Cyber experts have urged users of Palo Alto Networks' GlobalProtect VPN to patch immediately amidst active exploitation of an upgraded security flaw.

A flaw in the popular VPN service, tracked as CVE-2026-0257, could allow attackers to bypass authentication and establish an unauthorized connection.

The vulnerability primarily affects the GlobalProtect portal and gateway for Palo Alto Networks’ PAN-OS software, and carries a CVSS score of 7.8, rating it as ‘high’ in severity.

Notably, this rating follows an upgrade, with the flaw having previously been given a ‘medium’ severity rating. Palo Alto announced the upgrade late last week amidst reports that the flaw was now being exploited in the wild.

“Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” the company said in an advisory.

Analysis by Rapid7 shows threat actors have been exploiting the vulnerability since mid-May across several waves of attacks.

“Rapid7 MDR identified successful exploitation across numerous customers; however, we did not observe any indication of successful lateral movement from the devices,” researchers said.

“The earliest date for observed exploitation was May 17, 2026. As of May 29, 2026, this vulnerability has been added to the CISA KEV.”

Rapid7 noted that customers compromised in this wave of attacks had Cloud Authentication Service (CAS) disabled. Others, meanwhile, had GlobalProtect portal or gateway authentication override cookies enabled.

A patch has been issued for customers running affected appliances, according to Palo Alto.

Similarly, administrators are advised to turn off authentication override features to mitigate potential exploitation.

Qilin ransomware involved in GlobalProtect attacks

Analysis by Arctic Wolf Labs suggests attacks on GlobalProtect customers could be the work of the Qilin ransomware group or affiliates. Indeed, researchers detected Qilin ransomware during several instances across June, highlighting a range of tell-tale signs.

“Post-exploitation tradecraft varies across intrusions, from rapid encryption-only operations to full double extortion, possibly suggesting multiple affiliates operating under the Qilin ransomware as a service (RaaS) umbrella,” the company said.

Dray Agha, senior manager for Huntress’ security operations center, said these attacks highlight the growing threats posed to VPNs and firewalls.

"The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets,” he said.

“When threat actors can bypass VPN authentication, they are walking through the digital front door with a master key. The grace period for patching critical edge devices has practically vanished, and they must be the patching priority for all organizations".

FOLLOW US ON SOCIAL MEDIA

Cybersecurity experts have issued an alert amid reports that hackers accessed login credentials belonging to UK government officials and Foreign Office staff.

The credentials, which are reportedly being sold on the dark web, were exposed as part of the ongoing FortiBleed attack campaign.

FortiBleed targets internet-facing Fortinet VPN and firewalls, and is believed to have affected more than 70,000 devices spanning 194 countries since it was first uncovered last month.

Analysis from SOCRadar, for example, identified a vast database containing login credentials. The threat intelligence firm has since attributed FortiBleed to the Lynx/INC ransomware group.

While this database was believed to have been limited to basic usernames and passwords, reports from The Telegraph suggest some exposed details include privileged Fortinet credentials.

Volodymyr Diachenko, a security researcher who first uncovered the threat campaign, told the publication these credentials could give bad actors access to the Foreign Office’s “core networks” along with other government departments.

Some Foreign Office credentials are now being sold on the dark web, according to reports, going for up to £40,000.

Arctic Wolf CISO Adam Marrè warned that the incident could create a domino effect, impacting other government departments and also local authorities and public services.

According to The Telegraph, credentials at NHS trusts, energy companies, and local councils were also hosted in the illicit database.

“This major breach of email accounts of UK government officials and overseas Foreign Office workers is the latest development in the ongoing FortiBleed attack,” he said.

“While it may be tempting to think this is a simple credential-stuffing operation, our threat team found the threat actors have built a highly sophisticated and repeatable credential factory,” he said.

Marrè noted that analysis of the incident conducted by Arctic Wolf shows threat actors appear to have been using automated tools to harvest logins and target gateways at “exponential speed and volume”.

“This means while today it’s the Foreign Office which has been affected, the risk to every organization has increased exponentially.”

Back and forth on FortiBleed

The discovery of the FortiBleed sparked somewhat of a back and forth between Fortinet and security researchers last month. After threat intelligence firm Hudson Rock published a blog detailing the campaign, Fortinet disputed some of its claims.

Fortinet told ITPro at the time that the exposed credentials weren’t the result of a fresh breach, insisting that those following best practices were safe from exposure.

"Fortinet is aware of a reported third-party credential-harvesting campaign targeting Fortinet firewalls and VPN gateways. We are committed to safeguarding our customers, and we diligently and continuously monitor threat actor darknet activity,” a spokesperson for the company said.

“Based on our initial analysis, the data involved is likely a resharing of data from previous incidents, as well as brute forcing of credentials, and not related to any current incident or advisory."

Hudson Rock, meanwhile, said the campaign went “beyond simply credential reuse,” highlighting that hundreds of organizations are thought to have been affected.

FOLLOW US ON SOCIAL MEDIA

What makes you, you? In the physical world, identity is layered with memories, choices, and relationships. Online, all that is stripped away. To a computer, you are not your story. You are a login. A password. A browser cookie. A code was sent to your phone. And if an attacker can obtain those same fragments, the system treats them as you.

Identity online is not who you are; it is what the system accepts as proof of you, and that gap is exactly what the attackers take advantage of. Across devices, networks, and SaaS platforms, what is accepted as proof will vary greatly. That inconsistency is where attackers thrive, bypassing weak or uneven multi-factor authentication (MFA) implementations and exploiting the cracks between systems.

For managed service providers (MSPs), this fragmentation isn’t just a challenge. It gives them an opportunity to deliver differentiated identity protection services that will unify and strengthen what their customers are struggling to do on their own.

