0

I'm currently researching network security measures for my company, and I'm trying to understand the advantages of using a VPN (Virtual Private Network) compared to a combination of HTTPS (Hypertext Transfer Protocol Secure), DoH (DNS over HTTPS), and ECH (Encrypted Client Hello) for protecting our corporate network. I would like to delve into the technical details and explore the potential benefits of each approach.

Here's what I'm specifically interested in:

How does a VPN enhance security in ways that HTTPS + DoH + ECH might not? Are there specific threat scenarios where a VPN is more effective at safeguarding data?

note that all my applications are web based and also everything is on the cloud

I've already saw this: What does using a VPN offers over HTTPS + DoH in terms of protection? But asking more about it's security benefit for a company

Improve this question
1
  • VPN's aim to solve a different problem than HTTPS + DoH + ECH aims to solve. As pointed out by Steffen Ullrich in the question that you linked, a VPN creates a secure tunnel from the remote user to a private LAN, so that that user can access resources on the LAN which may not be available publicly. HTTPS + DoH + ECH does not provide this type of solution. So, the answer to your question will depend on what it is that you are trying to achieve.
    – mti2935
    Commented Sep 14, 2023 at 17:38

1 Answer 1

Reset to default
1

note that all my applications are web based and also everything is on the cloud

Based on this statement I assume that you care only about traffic from inside the company to some services in the cloud. And that you don't ask about the common use case of VPN in a company (include remote offices and mobile workers into the internal network), but instead ask about VPN to protect internet facing traffic.

When using just HTTPS + DoH + ECH your ISP still can distinguish between different connections to the target, observe the IP of the destination of your traffic, the amount of the traffic to these IP and the traffic pattern. This might be used to defer the kind of activity and maybe even the site you are visiting.

With a VPN the ISP all connections and traffic merged together and only traffic to the VPN provider instead of the real destination. This makes analysis of traffic pattern much harder. Note that now the VPN provider can see all the details the ISP could before, so it might be recommended to use HTTPS + DoH + ECH even within the VPN tunnel.

If this difference adds security for your specific company is unknown though. But if the company does not trust the VPN provider any more than the ISP then the additional VPN tunnel likely does not increase security or privacy.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .