VPN (Virtual Private Network)

A VPN (Virtual Private Network) creates an encrypted tunnel between a device, network or service and a VPN endpoint across an untrusted network such as the internet. Remote-access VPNs connect individual users, while site-to-site VPNs link networks. Encryption protects traffic in transit through the tunnel, but it does not make an infected device trustworthy or automatically restrict what an authenticated user can reach. A secure design also considers multi-factor authentication, device posture, least privilege, logging, split tunnelling, key management and redundancy. Performance depends on latency, bandwidth and the encryption endpoint. Some organisations use Zero Trust Network Access for more granular application access, but the approaches can coexist. Selection should follow the applications, users, risks and recovery needs involved.