Why MFA matters and why it’s often misunderstood

Most people still think of identity as a username and password. But that is like locking your front door with a simple latch. It might keep the wind out, but it will not stop a burglar. MFA is supposed to fix that by requiring more than one type of proof, typically something you know, something you have, or something you are. PINs, biometrics, push approvals, hardware keys, and device checks all fall into these categories.

However, not all factors are created equal. A unique, strong PIN is a lot better than a four-digit code that is reused everywhere. A fingerprint scan backed by the secure hardware on modern iPhones is better than the old swipe pattern on an Android screen that anyone could smudge-trace. A FIDO2 hardware key is significantly more resistant to attack than SMS codes that are inherently vulnerable to SIM swaps.

For MSPs, the ability to help customers understand the strongest versions of these factors, combined with what works for the business, and then guiding them toward the right combinations, is a powerful value-add.

Where MFA works well and where it breaks

The challenge for MSPs is that MFA isn’t consistent across platforms. Each login will have its own rules, capabilities, and points of failure, which is why simply “turning on MFA” rarely means true protection.

When it comes to mobile devices, at the lock screen, Apple and Google only allow a single factor - a PIN/passcode or biometric. You can’t stack multiple MFAs before the unlock. Strong passcodes and secure biometrics are the best you can enforce. Then, if the device is stolen, remote lock or wipe are the only remaining controls.

Desktops and laptops give you more options. Windows Hello, Touch ID, and passwords form the base layer. MSPs will be able to add second factors for their customers, such as push approvals or hardware keys. Hardware tokens also introduce revocation and re-issuance workflows that MSP customers often can’t manage alone.

Wi-Fi and office networks typically authenticate with either passwords or certificates. Passwords are easier for onboarding and change, but they’re also easier to phish. Certificates bind identity to a device and are more secure, but revoking them after compromise can be complex. This means MSPs must ensure that they balance security with operational overhead. The ability to do this well is itself a differentiator.

VPNs provide the greatest flexibility. MSPs can enforce multiple checks, such as passwords, MFA challenges, device posture, and even behavioural signals, before granting access. Because VPNs often serve as a gateway to sensitive resources, strengthening authentication here is important.

SaaS applications are where identity is most fragmented and also where attackers often strike first. Some apps support WebAuthn and FIDO keys; others support only passwords or basic MFA. Working with a centralized identity provider will enable MSPs to unify these experiences, enforce consistent MFA, and block the credential-stuffing and session-hijacking attacks that plague cloud services.

Context, behavior, and devices

Beyond basic MFA, there are contextual and behavioral factors such as your location, your device health, and your activity patterns. These may add even more strength, but support varies widely.

Mobile lock screens offer strong biometrics but limited context awareness; operating systems may allow geo-location checks or behavioral signals, but it is inconsistent; network infrastructure can evaluate IP or traffic patterns, but rarely user identity context; SaaS platforms may support conditional access, but only if tied into the right identity provider.

For any of this to work, MSPs must also manage device posture. This means OS updates, app patching, certificate health, domain join status, NAC policies, and more. Compromise will often need revoking not only user credentials but also device-based trust. This is something customers are often unprepared for. MSPs add value when they can step in with managed identity lifecycle services.

MFA everywhere is harder than it sounds

It is tempting to think MFA is just a feature you turn on that makes you more secure. But every platform has limitations. Some factors can be reset with a click. Others, such as certificates or hardware keys, need careful revocation workflows. Some support modern, context-aware signals, others don’t.

Attackers know this and specifically target the weakest link, for example, a phishable Wi-Fi password, an unprotected SaaS login, or a stolen session cookie that bypasses MFA entirely.

MSPs, however, can see across the whole environment. They can:

• Map where identity is weak or fragmented
• Recommend the strongest possible factor for each context
• Unify authentication through an IdP
• Manage factor resets, revocation, and device health
• Deliver identity protection as a recurring service with clear value

And this is where the real differentiation for MSPs is possible.

Identity won’t be perfect, but consistency and coverage are practical goals MSPs can deliver today. Start with an identity map and a pilot on high-risk users and apps.

By mapping where identity is weakest, centralizing authentication through an IdP, enforcing strong, context-aware factors, and owning revocation and device posture, MSPs turn MFA into a dependable, recurring service. The result for customers will be fewer breaches, faster recovery, and lower helpdesk churn. And for the MSP, it is new recurring revenue.

ExpressVPN has updated its Version 12 app for Windows following a tip from a security researcher about a routing problem.

The issue related to the way certain Remote Desktop traffic was being routed, and applied only under specific conditions — when a Remote Desktop Protocol (RDP) connection was in use or when other TCP traffic was routed over port 3389.

"As a result of the bug, if a user established a connection using RDP, that traffic could bypass the VPN tunnel. This did not affect encryption, but it meant that traffic from RDP connections wasn’t routed through ExpressVPN as expected," said the firm.

"As a result, an observer, like an ISP or someone on the same network, could have seen not only that the user was connected to ExpressVPN, but also that they were accessing specific remote servers over RDP — information that would normally be protected."

The company said it has now - with the help of its bug bounty community - fixed the issue.

It traced the problem to a piece of debug code - originally intended for internal testing, but which mistakenly made it into production builds, versions 12.97 to 12.101.0.2-beta.

The issue was reported on April 25 by security researcher Adam-X through its bug bounty platform, and ExpressVPN said its team confirmed and triaged the report within hours.

It released a fix five days later in the form of Version 12.101.0.45, with the update now rolled out across all distribution channels. It also includes other general improvements and routine bug fixes.

