Compare network-level tunnels with application-level access.
Scope remote access by identity, device, and resource.
Identify split-tunnel and endpoint risks.
A VPN encrypts traffic between endpoints and can extend network reach, but broad reach can increase blast radius. A zero-trust application proxy may expose one authorized application without placing a device on the entire network. Choose based on the resource, threat model, device posture, and operational capability.
Remote access must handle lost devices, stolen tokens, unmanaged endpoints, DNS leakage, patch state, logging, and session termination. Encryption in transit does not make an infected endpoint trustworthy.
Exercises
Choose VPN or application proxy for three use cases.
Define device-posture checks for privileged access.
List controls for a lost remote device.
Self-check
What does a VPN provide?
Why can broad VPN access be risky?
What is split tunneling?
Self-Check Quiz
1. Does a VPN authorize every internal resource?
AnswerNo. It provides a protected path; resource authorization must still be enforced.
2. Why verify device posture?
AnswerA valid identity on an compromised or unpatched device can still endanger enterprise resources.
Homework
Design remote access for employees and contractors.
Compare full-tunnel and split-tunnel trade-offs.
Write revocation steps for a lost device.
Sample answerUse identity-based, resource-scoped access with MFA, managed-device checks, time limits, and monitoring. Full tunneling centralizes inspection but costs more bandwidth; split tunneling reduces latency but can bypass inspection. Revoke sessions and tokens, disable the device, rotate exposed secrets, and review logs.