There are two main technologies used to implement tunnelless VPNs: Secure Sockets Layer (SSL) and Group Encrypted Transport (GET).
Of the two technologies, you're more likely to encounter SSL-based VPNs on today's networks, only because GET is a relatively new technology. SSL-based VPNs offer remote users secure access to internal applications without the use of an IPsec VPN client. SSL VPNs are most commonly used to share Web applications. In this case, users connect to the SSL VPN, authenticate and then gain access to selected applications though the VPN server, which acts as a proxy. Generally, this setup is more secure than that of an IPsec VPN, as it allows you to strictly control a user's access without granting direct contact to the underlying network. Many SSL VPNs also offer the download of a browser-based client that allows more extensive access to the protected network, including the use of client/server applications. In this case, the security risks are the same as an IPsec-based VPN.
Group Encrypted Transport (GET) is a relatively new technology that's proprietary to Cisco Systems Inc. Networks running GET encrypt the payload portion of a packet only, allowing the address information to remain unencrypted. This provides enhanced networking functionality, permitting the use of quality of service (QoS) to prioritize encrypted traffic. However, GET also exposes VPN users to the risk of traffic analysis, as eavesdroppers may be able to determine their usage patterns from the unencrypted portion of the packet. For more details on GET, you may wish to read more about the recent debut of Cisco's tunnelless GET VPN technology on our sister site, SearchNetworkingChannel.com.
Dig deeper on SSL and TLS VPN Security
Related Q&A from Mike Chapple, Enterprise Compliance
Social media compliance is not typically considered a big issue for companies, but expert Mike Chapple explains why it should be.continue reading
Metadata tagging is not just for security. Expert Mike Chapple explains how tagging tools can be used to achieve PCI DSS compliance.continue reading
Before using the HIPAA-compliant cloud services from Google, there are some things companies need to know, according to expert Mike Chapple.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.