"The issue was confirmed as resolved by the researcher shortly after release, and the report was formally closed at the end of June," said the firm. "We’re grateful to Adam-X for responsibly disclosing this issue."

ExpressVPN calms user concerns

ExpressVPN said the issue would mainly affect users actively using RDP — a protocol that’s generally not used by typical consumers, meaning the number of affected users is probably small.

Meanwhile, the only data exposed by the breach would be the user’s real IP address. It wouldn't reveal their browsing activity or compromise the encryption of any traffic, including RDP sessions.

"To make sure this kind of issue doesn’t happen again, we’re strengthening our internal safeguards with more targeted checks to better catch debug code before it can reach production," said ExpressVPN.

"This includes improving automated tests to flag and remove test settings earlier in development, reducing the chance of human error and helping us deliver even stronger protections for our users."

MORE FROM ITPRO

• The best VPNs for businesses
• Everything businesses need to know about VPNs
• Do you really need to fix that critical flaw?

Compromised network edge devices have rapidly emerged as one of the biggest attack points for small and medium businesses, prompting calls for firms to shore up defenses.

Statistics from Sophos’ Annual Threat Report show firewalls, routers, and VPNs accounted for initial compromise in nearly 30% of all incidents observed by the firm over the last year.

Virtual private networks (VPNs) were cited as the most frequently compromised, accounting for over 25% of all incidents and also 25% of ransomware attacks.

What’s more, these figures come from cases that could be confirmed by telemetry, Sophos said, so the actual number of cases could be much higher.

Sean Gallagher, principal threat researcher at Sophos, said the report highlights how attackers have aggressively targeted edge devices over the last several years.

“Compounding the issue is the increasing number of end-of-life (EOL) devices found in the wild – a problem Sophos calls digital detritus,” he commented.

“Because these devices are exposed to the internet and often low on the patching priority list, they are a highly effective method for infiltrating networks.”

Gallagher added the aggressive targeting of edge devices forms part of a larger shift in cyber criminal tactics. In its report, Sophos said this means attackers don’t have to deploy custom malware and can employ ‘living off the land’ techniques to maximize their impact on target organizations.

“They can exploit businesses’ own systems, increasing their agility and hiding in the places security leaders aren’t looking,” Gallagher said.

Other popular attack methods highlighted in the report were social engineering via Software as a Service platforms. These widely-adopted platforms have become heavily abused products commonly used for initial compromise.

Business email compromise is also a growing concern, according to the report, attributing to an alarming rate of initial compromises in security incidents.

In these instances, malware deployment, credential theft, and social engineering are being used extensively, the report warned.

Phishing of credentials via adversary-in-the-middle (AiTM) attacks and multi-factor authentication (MFA) token capture was cited as the main drivers of the increase.

AiTM attacks are a specific variant of the traditional 'man in the middle' attack method, whereby cyber criminals intercept communications between two parties to steal data.

This new type of attack differs greatly, however, enabling threat actors to actively interfere with and modify communications rather than simply intercepting them.

This particular method has been growing in popularity among threat groups in recent years, with state-backed threat actors in particular employing the technique.

In an advisory last year, Microsoft warned AiTM attacks have now become one of the 'go-to' methods for cyber criminals, with the tech giant's Digital Crimes Unit (DCU) observing a 146% increase across 2024.

MORE FROM ITPRO

• Six of the best malware removal services you can use today
• We ranked the best VPNs for businesses
• The best Wi-Fi and access points for your enterprise

Ivanti has patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.

Tracked as CVE-2025-22457, the critical severity vulnerability impacts Ivanti Connect Secure (versions 22.7R2.5 and earlier), Pulse Connect Secure (versions 9.1R18.9 and prior, which reached end-of-support at the end of last year), Ivanti Policy Secure (versions 22.7R1.3 and prior) and ZTA Gateways (versions 22.8R2 and prior).

In a security advisory published by Mandiant, the firm said there’s evidence of active exploitation in the wild, with the espionage group successfully achieving remote code execution (RCE) and deploying malware.

"Following successful exploitation, we observed the deployment of two newly identified malware families, the TrailblazeE in-memory only dropper and the Brushfire passive backdoor," said Mandiant.

"Additionally, deployment of the previously reported Spawn ecosystem of malware attributed to UNC5221 was also observed. UNC5221 is a suspected China-nexus espionage actor that we previously observed conducting zero-day exploitation of edge devices dating back to 2023."

The vulnerability is a buffer overflow with a limited character space, and as such was initially believed to be a low-risk denial-of-service vulnerability. But while a patch was released on February 11, Mandiant believes the group was able to analyze the patch and find a way to exploit 22.7R2.5 and earlier to achieve the remote code execution.

"The vulnerability is a buffer overflow with characters limited to periods and numbers, it was evaluated and determined not to be exploitable as remote code execution and didn’t meet the requirements of denial of service," Ivanti explained.

"However, Ivanti and our security partners have now learned the vulnerability is exploitable through sophisticated means and have identified evidence of active exploitation in the wild."

CISA responds to Ivanti threats

Google Threat Intelligence Group (GTIG) said UNC5221 has targeted a wide range of countries and verticals during its operations, and has made use of an extensive set of tooling, from passive backdoors to trojanized legitimate components on various edge appliances.

The group has a consistent history of success and an aggressive modus operandi, and GTIG believes it will continue to pursue zero-day exploitation of edge devices.

"This latest activity from UNC5221 underscores the ongoing sophisticated threats targeting edge devices globally. This campaign, exploiting the n-day vulnerability CVE-2025-22457, also highlights the persistent focus of actors like UNC5221 on edge devices, leveraging deep device knowledge and adding to their history of using both zero-day and now n-day flaws," Mandiant said.

