Organizations could enforce Always On VPN connectivity for mobile and travelling users to ensure all workflows are performed through a secure, encrypted tunnel connected back to the organization's on-premises network.
Control Type: Technical
Control Function: Preventive
Many organizations have employees that are constantly traveling, meaning they are accessing the organization’s digital assets from a variety of different networks. By modern cybersecurity standards, it is not acceptable to give any level of inherent trust to any of these networks. The organization has no idea how secure these networks are or who else is on them. Even a trusted employee’s home network should not be given any inherent trust.
An Always On VPN is a security control that helps mitigate this issue. In typical remote access VPN deployments, the user has their VPN profile and the VPN software installed and connects whenever they need to access the organization’s network. Since this is done at the user’s will, there is no guarantee that they will use the VPN all the time, including when accessing insecure networks.
Always On VPNs ensure that the VPN is constantly on and connected from power on to power off. The user does not have to initiate connection themselves, as the VPN is configured to establish a tunnel whenever power is given to the device. Thus, the device’s network activity is continuously kept inside a secure, managed tunnel back to the organization’s on-premises network.
This functionality is highly recommended if mobile employees utilize company devices for their work, as it is completely within the organization’s rights and interests to ensure secure connectivity for their devices. The Always On VPN can be configured via policies, including policies to prevent the end user from disconnecting. For BYOD scenarios, the Always On VPN can be enforced on work profiles. So the end user still has control over their actual personal device, but they agree to perform all company workflows on a separate work account that is managed at the organization’s discretion, including enforcing 24/7 VPN connectivity.