How to choose the best VPN for security and privacy

Enterprise choices for virtual private networks (VPNs) used to be so simple. You had to choose between two protocols and a small number of suppliers. Those days are gone. Thanks to the pandemic, we have more remote workers than ever, and they need more sophisticated protection. And as the war in Ukraine continues, more people are turning to VPNs to get around blocks imposed by Russia and other authoritarian governments, such as that shown by Cloudflare’s data on VPN usage.

VPNs may not be the complete answer for securing remote workers. It didn’t help when news reports about the latest hacks on Okta and last year’s Colonial Pipeline attack both leveraged stolen VPN credentials or when hackers found their way into NordVPN, TorGuard and VikingVPN.

Certainly, VPNs have their issues, such as a lack of securing endpoint networks, blind spots when securing cloud computing, and missing multi-factor authentication (MFA) controls. That post mentioned several other strategies for securing your remote workflow, including expanding zero-trust networking and using a combination of products such as secure access service edge tools, identity and access management and virtual desktops.

Where VPNs matter for enterprises

A VPN is still useful and perhaps essential to a modern mostly remote workplace. They can come into play in these four scenarios:

• Protect data on public (and home) networks from being intercepted in a man-in-the-middle attack. Encrypting your network traffic makes it more difficult for the middlemen to snoop and hoover it up.
• Protect your smartphone from being tracked, which is a separate issue from the above: Most users don’t have any VPN software installed on their phones. Mobile VPN products, combined with a more secure DNS (such as Cloudflare’s Warp), should be on all business users’ mobile devices.
• As a helpful tool for frequent travelers, especially when you go to countries with autocratic regimes or that censor particular internet destinations. Alternatively, if you need to support users in far-flung locations, it might make sense to employ a VPN with a nearby endpoint.
• Prevent your private data from leaking to your ISP, although your VPN provider could still obtain this information if they aren’t as diligent as they should be.

This last item requires more explanation and is one of the reasons NordVPN and others have seen more scrutiny. Sadly, the consumer VPN providers have done a lousy job by overpromising and underdelivering on their security and privacy claims. Many make a lot of noise about “military-grade security” and “100% no leaked data.” These are utter nonsense because there is no common military security standard and every VPN tracks something somewhere and somehow. Another reason: Some VPNs are nothing more than tracking apps masquerading as legit software. Researchers have uncovered Russian tracking software that has been quickly embedded in various VPNs, and some of them target Ukrainian users. 

Yael Grauer worked with a team of security researchers from the University of Michigan. Grauer found that of the 16 well-known VPN services the team tested, 12 made exaggerated claims about how much protection they could provide. Grauer’s analysis also delineates what data is leaked by each VPN, how long they retain customer logs, and other details that can be used when you analyze the business VPN behavior. Some of these use cases could be partially satisfied if you were diligent about using encrypted email products, connecting to secure DNS servers, using complex passwords and MFA with all of our logins and avoiding public Wi-Fi hotspots. That isn’t always possible, which is why we still need VPNs to protect our conversations.