Executives have serious concerns over VPN security

The increased pressure from remote working during the COVID-19 pandemic is putting pressure on existing virtual private network (VPN) implementations, according to new research from security company Zscaler.

In January, Zscaler surveyed IT and cyber security professionals in companies spanning multiple sizes and sectors to assess their approach to VPNs. The survey focused mainly on senior executives, but it also got opinions from managers and consultants.

Companies are coping with a challenging remote work environment. The survey found complex conditions, as 45% of companies cope with employee-owned devices connecting remotely to their infrastructures. They also ran their private applications on a range of infrastructures, with 67% running in the data center and 44% in private cloud environments. The public cloud also featured heavily in respondent infrastructures, with 37% running their applications in AWS, 32% in Azure, and 12% in Google Cloud.

This complexity extends to the VPNs they're using. The research found 41% of companies had over three gateways, with 21% running five or more. COVID-19 has contributed to VPN usage growth, as a third of companies that increased their VPN capacity did so by at least 50% to cope with the growth in remote working sessions.

The report suggests these VPNs aren’t keeping up with the increased pressure created by work-from-home mandates. A lack of visibility into user activity was the biggest concern, worrying almost a quarter (24%) of respondents. Nearly one in five (19%) were concerned that VPNs still required giving people access to the corporate network.

The VPNs themselves are also subject to attack, as 94% of respondents are aware their VPNs were open to cyber attacks and other exploits. Social engineering and ransomware are the biggest concerns, keeping three-quarters of respondents up at night. Malware came third, with six in ten people identifying it as a top threat.

Nearly three-quarters (72%) of respondents worry these security concerns might hinder their ability to secure their environments. Nevertheless, VPNs are still the top choice for remote access, as 93% of the companies surveyed use VPN services. People are gradually moving beyond VPNs, though, with 67% of respondents considering alternative remote access forms.

Zero-trust models are at the top of the list of alternatives, with 30% of companies already rolling out those solutions. Another 42% are in the early planning stages of zero-trust access. Work-from-home pressures have created a greater sense of urgency, with 59% accelerating their efforts due to the remote work focus.

This research echoes another report released in early February that also highlighted VPN security concerns among IT professionals.