There are two main technologies used to implement tunnelless VPNs: Secure Sockets Layer (SSL) and Group Encrypted...
Of the two technologies, you're more likely to encounter SSL-based VPNs on today's networks, only because GET is a relatively new technology. SSL-based VPNs offer remote users secure access to internal applications without the use of an IPsec VPN client. SSL VPNs are most commonly used to share Web applications. In this case, users connect to the SSL VPN, authenticate and then gain access to selected applications though the VPN server, which acts as a proxy. Generally, this setup is more secure than that of an IPsec VPN, as it allows you to strictly control a user's access without granting direct contact to the underlying network. Many SSL VPNs also offer the download of a browser-based client that allows more extensive access to the protected network, including the use of client/server applications. In this case, the security risks are the same as an IPsec-based VPN.
Group Encrypted Transport (GET) is a relatively new technology that's proprietary to Cisco Systems Inc. Networks running GET encrypt the payload portion of a packet only, allowing the address information to remain unencrypted. This provides enhanced networking functionality, permitting the use of quality of service (QoS) to prioritize encrypted traffic. However, GET also exposes VPN users to the risk of traffic analysis, as eavesdroppers may be able to determine their usage patterns from the unencrypted portion of the packet. For more details on GET, you may wish to read more about the recent debut of Cisco's tunnelless GET VPN technology on our sister site, SearchNetworkingChannel.com.
Dig Deeper on VPN security
Related Q&A from Mike Chapple
Choosing to encrypt confidential data with AES or DES encryption is an important cybersecurity matter. Learn about the important differences between ... Continue Reading
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ... Continue Reading
The HHS OCR ruled that healthcare ransomware attacks are HIPAA violations, so these covered entities need to react according to the HHS's guidance. ... Continue Reading