"This activity aligns with the broader strategy GTIG has observed among suspected China-nexus espionage groups who invest significantly in exploits and custom malware for critical edge infrastructure."

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory for at-risk enterprises.

In addition to applying the relevant security patches, the agency urged organizations to run an external Integrity Checker Tool (ICT) and conduct threat hunt actions on any systems connected to — or recently connected to — the affected Ivanti device.

For the highest level of confidence, it said, they should conduct a factory reset.

UPDATE:

In a statement given to ITPro, an Ivanti spokesperson gave additional details on the issue:

"Following initial identification of the compromise by Ivanti’s Integrity Checker Tool (ICT), Ivanti quickly investigated, identified the vulnerability and disclosed it to customers. Additionally, Ivanti partnered with Mandiant to provide additional information to defenders.

"Importantly, this vulnerability was fixed in ICS 22.7R2.6, released February 11, 2025, and customers running supported versions on their appliances and in accordance with the guidance provided by Ivanti have a significantly reduced risk. Customers running ICS 9.X (end of life) and 22.7R2.5 and earlier are encouraged to upgrade as soon as possible and follow the other actions outlined in the Security Advisory.

"Ivanti’s ICT has been successful in detecting potential compromise on a limited number of customers running ICS 9.X (end of life) and 22.7R2.5 and earlier versions."

MORE FROM ITPRO

• INSERT STORY LINK
• INSERT STORY LINK
• INSERT STORY LINK

Defender VPN, Microsoft's free virtual private network, is set for the scrapheap – so you might want to think about alternative services.

As of 28 February, Microsoft will no longer support the free VPN service that had been included in its Defender security app since 2023.

When the move was announced at the beginning of the month, Microsoft said new installations and reinstallations would not feature the tool.

Microsoft suggested the removal of the "privacy protection feature" was because the tool wasn't very well used.

"We routinely evaluate the usage and effectiveness of our features," Microsoft said in a support post. "As such, we are removing the privacy protection feature and will invest in new areas that will better align to customer needs."

The move follows Google killing off its One VPN last year, also citing low demand.

Microsoft said it wasn't planning on ending any other Microsoft Defender features, with device protection, identity theft and, in the US, credit monitoring set to continue.

Did Microsoft do enough to promote Defender VPN?

Some commenters online have suggested that the limited take-up was because no-one knew about the VPN — or because the service was seriously limited.

It wasn't available outside the UK or US, had a strict 50GB monthly data cap, excluded certain apps, and users couldn't choose the server location, meaning it didn't help with accessing geo-restricted content or dodging censors.

Instead it was pushed as a way to protect privacy when online, such as against man-in-the-middle attacks when using public Wi-Fi.

Anyone who was using the limited VPN will need to find an alternative VPN, likely via a paid-for service, but any will come with a wider range of features that Defender's version lacked.

Microsoft will continue to offer a VPN in one instance, however, mainly for phishing protection on iPhones.

"Defender for iOS users, please note, web protection (anti-phishing) on iOS uses a VPN to help keep you safer from harmful links," the support document said.

"You will continue to see a VPN used for the purposes of web protection and this local (loop-back) VPN is different from the privacy protection feature."

Anyone with the VPN on Windows, iOS, and MacOS won't have to take any action, but Android users will need to remove the tool from their VPN settings if they want it to stop being listed as an option.

"Not removing the Defender VPN profile on your Android device will not cause any impact to your device but it’s recommended to remove it as it won’t be used by Defender to provide protection," the support post noted.

What is the Defender app?

Microsoft included the privacy protection VPN for free in the Defender app that comes with Microsoft 365 Personal or Family subscriptions.

The Defender app is available across Windows, Android, iOS, and MacOS, and also features a web portal for managing phone and PC protection.

The app includes antivirus, alerts about malicious websites or suspicious activity, and more, though what's available differs by platform and region.

This is separate from Windows Security, a set of security tools built directly into Windows, that is formerly known as Windows Defender Security Centre.

MORE FROM ITPRO

• Everything you need to know about VPNs
• Does your business need a VPN?
• Everything you need to know about Microsoft Defender

A host of cybersecurity agencies have teamed up to offer guidance on how to secure edge devices from ever-increasing threats.

The advice covers network edge devices and appliances, such as firewalls, routers, virtual private networks (VPN) gateways, Internet of Things (IoT) devices, internet-facing servers and internet-facing operational technology (OT) systems.

Issued by the UK's National Cyber Security Centre (NCSC), CISA, and agencies in Australia, Canada, New Zealand, and the US, the guidelines encourage device manufacturers to include and enable standard logging and forensic features that are robust and secure by default.

This, the NCSC points out, should make it easier for network defenders to detect malicious activity and investigate following an intrusion.

The guidelines also set out a set of minimum standards for forensic visibility to help network defenders secure organizational networks, both proactively and when responding to a compromise.

"In the face of a relentless wave of intrusions involving network devices globally our new guidance sets what we collectively see as the standard required to meet the contemporary threat," said NCSC technical director Ollie Whitehouse.

"In doing so, we are giving manufacturers and their customers the tools to ensure products not only defend against cyber attacks but also provide investigative capabilities post-intrusion."

The NCSC said malicious actors are increasingly exploiting vulnerabilities and insecure design features to gain and maintain valuable accesses. Devices often aren't secure by design or by default, aren't given regular firmware updates, or have weak authentication measures with limited logging, making it hard to detect suspicious activity.

Similarly, many may not be configured securely, lack proper network segmentation, and use unsupported or end-of-life (EOL) hardware, thereby increasing their vulnerability to exploitation.

Last summer, a report from WithSecure identified the mass exploitation of edge services as the year's prevailing trend for attackers.

