Should my business be using a VPN (virtual private network)?

A Virtual Private Network (VPN) is a secure way to connect to in-office network devices, files, and applications from outside of the physical office network. VPNs are still widely used in businesses of all sizes. But with emerging technologies, the rise in cloud computing, cloud applications, and modernized cybersecurity models, deciding whether to implement a VPN as a small business depends on a few variables specific to your business.  VPNs don’t make sense for all businesses but when used in the right environment, a VPN can strengthen SMB cybersecurity practices and have a huge impact on productivity and efficiency in business operations.

Behind the scenes, IT Professionals utilize VPNs for a variety of reasons but in this article we’ll focus only on the most typical small business set up:  a remote employee trying to access files or application that are only accessible when in their business’s physical office location.   

      First, there’s a few things you’ll need define clearly before using the rest of this article to decide:  

1. What needs to be accessed?
2. Who needs to access it? 
3. How Often do you need to access it? 

What Needs to Be Accessed?

VPNs are used to access local resources:  File servers, File Storage Devices, Physical Devices such as a specific PCs or servers, network devices, or applications that can only be accessed when you’re in the office.  

If you need to access more than one of these while at home or travelling, a VPN may be useful.  

If you only need to access files, and nothing else, a VPN may be a solution. But you’d benefit from exploring other ways of accessing files, like implementing a cloud storage service that can be accessed securely via the web. If your business has a firewall already, a VPN can usually be set up at no extra cost.  If you’re considering buying a firewall to implement a VPN, compare the cost of entry-level firewalls with implementing cloud file storage or consider using a service like SharePoint or Sharefile. 

Who Needs to Access It?

Plenty of small businesses set up VPNs for just one critical employee, but it’s usually implemented when more than person has a need. There are few things to consider about the person or people who need to access in-office assets from remote locations.  

Apply the least privilege principle; consider the business case for needing access and establish whether that need supports the cost of implementing – including potentially purchasing a firewall or additional lite work PC for that person to access the VPN from.

Connecting to the VPN from a personal computer is strongly discouraged, as it can open your work network to a slew of cyber threats.  If the person requesting remote access to assets has a work laptop that travels with them, then it’s a safe solution.

VPNs do often have simultaneous connection limits, but those limits are usually in the hundreds (200+).  Keep in mind that the more people are connected, the more impact on firewall and network performance, causing slower response times or network drops.

And lastly, consider the technical ability of those needing to connect. VPNs require a client application to be opened, credentials, 2FA, and basic network troubleshooting skills. If setting up a VPN, make sure that staff can use it independently or that they have resources to call when they’re having trouble connecting.  VPN clients can be finicky and require a steady, strong internet connection.  When competing with other streaming services on a home network like Netflix or online gaming, VPNs are often the first to be dropped, causing frequent disconnects.

How Often Do You Need to Access It?

CEOs who often find themselves heading to the office every weekend are usually the first to consider remote access.  For frequent needs, several times a week or more, a VPN can be an absolute game changer.  No commute time and better work life balance can have a positive effect on productivity when overtime is needed or to give employees the option of remote work when needed. There’s an added benefit of reduced response time for critical issues that require employees or management to be available at the drop of a hat.

Infrequent access needs, perhaps less than 10 times a year, may still be a valid reason to set up a VPN but should be considered in the context of the overall business need. Sometimes, it’s simply more efficient to head to the office.

VPNs can be a powerful tool for enhancing security and productivity in certain business environments, they are not a one-size-fits-all solution. Assessing your specific needs provides a better framework for determining whether a VPN is right for your business. As technology continues to evolve, so do the options for secure remote access. The final thing to consider is the future-state of your business. If you anticipate moving to a fully-cloud infrastructure within a year or two, a VPN may not be worth the investment of money, time, training, and support.  If there’s a solid use case considering the above, it’s a great way to ensure secure, fast access to support your business.