A virtual private network (VPN) needs no introduction. Not only have you heard of it, but you are also likely using one on a daily basis. But traditional VPNs were invented over two decades ago at a time when enterprise applications were hosted in local data centers and most of the workforce worked on-premise.
Today, enterprises operate quite differently, and the network perimeter VPNs were designed to protect has practically dissolved with the increasing adoption of cloud-based infrastructures.
A typical enterprise now has dozens of applications hosted on public cloud platforms like Amazon AWS not to mention how most, if not all, company workforces, big and small, are now thriving in remote working environments out of necessity.
So while traditional VPNs allow secure remote access, more is needed for modern distributed corporate networks. The fact that many of today’s applications and data are no longer behind a single network perimeter—they have moved to the cloud—calls for the need for a new, next-generation VPN.
Enter software-defined perimeter (SDP) technology.
In this post I’ll show you what SDPs are and how they work as well as their key advantages over VPNs. As you will discover, SDPs are the way forward, so it’s important to be informed of their key characteristics.
What Is a VPN?
Before we dive into SDPs and their key differences compared to VPNs, let’s quickly recap what a VPN is.
As the name suggests, a VPN provides users with a virtual network that is private so they can connect to the web in a secure and anonymous manner.
A VPN creates a secure connection—a private “tunnel”—between your device (your laptop or smartphone) and the internet. It serves as an intermediary when you go online, hiding your IP address—your personal identification code that reveals your location and makes your identity and activities traceable—thus helping conceal your identity.
In other words, the private network lets you send your data via an encrypted, secure connection (using different protocols like IPSec, SSL, WireGuard, etc.) to an external server. From there, the traffic is sent to the internet. In this way, your IP address shown online is also modified.
So, in short, a VPN helps users connect to online pages and applications securely. As long as it’s active, it keeps their connection and data private and allows them to route (and anonymize) their traffic through various globally-placed servers.
What Is an SDP?
SDP is an approach to cybersecurity based on the Zero Trust Security Framework. SDP is designed to provide the same user experience regardless of whether the user is on-premises or beyond the network’s perimeter while granting access to only the resources users need.
This ability to provide the same experience means that users don’t need to remember to connect the way they would with a current-generation VPN.
The term “perimeter” often creates confusion, since it’s conventionally used to refer to elements like demilitarized zones (DMZs) and firewalls. Despite the rather confusing terminology, SDP takes the exact opposite approach.
As opposed to conventional enterprise architectures, which detach the enterprise network from the outside world by a fixed perimeter, SDP dynamically creates one-to-one network connections between each user and the resources they access. All unauthorized network resources are inaccessible.
According to Gartner, “enterprise access requirements are growing ever more complex due to application dynamics, cloud adoption, and mergers. To cut through this complexity, technical professionals should explore SDP — a new technology whose strength lies in facilitating access to enterprise apps.”
An SDP is leveraged as software on end-user devices, controllers, servers, or gateways. It can be deployed either as a standalone product or as a cloud-hosted service.
SDP vs. VPN: Why SDPs Are the Way Forward?
With a clear understanding of software-defined perimeter and virtual private network, let’s look at the key differences between both and how SDPs are the next generation of VPNs.
| Facet | SDP | VPN |
| Security |
|
|
| Management |
|
|
| User Experience |
|
|
Overall, SDPs are better than traditional corporate VPNs. Firstly, they offer stronger security, as they allow tighter control over data access, minimizing the attack surface and risk to the enterprise network. An SDP has an identity-based approach that enforces a customized policy for each user device, whereas VPN access is overly permissive, granting remote workers access to more of the network than is required to complete their tasks.
SDPs also offer better user experience, whereas VPNs are often unreliable and slow. In contrast, with SDPs there’s a global network of points-of-presence, or PoPs, that provides a network backbone that reduces latency and optimizes the routing of data.
Another area where SDPs have an advantage is that they offer greater scalability. For many companies, VPNs are installed and expanded as demand requires. As the business grows and adds additional VPN connectivity to provide support for business partners and customers, both the management complexity and costs rise significantly.
Conversely, with a fixed price per user, regardless of how many network resources the user needs to access, an SDP solution with a cloud-native infrastructure can quickly, easily, and affordably scale up to thousands of concurrent users relying on a backbone of global PoPs.
Moreover, despite these advantages, SDPs generally come at a reduced cost. An SDP cloud platform will typically not charge by the number of data centers or sites added but rather by the number of users connected, which results in lower total costs. This is not the case with VPNs, wherein adding multiple sites, data centers drive up costs due to the need for additional infrastructure and licenses.
In fact, Gartner predicts that by 2023, 60% of enterprises will phase out most of their remote access virtual private networks (VPNs) in favor of Zero Trust Network Access (ZTNA) security models like SDPs. And so, SDPs clearly seem to be the way forward.
SDP Is the Way Forward
With improved end-user experience, better scalability, and greater flexibility, SDPs provide not only all the features of a current-generation VPN but also solutions to many disadvantages of VPN like tighter security, including application-based security.
SDPs let you adopt Google’s BeyondCorp approach of a zero trust model without changing your network infrastructure or applications. Remote employees, partners, contractors, and customers can all have easy, granular access to specific resources without the need for a traditional VPN.