What VPNs still do better than ZTNA

Disclaimer: The views, thoughts, and opinions expressed in this guest post belong solely to the author and do not necessarily reflect the official policy, position, or views of OpenVPN Inc.

---

“VPN is dead.”

How many times have you heard/read the above sentence or something to that effect? If your answer is “a lot,” you’re at the right place to prove those doomsayers wrong.

As with everything in life, the situation is not black and white. There are always shades of gray (though not 50 of them) that show a different story. Yes, Zero Trust Network Access (ZTNA) is conceptually sound and great at what it does. Yes, it’s better in some cases than a good ole VPN, particularly when handling third-party contractors. And no, it doesn’t beat VPN at every game — far from it.

To begin with, so many people in wildly varying ways are accessing critical resources these days, which makes certain approaches better or worse for specific circumstances.

This particularly holds true for SMBs, where a VPN provides the best balance of security, simplicity, compatibility, and cost. On the other hand, ZTNA benefits (great as they are) often come with more complexity and expense that smaller organizations, in all likelihood, may not need.

Two differing philosophies

Comparing what VPNs do to ZTNA is much like comparing apples and avocados, let alone oranges. Both are remote access tools, but look and act differently under the hood. As such, they represent two opposing security philosophies trying to solve the same problem of getting a remote worker connected to corporate data.

To get a better idea of why the humble VPN still has an edge in several scenarios, we first have to look at how these philosophies operate.

VPN philosophy

The contrast between VPNs and ZTNA tools stems from the fact that they operate at completely different layers of the networking stack.

Traditional network access operates at the Network and Transport layers of the OSI model. When an employee connects via a business VPN client, the software creates a secure virtual network interface card (NIC) on their laptop, assigning it an IP address from a private pool.

However, nobody says that business-grade VPN servers have to be a wide open door. It’s true that basic consumer-oriented setups grant unrestricted access to an entire network, but a professional business VPN has its own way of doing things. Namely, it allows administrators to implement identity-driven routing rules and Access Control Lists (ACLs).

That’s not all. The current crop of business-grade VPNs isn't a one-size-fits-all setup. You have the freedom to choose the deployment posture that fits your team's skills and infrastructure:

• Self-hosted: You install the server software directly on your physical hardware, a local virtual machine, or within your private cloud partition. This gives your business absolute data sovereignty and total control over your traffic tunnels.
• Cloud-delivered: For situations when you want to bypass server maintenance entirely, a cloud-delivered virtual network-as-a-service (NaaS) is a good fit. It provides you with the same network-level routing simplicity, and the backend is fully managed in the cloud for you.

Let’s say a remote contractor logs in. The VPN server authenticates them and applies a specific group policy. As a result, they can route traffic directly to the specific development server they need, and that’s it. The server actively drops any packets as soon as the contractor tries to send them to the accounting subnet, for instance.

The benefit here is targeted access control executed at the network level. The remote device continues to interact natively with the infrastructure, making data movement fast and predictable, not to mention fairly easy to deploy.

ZTNA philosophy

As the name gives it away, ZTNA throws the concept of network-level trust out the window and shifts everything up to the Application layer (Layer 7) using a reverse-proxy architecture.

In real life, a remote worker's laptop never touches the corporate network. A local software agent intercepts individual application requests and forwards them to a cloud-hosted broker run by a third-party security vendor. Then, that broker evaluates the user's identity via an external cloud identity provider and verifies the device's posture. If they like what they see, they create a temporary, isolated bridge directly to that single application interface.

The employee can then interact with the company’s CRM or accounting portal, but that's about it. In case they open a command prompt and try to ping an adjacent server on the same subnet, the request will fail because the network layer is entirely invisible to them. They only have access to a specific port on a specific asset.

Why this matters to SMBs especially

One firm look at the raw IT mechanics reveals that a direct feature-for-feature scorecard makes little sense, if any. ZTNA is an intricate and highly secure identity-checking framework that requires a hefty amount of configuration to stitch together applications, users, cloud policies, and whatnot. On the other side is a simple (by comparison) and trusted network pipe.

Yet, there’s another thing that becomes quite obvious, which is the sizable (that’s perhaps putting it mildly) architectural tax ZTNA demands to achieve security goals. A business must overhaul its infrastructure around a mazelike web of multiple parties and entities, with a finishing touch of granular application-layer policies.

