CyberStack

Glossary / network acsc-glossary

Virtual private network (VPN)

A tunnel plus some discipline. Encryption is common. A full-trust badge on the far side is optional and usually a mistake.

Zero trust control layersZero trust architecture as five stacked control layers: Identity, Device, Network, Application, and Data. Assume breach; authenticate and authorise each request. A VPN badge is not a day pass.IDIdentitywho is askingDEVDeviceis it healthyNETNetworkpath + segmentAPPApplicationDATADataOther layerFocalZERO TRUST / NEVER TRUST · ALWAYS VERIFYEach layer asks again. A VPN badge is not a day pass.Identity and data are the usual focals; the middle three still ask.

A VPN keeps traffic private using a tunnelling protocol and the security procedures around it. Many VPNs encrypt. Not all of them authenticate the device, check posture, or split-tunnel your DNS into a swamp.

Treat remote access as a privileged path: MFA, least privilege, logging, and no standing admin on the other end. Split tunnelling that dumps business traffic onto cafe Wi-Fi is a design choice. Document it.

A consumer 'privacy VPN' is not corporate remote access. Do not run them on the same laptop without a story.

Fact source: ASD's ACSC glossary.