SSL VPN Gateways: A New Approach to Secure Remote Access
by Ken Araujo - CTO Netilla Networks - Wednesday, 5 November 2003.

Secure Sockets Layer (SSL) Virtual Private Networks (VPNs) are quickly gaining popularity as serious contenders in the remote-access marketplace. Analysts predict that products based on SSL VPN technology will rival – or even replace – IP Security Protocol (IPSec) VPNs as remote–access solutions. A number of factors are fueling the dramatic demand for SSL VPNs, including:
  • Government mandates – such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States – that are driving key industry segments to protect the privacy of distributed electronic information.
  • The increasing use of extranets – the granting of non-employees and business partners secure access to internal networks – which have become a “must have” requirement of conducting business.
  • Increased demand by employees for flexible working options that enable home working – a trend fueled by governmental regulations such as the Flexible Working Act in Great Britain that require employers to make reasonable accommodations for working parents of young children.
It’s not surprising that SSL VPNs are benefiting from these developments. SSL VPNs are uniquely suited to meet the diverse remote-access needs of today’s enterprise, with their low costs, application access flexibility, high security, and overall simplicity.

Traditional Solutions Fall Short

Until recently, VPNs based on the IPSec protocol have been seen as the logical choice for providing secure network connectivity beyond the firewall. IPSec VPNs leverage the Internet as an “always on,” ubiquitous data-transfer bridge, eliminating “private” network access costs, such as leased lines, Asynchronous Transfer Mode (ATM), or frame relay. IPSec VPNs offer a less-expensive alternative to dedicated networks, and have proven well suited for secure, on-demand point-to-point connectivity over the Internet.

However, remote-access IPSec VPNs bring security at a high price. Distributing IPSec clients to remote machines and configuring them for access is challenging, especially when the Information Technology (IT) department does not have easy access to remote computers. Further, because they operate at the network level, IPSec VPNs effectively provide the remote personal computer (PC) with full network visibility, as if it were a computer located on the corporate Local Area Network (LAN). Policy enforcement and security controls cannot be easily applied in this model. For these reasons, remote-access IPSec VPNs typically result in a high total cost of ownership (TCO), especially when compared to SSL VPNs.

SSL VPNs: Application Gateways for the Enterprise

The modern enterprise network is a dynamic environment. Inevitably, corporations deploy an ever-changing variety of applications for a diverse community of users. These heterogeneous data centers may comprise legacy and client/server applications on Windows Terminal Servers, UNIX/Linux servers, or mainframes and AS/400 machines, as well as Web applications that reside on intranet Web servers.

Historically, opening up this complex realm to remote partners, suppliers, and employees, while ensuring network protection, has been one of the great hurdles to a successful remote-access deployment. As a result, enterprises are turning towards SSL-based VPNs to satisfy the demands of today’s more heterogeneous enterprise networks.

Today’s leading SSL VPNs take this approach one step further, by consolidating three application-access technologies into a single application-layer gateway device:
  • Clientless, browser-based access to remote legacy applications
  • Secure intranet access to Web-based applications and portals
  • Desktop access for client/server applications over SSL tunneling
Clientless Access to Legacy Applications


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th