As you can imagine, SMBs can rarely deal with such a level of complexity. In some instances, the resulting operational burden may be too heavy. SMBs need to protect their resources and restrict user access, but not at the cost of an over-engineered enterprise identity proxy.

Setting up a business-engineered VPN is often far more practical, more so if we’re talking about a handful of users who just need to access a local server or two. An SMB can enforce strict, role-based access control and identity verification directly within a trusted network pipe, thus getting enterprise-grade data control without the enterprise-grade headache.

Five areas where VPN is a better fit than ZTNA

With a technical baseline established, here are five day-to-day business realities where a VPN clears the bar for SMBs compared to its advanced cousin.

1. Total cost of ownership (TCO)

We start with the factor dictating almost every business decision: the bottom line. Budget is the ultimate decider of what gets done, and nowhere is it more evident than in the SMB world.

Large companies have the luxury to simply shrug off huge SaaS bills as the cost of doing business. On the other hand, their smaller peers have to account for every single dollar. These financial differences quickly become glaringly obvious when you scratch beneath the veneer.

What a business VPN does

It primarily operates on a flexible concurrent connection model. This means you only pay for the maximum number of devices connected to the VPN at the exact same time. You can create 20, 50, 100, or more employee profiles in your user directory, but if only 10 people are working remotely at any given hour, you only need to license 10 active connections.

What’s even better is you can give the business VPN a test drive at no extra cost (some vendors offer forever free plans) with a limit of active connections to see if it’s a good fit before spending a dime. And when/if you opt to scale, paid tiers are generally rather affordable.

Even if you choose a fully managed, cloud-delivered virtual network option, the scaling model remains wallet-friendly. Instead of hitting you with a pricey baseline bill, managed virtual networks often let you get started with a handful of free connected devices, keeping your upfront operational costs at zero.

Think of it as renting a pool table for your office breakroom. You only have to pay for the two cues that people are actively using to play a game. You don't have to pay a rental fee for every other employee in the building who might want to play a game at some point.

What ZTNA does

Here, we have a rigid, per-user, per-month SaaS subscription model. Every identity created in your directory requires a user license. It doesn’t matter if a part-time employee only logs in for two hours a week, or if their colleague is on vacation for the better part of the month — the ZTNA provider meters and charges you for their existence in the directory.

If we’re to stick with the pool table analogy, you’re also renting it in this scenario. However, the vendor charges you a mandatory monthly surcharge for each employee on your payroll, including those who aren’t quite keen on hitting the balls or have no plan whatsoever to pick up the cue.

2. Ongoing management

For an SMB, operational simplicity through IT sanity is the holy grail. Hence, a secure connection tool should run quietly in the background, not scream for attention every time an employee updates their computer.

What a business VPN does

Arguably, the most notable thing is a drastic cut in daily headaches by providing a centralized, web-based admin portal. As opposed to forcing you to micro-manage every data point, a VPN allows an administrator to quickly sort staff into broad, functional buckets per department.

Your job is to set up ACLs and connection rules once (stating exactly which subnets or internal servers each group can talk to), and the system handles the rest. It features automated multi-platform client software setups and built-in two-factor authentication (2FA), so users can log in securely without IT constantly holding their hands.

The analogy here would be setting up a shared office filing cabinet with color-coded drawers. You give the accounting team a physical key that opens the green drawer, and the marketing team gets a key for the blue drawer. Once the locks are installed, the drawers stay put and open whenever the right key is used.

What ZTNA does

Because ZTNA operates on absolute micro-segmentation by breaking down the environment into hundreds of isolated application pieces, it requires continuous policy updates.

As you can expect, it’s a high-maintenance task, since admins can't just point a user group toward a segment of the network. They must manually configure and maintain explicit permission profiles for each software tool, web portal, internal database, and so on.

ZTNA also relies heavily on checking device postures all the time. The software in charge constantly evaluates the remote device’s operating system version, firewall settings, and local security compliance, so the very moment a minor variable changes, the system can automatically lock the user out.

This is like replacing your filing cabinet with a fancy vault. Every time an employee wants to grab a document, the vault scans their fingerprints, checks their device, inspects their shoes, or does some other technologically impressive but ultimately arduous thing.

The caveat is that if the employee wears a new pair of sneakers one day or their computer runs a silent update in the background, the vault won’t recognize their current posture and will keep the door shut.

