In which I agree with the federal government and bash VPNs for fun and profit
There are two subtexts behind these arguments against VPNs:<p>1. Your IT infrastructure is mature enough that all application access is directed through a series of authenticating proxies, so that you&#x27;re not making individual app-by-app configuration changes to enforce SSO&#x2F;MFA&#x2F;device-context rules.<p>2. Your VPNs have strictly iptables-style network access control (if that).<p>The latter subtext is true of most existing VPNs and is responsible, I think, for almost all of the flak access control VPNs take. Until pretty recently, the state of the art for access VPNs was stuff like OpenVPN, which is so painful to set up and maintain that most installations have no access control at all.<p>The former subtext is true almost nowhere, and that&#x27;s a problem I have with arguments like this. I like the BastionZero people, but, obviously, most engineering teams aren&#x27;t using BastionZero, or anything remotely like it. I also don&#x27;t believe the dust has settled on what products&#x2F;solutions like this are going to look like.<p>If you can&#x27;t get that first subtext to hold true for your team, and you nevertheless adopt the logic of this post, you are going to be boned; you&#x27;ll effectively be setting your security posture to a mid-oughts level, when VPNs were themselves a novelty at small engineering teams, and debug instances of apps hanging out on the Internet were a norm.<p>Meanwhile, you can mostly break the subtext about VPNs by using a modern VPN like (sorry, I have to say it again) Tailscale, which has fine-grained per-app ACLs based on role-based access control.<p>A major complaint the &quot;Zero Trust&quot; people have about modern VPNs is that app-layer proxies can do device-context authentication --- so &quot;employer-owned device, up-to-date patches&quot; is a valid access rule, and that&#x27;s harder to do right now with things like Tailscale. Fair enough. But almost nobody is doing anything like that today, and I&#x27;m not sure that when the dust settles it&#x27;ll be a market win for app-layer ZTA proxies.<p>You should do whatever you can to limit the scope of exposure for your networks, and you should not put off network access controls you can deploy today because you think you should just wait to see how ZTA products mature.<p>I think Tailscale is probably the most pragmatic next step for most companies.