Bring your own privacy: VPNs for consumers and orgs
Credit to Author: Malwarebytes Labs| Date: Fri, 06 Mar 2020 17:24:33 +0000
VPNs (virtual private networks) have been popular for quite some time now, and they’re worth a huge amount of money for the companies working in this area. They’re also at the forefront of combating potential repression and censorship around the world.
It might all sound a bit esoteric and unrelated to your general day-to-day requirements, but VPNs are absolutely a mainstream topic whether at home or in the workplace. The question nowadays probably isn’t so much “Do we need a VPN?” as “How do we get the most from the VPN we just bought?”
With that in mind, let’s cut right to the chase: We’re going to go over the pros and cons of jumping on the VPN bandwagon. With any luck, you’ll have a better idea of some of the perks and pitfalls associated with this realm.
It is, of course, worth mentioning the calculated risks taken when signing up to a VPN provider. If you’re determined to keep your data safe and your anonymity preserved, that’s great. However, that idea goes out the window if you simply sign up to the first service you come across.
VPN cons: fakes, rogues, and the long arm of the law
Please don’t fall into the trap of thinking, “I have my VPN, and now I’m a digital immortal.” There’s nothing worse than overhyping theoretical protections from all things unpleasant.
For example, 100 percent anonymity isn’t a guarantee—how can you be sure that provider X doesn’t keep logs? Is it true just because they said so? What happens if law enforcement turn up at their door with a warrant? They’re not going to get into a tussle with the law if they can help it, so it’s likely that whatever they do have, is headed in the general direction of the powers that be. This does rely heavily on where the VPN is located, so all cases are different—something to keep in mind when making a selection.
Mobile considerations
Mobile apps are incredibly popular for VPNs, with a significant chunk of younger users adopting the technology (some 70 percent of users are aged 35 or under). There are even pronounced differences in usage in the same cohort, so it’s a bad idea to guesstimate who is doing what.
Combine an unpredictable user base with countless mobile stores—some of which inadvertently play host to rogue apps—and this means unscrupulous individuals will move into the territory and try to scam people. Code injection for advertising, undisclosed data sharing, and VPNs used to attack or spam other services have all been in the news at some point, and you don’t necessarily have to be on a traditional desktop to run into these issues.
Bad ads muddy the waters
We’ve also seen examples where dubious scare tactic advertising has sent device owners to install pages for “free” VPN solutions, which themselves have some worrying statements in their terms of service. All of this before we get to the timeless scam where no VPN exists at all and they just want you to install some keyloggers.
As you can see, then, it’s bad out there—but VPNs are absolutely an advantage when it comes to keeping yourself a little more anonymous and secure online. They’re not a magic bullet, but then nothing else is either. If you’re of the mindset to explore and do a little homework before making the leap, it could be one of the stronger tools in your security/privacy arsenal.
You’ve heard the warnings; now it’s time for the measured response.
VPN pros: Securing business, helping out at home
Long gone are the days where the view was anybody using VPNs has something to hide/is up to no good. People simply want a little more privacy at home. And for businesses, it’s one more layer they can wrap around their network. If you need to make use of a remote access, business-approved VPN to be able to get on the network in the first place, it’s one more potential obstacle for attackers to get through.
Given the path of least resistance for many attacks, it could be the additional step that makes them say “too much hard work” and move on to potentially less secure targets. It’s unpleasant, but that’s how a good chunk of criminals operate: Why jump through hoops when you can walk through someone else’s front door to achieve the same result?
You don’t have to go too far back to see a steady churn of “Will my boss fire me?” missives in relation to firing up a VPN on corporate networks. An odd thing to get hung up on, considering so many workplaces will happily offer up a business-approved VPN in the first place. (You really shouldn’t be playing games on the network either way, regardless of VPN, but that’s another discussion).
Coffee shops and public Wi-Fi
Many offices are not just scattered across different regions, but also make use of decentralised employees working everywhere from living rooms to coffee shops. It stands to reason throwing a VPN into the mix is going to be beneficial in those circumstances, too. Employees on the VPN are also helping to reduce the visibility of their network traffic while out and about.
A great way to attract unwanted attention is by sitting on public Wi-Fi uploading/downloading sensitive workplace files and folders. Snoopers observing may well decide to take a more sustained interest in your business dealings, and you’ve accidentally made the entire organisation a target.
You could argue that you make yourself stand out more by overtly hiding what you’re doing in a room full of people surfing in the clear, in much the same way people making their Wi-Fi routers invisible is a large red flag. Having said that, I’d still rather lock things down while out and about versus the minuscule risk of a random person being so obsessed with you using a VPN that they make it their life’s work to take you down, instead of shrugging and buying another coffee.
If anything, it’s probably quite reassuring for employees to know they have an additional safety blanket out on the road. When every other horror story tells us never to use airport hotspots or web cafes because someone evil is definitely going to hack you and steal your briefcase, it’s something you can give employees to even the odds.
Going undercover
One of the most common benefits of a VPN is hiding your location. If you fire up the TOR browser, for example, you can appear as though you’re in Mexico to the owner of the website you happen to be browsing, when you’re actually in Italy. Researching scam websites that only respond to mobiles? Easy: change your user agent string so it thinks you’re on an Android or iPhone.
Want to watch that show from the streaming service you’re signed up to, but it doesn’t work outside your region while on holiday? How about MMORPG gamers who get better performance from a different region’s server than their own but have no straightforward way to connect? That’s where the VPN, and its path to gamer glory, begins.
Regional reflections
Using a VPN has clear benefits for workplaces where employees travel a lot and security policies may insist on certain IP addresses/regions connecting to the network. You can’t get on the US network if you’re sitting in France, on a French network, with a French IP.
Depending on your role, you may need to access geo-locked third-party content excluding some regions but not others—if you can’t access the content, you may experience significant impact across the business. Whether people should be doing this is, of course, another discussion to be had, but there’s no point pretending people don’t do it.
The humble VPN is here to stay
The verdict, to me, is very much in favour of VPN use. Whether you need it or not, VPNs can scale based on whether you want them for business or pleasure, and which essential tasks simply cannot be completed without one.
Like most tech tools, researched well and used correctly, it’ll be a great benefit to your day-to-day activities. Used poorly? You could end up running into one of several issues highlighted at the start of this post. The one situation you don’t need is your VPN being the kind of compromising element you were hoping to avoid in the first place.
The post Bring your own privacy: VPNs for consumers and orgs appeared first on Malwarebytes Labs.