3. Setup simplicity and speed

Remote access needs to happen the very moment it's required, which is where VPN’s agility comes to shine.

What a business VPN does

It makes the most of the existing networking infrastructure. If you go the self-hosted route, the server can be launched in minutes as a pre-configured image directly from major cloud marketplaces (like AWS, Azure, or Google Cloud), or spun up on a simple virtual machine in your office.

If you decide on a cloud-delivered virtual NaaS, you simply connect your network and devices to a secure cloud portal, as there’s no need to provision a virtual machine.

Once initialized, the admin manages routing via a web interface, and that’s pretty much it. Some platforms even provide a self-service client portal where users can log in, download the pre-configured VPN app for their specific device (Mac, Windows, iOS, Android), and connect.

What ZTNA does

By contrast, ZTNA calls for a thorough remodeling of how your company's data flows. Because it elegantly bypasses the network layer, there’s no ‘on’ switch. You must first set up and integrate a centralized cloud Identity Provider (IdP) before you even write your initial security policy. Then, you have to audit your entire business (painstaking as it is) to locate every app, database, and server, and manually map out how they talk to one another.

From there, the final step is to install software connectors in front of each database and configure custom software agents on every user's machine. For small businesses that live and die by their ability to adapt to sudden changes, such a setup is unwieldy, to say the least.

4. Handling legacy systems and proprietary software

Not all SMBs are running on cloud-native tech stacks. In fact, 63% of SMBs have workloads in the public cloud, while 61% have data there. That leaves one-third likely powered by a customized piece of software from the past decade, maybe even older. And while these systems work fine, they were built before the cloud became the new black, so they don’t play nice with current security trends.

What a business VPN does

Because a business-grade VPN works at the network layer, it isn’t concerned with protocols in use and how your software talks. All it cares about is that data packets are moving from point A to point B.

Say an old(er) application uses custom TCP/UDP channels, dynamic port ranges, direct non-IP hardware addressing, or obscure legacy protocols. Like a good postal service, the VPN tunnel wraps those packets up and sends them along. That’s its sole responsibility.

What ZTNA does

For starters, it works amazingly well for standard web traffic (HTTP/HTTPS) or common remote protocols like RDP. But if you throw at it a custom-built application past its heyday that uses dynamic ports or non-standard protocols, ZTNA stutters.

The reason why that happens is the application layer where ZTNA operates. It has to actively understand the "language" of the application it is proxying. If the cloud broker doesn't recognize the so-called language of the traffic, it will assume it’s a security threat and instantly block it.

5. Access to on-premise tools

As much as tech evangelists want us to believe that everything has migrated to the cloud, the reality for some SMBs is cloudless. They still have local server closets, printers, routers, switches, NAS boxes — you name it; they probably have some under a thick coat of dust. In such an environment, the last thing you want is for your remote worker to play IT detective when wanting to print something or grab a file.

What a business VPN does

It bridges the gap between the remote worker and the physical office by supporting local network discovery protocols. These are what computers use to proverbially look around a room and say, "Oh, hey, there's a printer over there!" and perform the worker’s intended action.

In other words, the VPN allows a remote laptop to communicate directly with local IP addresses. So, you can use your local files and office hardware just as if you were plugged in at your office desk.

What ZTNA does

In a Terminator-like fashion, it seeks to prevent network discovery so that hackers can’t snoop around. ZTNA tools open single-lane pathways to specific web-based applications, which means they don’t understand the concept of talking to physical hardware. As such, they have no native way to route traffic to non-web office equipment.

To make an office file server or local printer work over ZTNA, you have to build complex custom software connectors and translate those local resources into web-friendly portals.

Simplicity still wins for SMBs

Gone are the days when a VPN meant, for the most part, a generic consumer app. In this day and age, it’s a corporate asset with robust, identity-driven access control.

Now, there’s no denying that ZTNA is a powerful framework, responsible for a fundamental change in how we deal with security. Never mind that most IT professionals can’t agree on what zero trust is. The sheer complexity and per-user SaaS tax are often incompatible with SMBs operating on tight budgets, with limited IT staff, tool sprawl, legacy tech, and so on.

The point is, nobody says you have to compromise on security to keep your setup simple and data protected. A VPN can be the solution, depending on your needs — whether you want to keep traffic close to your infrastructure and align with your existing security, or a fast rollout without daily management of VPN infrastructure. Just be sure you can manage and use it every day.