The year saw a sharp rise in security incidents caused by the mass exploitation of edge devices, including such as MOVEit, CitrixBleed, Cisco XE, Fortinet’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect.

The number of edge service and infrastructure Common Vulnerabilities and Exposures (CVEs) added to the Known Exploited Vulnerability Catalogue (KEV) was 22% higher than in 2023.

Juliette Hudson, CTO of CybaVerse, said the new guidance is much needed given the scale of threats facing edge devices currently.

"These are guidelines that shouldn't be ignored, because when edge devices are insecure, the entire networks they run within are at heightened exposure to attack. Today, all businesses are digital businesses, where they rely on smart devices and the internet to deliver services, but this expands the enterprise attack surface," she said.

"Having good visibility across network assets and running proactive monitoring for threats are essential, but device manufacturers also have a key role to play, and it is essential they practice good security hygiene in the development process."

MORE FROM ITPRO

• Five Eyes raises alarm over 'living off the land' attacks
• How edge computing can benefit businesses
• Check out the best VPNs for enterprises

The benefits of the Tailscale VPN are numerous. Imagine you're a remote worker using a self-hosted document management system that you want to interact with while away from home. Or, you're running a self-hosted server that you want colleagues to access, but you don't want them to see anything else on your network. Or you want to make encrypted backups on hard drives at the office of a partner company.

There are point-to-point VPN options to manage this kind of thing. WireGuard is an open-source VPN that runs on your personal devices (including your phone) and a computer at home that acts as a VPN server. It takes a little setting up, and that node on your home network has to stay active to use it effectively or you'll have to set up separate WireGuard VPNs on all your devices. You'll also have to use dynamic DNS for any destination WireGuard servers to ensure that your nodes can find each other when your ISP changes your static home address.

Supporting a handful of remote users can be troublesome enough, but it gets exponentially more complex as you add users. Multiple people would connect to a VPN in a hub and spoke configuration. You can add more WireGuard hubs to manage different physical offices around the country, but this still doesn't allow machines to talk directly with each other; they can only connect with a hub and access centralized resources from there.

Tailscale review: How it works

This is where Tailscale comes in. It's a service to manage WireGuard VPNs in a mesh configuration, enabling them to find each other. Admins set up their Tailscale network (called a tailnet) using Tailscale's centralized service. They register devices to the tailnet by installing Tailscale's client, which contains Wireguard. The client sets up a private/public key pair and gives the public one to Tailscale.

Private keys never leave a device, but Tailscale manages those devices' public keys. It acts only as a control plane, enabling machines to find each other, no matter what their real IP address is. After they connect and authenticate each other using their private keys, their data session takes place outside the Tailscale network, meaning that it doesn't see the data (which is end-to-end encrypted, thanks to Wireguard).

Because Tailscale is just handling the control plane, its network and compute load is far lighter than it would be if it was having to transport the content of an entire data session between clients. That enables it to offer an impressive free service tier supporting up to 100 devices and three users. After that, pricing scales reasonably, placing it within reach of even small businesses that need more scale.

The site manages NAT traversal, and if it does run into problems, it falls back to a network of Tailscale-operated relays using its Designated Encryption for Packets (DERP) software. Like Tailscale's client, this software is open source.

Tailscale review: Setup

To set up a tailnet, you register with Tailscale using an identity provider like Apple or Google rather than email, and it then asks you to install its client on your device (it supports Android, iOS, Windows, macOS, and Linux). The client will make you log in again, which registers the device. You can see it immediately pop up on the Machines tab on your tailnet's page on the service's web page.

Installing on Linux takes a few terminal commands. Start the service and it displays a URL, which takes you to the registration page.

Once running, it works seamlessly. On an iPhone, bringing up the Tailscale app triggers the phone's VPN icon to show you're using Wireguard, and shows you a list of each device's address on the Tailscale network, which you can copy and paste. So, you can access your document management system, home assistant, NAS box, or other resources easily.

Tailscale review: Services

You can also switch on a feature that collects information on all the services running on your Tailscale devices. This is not only a handy way of monitoring what the machine is exposing and checking whether that service is up, but also provides you with a handy way to copy the service address for easy access. Tailscale doesn't store service information but just passes it to your tailnet dashboard.

One advantage of accessing services directly via the tailnet is that you can close down all the internet-facing ports on your firewall and just access everything via the tailnet, reducing your external attack surface.

The services that Tailscale collects include SSH, and while you can happily use the SSH service address on the tailnet to log in using your regular SSH keys, you can also use the tailnet's own authentication to log in more quickly. To do this, you use a command line option when starting the service on the SSH host, which allows access using the Tailscale private keys that power the Wireguard connection.

Your tailnet also offers MagicDNS, a service that lets you just use a device's name instead of its IP address on the tailnet, making access more intuitive. That, along with the native tailnet authorization, enables you to simply ssh /mymachine/, and you're in. It's a handy little feature if you're constantly launching shells on remote computer.

Tailscale review: Other functions

Once you've registered all your devices, there are plenty of things you can do with this service. You can turn one of the machines in your network into an exit node for internet access. This enables any machine with access to that device to specify it as such when starting Tailscale. It will then direct all traffic not intended for its Tailscale peers to the exit node.

The exit node feature creates a VPN for mobile users, so when you're in an airport or hotel with dodgy open Wi-Fi, you needn't cross your fingers and hope that you're connecting to a legitimate access point or that someone is sniffing your traffic. It also gives you all the protections of your home network, which is handy if you run an ad blocker or traffic scanning service on your LAN.

If you're interested in appearing to be in another country, Tailscale has also partnered with VPN provider Mullvad so that you can use any of its servers as an exit node.

