1

A popular new idea at the company I am working for is to remove worldwide access of web applications and restrict them to the internal network only, allowing remote users to work with them through VPN only.

As we have thousands of users, one major problem with this approach is that VPN resources have to be ramped up quite a bit to handle all of them. Also it is a problem to give new users access to this VPN so that they can start using it at all.

This brings me to the question, is VPN really more secure than having an authentication proxy which forwards (HTTPS) traffic to an internal web application (which itself is not accessible from the internet directly) after a successful authentication (only)? If yes, could someone explain why that is?

To be a little bit more precise on the goal: This measure is intended to minimize the risk of (unauthenticated) attackers compromising web applications in any form. The idea is that if they can not access it, they can not exploit possible security holes that those application might (and usually do) have.

My question is wether a simple Proxy can do as good of a job as using VPN.

PS. It is clear that none of this helps if we have an authenticated user (e.g. a phished account).

3
  • "more secure" -- against what threat? You need to define that. It looks like you are trying to use VPN as an authentication method, not as a network access method. As you suspect, that's overkill.
    – schroeder
    Commented Dec 6, 2023 at 12:37
  • I have added some more information, although I can not get much more precise. PS. Regarding "I am trying": I have no say in this matter, this question is purely to educate myself and possibly other interested people. Commented Dec 6, 2023 at 12:52
  • Welcome to the community. It's not quite clear what your actual goal is... Commented Dec 6, 2023 at 15:59

2 Answers 2

0

There is no generic "VPN is more/less secure to an authentication proxy". It depends on the actual implementations and how they are deployed.

An authentication proxy might provide more security since it might have a more granular access control, i.e. not only accessing the application itself but also restricting access to specific URLs/actions. A VPN instead works only at the network level and has no visibility into the URL. And often a VPN allows access to the whole network instead of restricting it to the specific application.

A VPN usually runs as some process on the client device. This process can collect information about the security of the device, which then can be included in the access policy. A VPN might also be part of some endpoint protection which does way more then VPN, for example enforcing strong user authentication, enforcing encrypted disk, enforcing current patches and current patterns against malware etc. A browser based access with an authentication proxy in between does not provide any of this.

0

It depends on your particular security and functionality needs, which is better, and it depends on what software you use and how.

The benefit to a web-based authentication proxy is that it's more granular, and it can be combined with things like SSO to make sure that only the right people are authenticated, and it's easy to force the addition of 2FA (especially strong 2FA like FIDO2). Typically, browser implementations of TLS are robust, and so this offers good cryptographic security. However, the same functionality that makes this work really well in the web browser makes it work terribly for automated tooling like Git.

The benefit to a VPN is that it works at the network level and so all the traffic is encrypted, including, usually DNS. It also works well with automated tools because, again, it works at the network level. Some VPN environment use older, poor-quality cryptography, such as 3DES and SHA-1, so you need to be careful to configure secure algorithms. You can often add 2FA, but it's harder to add support for things like FIDO2.

Both can support some sort of endpoint integration. If you're managing devices, then there are some authentication proxies that can integrate with a local endpoint management tool that will only authenticate to the SSO for the authentication proxy if the device is secure. VPN software can do this natively as well, although it does not always work well across platforms.

I have also seen a hybrid approach. The web-based authentication proxy is used for most things and includes a FIDO2-based 2FA. To connect to certain restricted resources that must be on the same network, the VPN is used and a site behind the web-based authentication proxy (with a very short FIDO2 2FA timeout) is used to grant a special 2FA token for the VPN.

As for authentication proxies which are simply a regular HTTPS or SOCKS proxy, typically those tend to be less secure than either, since they don't offer 2FA in a standard way. Also, many tools simply don't support proxies, so that makes using them rather difficult.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .