The difference between DirectAccess and VPN

In this article we will discuss the difference between DirectAccess and VPN.

DirectAccess has a lot of features that make many users confused with VPNs, but the fact that DirectAccess is not the same as VPN. So how to distinguish the differences between them. In this article we will introduce you to this difference by placing them in scenes with different client types on the network, then observing important connectivity and security issues for each type. this client.

Client types

To begin this discussion, we acknowledge that there are three general types of clients that are:

The client is 'bolted-in' inside the corporate network

'Bolted-in' clients inside a corporate network are systems that may or may not be 'bolted in' properly but will never separate from the company's internal network (which can be interpreted as machines). Guests are tied to the corporate network. This system is a domain member, a managed system and never exposed to other networks. Internet access of this network is always controlled by the application layer inspection firewall, such as the TMG firewall. USB and other communication slots are physically blocked or managed strictly, access to the building where these computers reside is only allowed for trusted employees and passengers. These systems are installed with anti-malware software, configured via Group Policy or some other management system to maintain the desired security configuration, Network Access Protection (NAP) is enabled on the network to Prevent fake systems from connecting to the network and accessing company resources. Windows Firewall with Advanced Security is enabled and configured to reduce the risk of threats emerging from the network worm.

The concept of 'bolted-in' clients in the corporate network is nearly as ideal as the idea of ​​secure clients:

You can imagine this is an ideal system in the form of network security, so how is this feature realistic? How many guest systems have you never left your corporate intranet? And even if there is proper control, how do they avoid attacks? We need to consider the following aspects:

Implementing security thanks to diligence is an ineffective lesson. What is clear here is that, even in an ideal situation for 'bolted in' clients in the corporate network, there are still many things that may not be expected and lead to Serious accidents of security. You still need to do everything to make sure your computers are safe, keep them updated and manage them best - but need to put yourself in the perspective of computers. How to isolate and cannot move clients in the corporate network compared to other types of client systems.

Finally and perhaps most importantly, you need to know whether or not the 'bolted-in' client concept in a corporate network is probably just a concern. How many of these clients exist in corporate networks today - especially those in which the majority of employees are knowledgeable? In such an environment, you can assume that VDI is a feasible solution, because the tasks they perform do not require many functions provided by the full computer environment, but the employees knowledgeable need the flexibility and power provided by a complete computer platform. In addition, more and more companies realize the advantage of remote communication and more and more employees work from home or connect to the corporate network while on the road. These problems have arisen for us:

Roaming remote access VPN client

In the 1990s, it was common to use 'bolted-in' clients in the corporate network. However, by the second decade of the 21st century, employees need to work more and more on a mobile basis, which has resulted in roaming remote access VPN clients. Knowledgeable computer personnel can hold high-profile laptop computers to work, home, to customer locations, to hotels, seminars, airports, etc. is anywhere in the world where there is an Internet connection. In many cases, after accessing the Internet in many different locations, they brought their laptops back to the corporate network.

Roaming remote access VPN clients again pose a very different way of security than 'bolted-in' clients in the corporate network. A point like 'bolted-in' clients in the corporate network, these computers are domain members, installed with anti-malware software, activated Windows Firewall with Advanced Security and fully configured with consensus with company privacy policy. Initially roaming VPN computers provided to users are as secure as 'bolted-in' clients in the corporate network.

However, that security status and configuration did not last long. Users may not connect to the company intranet via VPN connection for days or weeks. Or they can connect daily for a week or two, then not connect for a few months. During the transition period, roaming VPN clients gradually lose their consent. Group Policy Group Policy is not updated, antivirus updates, and malware are not updated in time. Security policies and controls applied to clients located on the corporate intranet may not be feasible for roaming remote access VPN clients because they cannot connect via VPN with them. way.

The fact that roaming clients are not catching up with the company's configuration and security policies is becoming more and more serious because this computer is often connected to many untrusted and unsecured networks. all. These unreliable and insecure networks can have many network worms as well as other threats.

What happens when users bring their computers back to the corporate network? What happens if their computers are compromised by worms, viruses, Trojans or some other type of malware? The danger can be limited if you enable Network Access Protection on the network, but how many networks have enabled NAP, even though this feature has been available for years as part of Windows Server 2008?

Obviously users should not bring compromised computers back to the network. Suppose a certain user connected their computer to a number of different networks and eventually the computer was compromised. After three months he needs to change his password so he made a connection via VPN to change the password. In this case the disastrous security consequences will be similar to the case where this computer is physically connected to the corporate network.

As you can see, roaming has generated a lot of security issues compared to 'bolted in' clients in the corporate network:

The main difference between roaming VPN clients and 'bolted-in' clients in the corporate network is that VPN clients are often out of control and exposed to a large number of threats. However, there are many ways to mitigate some of these threats and many companies have introduced such implementation methods, such as:

Using some of these measures will greatly reduce potential threats to remote access VPN clients. While it is not levelable compared to 'bolted-in' clients in the corporate network, there are some scenarios where roaming remote access VPN clients can reduce the risks. . We will look at one of the methods in this section.

DirectAccess client

We are talking about the DirectAccess client theme. Like VPN clients, this computer can be moved from the corporate network, to a room in a hotel, conference center, airport, or anywhere a remote access VPN computer. via roaming can exist. The DirectAccess client will be connected to both a trusted and untrusted network, just like a remote access VPN client, and the risk of a computer's physical compromise is similar to that seen for the machine. VPN guests. So if you compare, the DirectAccess client and VPN are basically the same as before the security perspective.

However, there are still some significant differences between roaming and DirectAccess:

When comparing the DirectAccess client to the remote access VPN client, you will see that the DirectAccess client appears less secure than VPN, this is because the DirectAccess client is always in the control of the group. IT company. Different from VPN clients, they may or may not connect to the corporate network for a long time, which can easily lead to failing to keep up with common security configurations and increasing the risk of security compromise. In addition, the above mentioned mitigation methods applied to remote access VPN clients can also be brought to use with the DirectAccess client.

So far we have achieved our goal of comparing roaming remote access VPN clients and DirectAccess clients, evidently all that is demonstrated in this article shows the DirectAccess client showing the safer in the general security of the company compared to roaming implementation.