You can also temporarily share nodes privately with a Tailscale user who isn't part of your network. This could be useful for providing ad hoc access to specific files. Tailscale has a walk-through on its website.

Tailscale review: Securing your tailnet

When you add more devices and users to your network, you'll quickly want to restrict access to certain things. None one should be able to look at files on your NAS, for example. Tailscale offers access control lists (ACLs) that enable you to control which users and devices can access, down to an IP address and port level. The ACL starts wide open by default, but once you've edited it (it's written in a human-friendly variant of JSON), it switches to denying access by default, so you have to explicitly open things up.

Tailscale is a useful service for everyone from families with a pet self-hosting geek through to larger businesses, and it already has some impressive corporate customers under its belt. There's really not much to dislike here. The main concern people might have is trusting a single third-party with their infrastructure. However, the company has done its best to require minimal user trust.

For example, one scenario could see an attacker co-opt Tailscale's coordination server and add malicious nodes to the control plane. To protect against that, Tailscale added a facility called tailnet lock, which stops nodes on your tailnet from automatically trusting a new node's public keys.

It's still possible that an attacker – perhaps an intelligence agency – could compromise Tailscale's internal systems and push compromised code to production, compromising the client enough to issue compromised keys.

Also possible are legitimate software bugs that could lead to remote code execution, given the level of privilege that the client can be given on machines. Indeed, security researcher Emily Trau expertly highlighted just such a bug a year ago.

The thing is, such things are true of any service (someone might try to compromise Wireguard's own development pipeline, for example). And like Wireguard, Tailscale's client software is open source, enabling the community to scrutinize it.

Tailscale review: Is it worth it?

Security boils down to two things; the company's approach to it, and the user's. On the first point, Trau's blog post is a glowing testimony. She said that people should keep using Tailscale, given that the company fixed the flaw she identified in hours. She added: "The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe."

Tailscale works with third parties for security audits, and also seems to have a friendly, non-evil-corporate ethos. Its own code is open source, and it enthusiastically supports open-source versions of itself such as the Headscale project, which develops an independent self-hosted server for people to run their own tailnets. The Tailscale team also makes the service free to open-source projects.

There's a caveat though. Tailscale is funded by venture capital, and VCs can exert influence over company strategy in ways that may cause value creep. Companies that start out with a "don't be evil" ethos often find market requirements changing their culture. Google, where Tailscale's founders previously worked, has been a case in point. So this is worth watching over time.

On the second point - user risk management - any admin should harden their infrastructure as much as possible. If you're nervous about using someone else's software to connect your infrastructure, you can avoid turning on some of the funkier stuff like Tailscale-authenticated SSH. You can set up ACLs and follow basic cybersecurity hygiene principles like keeping your software patched. Tailscale has a tailnet hardening guide here.

For now, we're going to keep using Tailscale. It solves some pressing problems, and the company has been impressively conscientious so far. If you're a small business interested in easy VPN mesh setup, this is definitely worth a look.

In this webinar you will:

• Learn how Zero Trust can help your organisations' network security
• Understand how Zero Trust solves challenges of modern security deployment
• Discover just how new (or not) the Zero Trust concept is
• Determine the difference between Zero Trust and legacy business VPNs

Provided by

IT leaders today are tasked with finding innovative ways to secure their remote workforce, with legacy hardware firewall VPNs no longer able to meet today’s security needs. One solution is enterprise level network security with Zero Trust, that enables network access for users to only what they need to perform their roles.

This guide further explains the benefits of a Zero Trust Network Access (ZTNA) security model and how organisations can significantly reduce the level of exposure to cyber attacks and limit unwanted access to their data.

Download now to see how ZTNA compares to On-premise Firewall VPNs, and how it can offer a safer hybrid work environment.

Provided by

You may have seen the term 'VLAN' wherever there’s talk of networking. It stands for virtual local area network and is one of the most useful but underused features in a network admin’s arsenal. But what is a VLAN, and how do you go about setting one up?

A VLAN is one of the first examples of software defined networking (SDN), a burgeoning technology which allows physical switches to be replaced with software controlling the flow of data. VLAN technology is much simpler in scope than some other, more advanced examples of SDN infrastructure but the good news is, it’s much easier to set up with your existing equipment.

Put simply, a VLAN is a way to have an entire branch of your network completely separate from the rest without the need for a second internet connection or router. Most professional routers (and an increasing number of home/SOHO devices) are VLAN capable. If your office communications are delivered by voice over internet protocol (VoIP), it will almost certainly be routed over a VLAN in order to ringfence bandwidth, avoid security breaches and thus ensure uptime – as long as there’s still an internet connection – regardless of what happens on the rest of the network. An even simpler VLAN is the Demilitarised Zone (DMZ) feature offered by most routers, which bypasses all security protocols to a specific IP address or range whilst leaving it active across the rest of the network.

What are the benefits of using a VLAN?

In an office environment, the benefits can be huge. If you want to offer customers Wi-Fi, for example, you can add a separate access point (AP) to your network inside a VLAN, thus ensuring that public users can only connect to the web, with no way of getting to your sensitive company data.

One of the advantages of a VLAN is that, because it’s a software defined logic layer, it isn’t limited to one physical location. In a global company, a VLAN can be set according to the needs of individual job functions or departments. For example, a sales team may not have desks in the office, but instead log into the company resources via virtual private network (VPN). The VPN can be configured to divert traffic over a specific VLAN, thus limiting company access remotely in the same way as it does in the office.

Another good example of VLANs in action is prioritisation of network traffic. Returning to the example of a public Wi-Fi network, if your main corporate network is struggling to meet performance demands, you could, at the flick of a switch, reapportion part of the bandwidth devoted to customer-facing Wi-Fi in order to bolster the primary network, and return it when traffic returns to normal.

Setting up a VLAN

If this sounds like a useful ability to have in your toolbelt, the good news is that setting up a VLAN is very quick and easy, although the specific process will depend on your network infrastructure. On some devices, there may be one ethernet port designated for VLAN use, whilst others may allow multiple VLANs on multiple ports. Check the instructions on your router for more information on what yours can do. In our example, we’re going to assume that any output can be defined for your VLAN.

The first thing you’ll need to do is gather the physical equipment that you’ll be using to create your VLAN. We’re using Netgear Prosafe equipment, but the method should be similar with other brands too – if you get stuck, check the documentation. In our case, we’re going to assume that your router only supports a single WAN and LAN, so we will use a secondary network access point for providing customer Wi-Fi, which will sit alongside the APs serving our main network. You’ll need to nominate an ethernet port on your main switch which will be given over to the VLAN, and if you’re running multiple VLANs, each one will need a separate port.

On some devices, there may be one ethernet port designated for VLAN use, whilst others may allow multiple VLANs on multiple ports. Check the instructions on your router for more information on what yours can do. In our example, we’re going to focus on setting up a single VLAN, but if you want to set up a number of VLANs, or your router doesn’t support them natively, you may need to add a dedicated VMPS – a VLAN management policy server capable of more advanced rules and additional features than your router GUI. If so, you’ll need to discuss this with your network infrastructure provider.

It should be noted that Cisco has its own proprietary system for managing multiple VLANs built around the Cisco VLAN Transport Protocol. If you use Cisco equipment, check with your representative about how to configure VLAN traffic on your network.

For our example, we’re going to assume you’re setting up a single VLAN, so the next step is cabling your access point to your switch. If you’re retrofitting a VLAN, you may find you have to do an audit on your ethernet wiring. Although using a VLAN to ‘ring-fence’ sensitive endpoints or applications is a valuable security strategy, a rogue physical connection between your VLAN and the rest of your network will render this useless. It may also cause all kinds of network problems, as the hardware connection will be in conflict with the software routing.

With the cabling taken care of, we can move on to the software side. Creating a VLAN will be done in the management console of your main network switch or router; you may need to check the advanced settings section to check that VLAN support is enabled first. Once you’ve enabled the feature, create a new VLAN and assign it an ID number.

Each VLAN you create will have its own ID between 2 and 4096, with any traffic not assigned to a specific VLAN lumped under ID 1. If you’re setting up a VLAN to accommodate a specific piece of equipment, check the documentation, just in case they have a specific one in mind. The most common defined ID for IPTV and VOIP use is 101, but check requirements for your equipment. Any traffic outside the VLAN environment will automatically be given the default VLAN ID of 1.

Along with setting a VLAN ID, you’ll also be able to name this VLAN too, in the same way as a Wi-Fi network’s SSID, which is a bit more ergonomic for both end users and admins.

Next, we need to decide the parameters for our VLAN. You should be able to define variables such as which folders and directories the VLAN has access to, what communication ports are open, how much bandwidth is given over to VLAN traffic, what transport protocols are allowed, and lots more besides. Think about the specific purpose you want your VLAN to serve, and be careful not to over-provision it as this will take additional bandwidth away from the main network.

Some switches will offer traffic prioritisation for VLANs, allowing you to dictate which sub-networks have first dibs on available bandwidth. You may, for example, want to give your VoIP network a higher priority than your public Wi-Fi – or you may wish to give your archiving processes lower priority during work hours, but highest priority overnight.

At this point, you should decide which users will be routed through your VLAN. In our case it’s simple – anyone who connects through our separate public Wi-Fi access point. But it could be that different departments or branches are routed through different VLANs. User endpoints don’t have to be physically present - if a user logs onto your domain, for example, over VPN from home, their traffic can be routed based on their credentials.

As long as you’ve provisioned your company topography correctly through something like Active Directory or single sign-on (SSO), you can do this for job functions, departments and locations, as well as individual user endpoints. For our public Wi-Fi example, we simply want all traffic that connects to our public access point to have internet access to surf the web, without access to the internal business network.

Turn on the public Wi-Fi access point and configure it appropriately. If all has gone well, you should find that connecting to it will give you access to the internet, but nothing more – indicating that your VLAN setup is correctly isolating the two networks from each other.

While this is a fairly basic example of a VLAN implementation, the same principles can be applied to network management tasks across a whole range of different use cases and footprints. VLANs are an essential networking tool.

The best VPN services run smoothly in the background while you browse or stream, with little work required. Unfortunately, however, sometimes even the best VPNs will run into problems. Use this handy guide to VPN troubleshooting as a one-stop shop to fix all your VPN problems.

Common VPN connection problems

• Non-responding VPN server
• Your ISP (internet service provider) is blocking the access to VPN
• When old VPN packages interfere with the new ones
• The set firewall is interrupting your connection

Most VPN issues result in your VPN disconnecting from the internet. There are a lot of reasons why your VPN might fail to connect, but the end result is the same—your VPN stops functioning, leaving your browsing session unprotected.

Read on for eight steps that you can take to determine the cause of a VPN connection failure and rectify it.

Here's why your business needs a VPN.

Step 1: Check your internet connection

Sometimes a connection failure has nothing to do with your VPN at all. It is simply the result of a failed internet connection.

The best way to check if your internet is down is to look at your router. It should have an indicator—often a glowing green light—to tell you whether or not it is currently connected to the internet. Consult the manual that came with your router to see where to locate the internet connection indicator for your model.

If the problem is indeed an internet connection issue, check out our guide on how to troubleshoot your internet connection.

Step 2: Check if the site/service you are accessing allows VPNs

Certain websites, especially streaming service providers like Netflix, have taken steps to block VPNs from accessing them. The easiest way to test if this is happening to you is to try and browse several random web pages. If they load fine, you are probably being blocked by one specific site. If not, it is probably a wider connection problem.

Websites that block VPNs typically do so by blocking specific VPN servers. You can try switching servers to resolve this issue. If that does not work, you will have to turn off your VPN to access the site or try again with a different VPN provider.

Step 3: Change server

If you’ve determined a specific site is not blocking the VPN, and it’s still not connecting, there could be an issue with the server. Certain VPNs, especially free ones, suffer from overcrowding. Essentially, too many people attempt to connect to the same server at once, forcing the VPN to block some of them or slow down their internet connection to cope with demand.

A particular server could also be down due to technical difficulties. In either case, try switching to a different server, perhaps in a less popular location.

Step 4: Disable your firewall—temporarily!

If you have tried various servers and are still experiencing VPN connection issues, disable your firewall, then navigate to a website you know and trust while connected to your VPN. If that works, then your VPN is likely in conflict with your firewall. Do not continue browsing with the firewall off—a VPN will protect your privacy online, but it will not protect your computer from viruses and malware.

If you are using a paid firewall, try switching to the free firewall that came with your computer. You can also try adding your VPN to the firewall’s whitelist, although this works less often then we would like it to. If these options do not work, some VPN providers also offer a firewall product that is guaranteed to be compatible with their VPN service. Try any of these solutions, but do not continue browsing without a firewall.

Step 5: Restart the VPN

Turning it off and on again is a tried-and-true tech support solution, and it can apply to VPNs. If you are using a desktop or mobile VPN application, disconnect from the VPN server and sign out completely, then sign back in and reconnect.

If you are using a browser-based extension, log off, clear your browser cache, and close the browser. Then open your browser and log back on.

Step 6: Make sure everything is up to date

Internet browsers and VPN service providers regularly update their software, and there’s no coordination between the two. If your VPN is still not working, check if you have the latest version from your VPN provider. Some updates are automatic, while others are manual. Your VPN might not be working because a manual update needs to be downloaded from your provider’s website.

You should also check your web browser to make sure it's up to date. Sometimes, the browser will need to be updated. In other cases, your VPN might not be compatible with the latest version of your browser. If that is the case, downloading a different browser that is compatible with your VPN is the best solution. Your VPN provider should indicate compatible browsers on its website.

Step 7: Change your VPN’s tunneling protocol

VPNs use a point-to-point tunneling protocol to facilitate a secure and anonymous internet connection for you. Unless you have very significant security concerns, you do not need to know the technical details behind these protocols beyond the fact that changing the protocol can sometimes resolve connection issues.

Go into your VPN’s settings and try a few different protocols from the list. Some examples of protocols are OpenVPN, L2TP/IPSec, or IKeV2/IPSec. OpenVPN, in particular, is one of the oldest and most widespread VPN protocols, with a low likelihood of connection issues.

All commonly available VPN protocols are secure and encrypted. You should not worry too much about the security ramifications of changing your VPN protocol. If you do have concerns, contact your VPN provider’s customer support team before changing your VPN protocol.

Step 8: Contact support

If you are still unable to connect after trying these steps, your issue could be specific to your particular VPN provider. It could also be an advanced issue that is outside the technical abilities of the average user to solve.

In either case, it is best to contact your VPN provider’s customer support team and open a ticket. VPNs are technically complex, and sometimes the best course of action is to seek the assistance of a professional.

Summary

VPNs have a lot of complicated technology on the back end, but, for the most part, they tend to run without a hitch. If you do run into an issue, now that you’ve read our eight-step guide, use your newfound knowledge to quickly troubleshoot. Switching servers or turning the VPN off and on again is often enough to restore your connection. And if all else fails, contacting support is still a great option.

Need help choosing or changing your VPN provider? Check out our articles on the best free VPN in 2022, and best business VPN in 2022.

ProtonVPN is a Switzerland-based VPN provider whose name may sound familiar if you’ve had the chance to encounter another popular product made by its creators - an end-to-end encrypted email platform ProtonMail.

This VPN service may not have thousands of servers like some others, but the ones it has are well distributed around the world - over 1200 of them are located in 55 countries, including India, South Korea, Brazil, Hong Kong, South Africa, and so on.

Another great detail is that the provider owns and runs all of its servers, which means more control over how they’re installed and used, leading to potentially better security and performance.

The company also stands out from the crowd with the proprietary Secure Core technology that directs traffic through multiple servers before leaving the network. In other words, it will prevent even the most tech-savvy of hackers spying on an exit server to track individual users.

ProtonVPN apps can be installed on Android, Windows, iOS, Linux, Mac, Android TV (beta), and Chromebook devices, and they’re available in several languages, including Italian, French, Polish, Spanish, and Brazilian Portuguese. The vendor has made all of its apps open-source and had them audited, and you can actively use them on up to 10 of devices at the same time. ProtonVPN can also be manually installed on routers to put all of your devices (including those that aren’t directly supported) under its protection.

ProtonVPN: Plans and pricing

Most VPN providers have subscription plans revolving only around their length in months or years. ProtonVPN does things slightly differently. There’s a free plan that gives you coverage for one device, access to servers in three countries (Japan, the US, and the Netherlands), delivers medium speeds, and, refreshingly, doesn’t impose any data traffic limits.

It is followed by the Plus subscription at £5.16 a month (charged £61.89 every year), which gives you access to all the provider’s servers in all countries, covers simultaneous connections on up to 10 devices, enables P2P traffic, and delivers top speeds. It's also available in a two-year or one-month plan, respectively priced at £4.30 a month or £8.60 a month, with the two-year plan costing £103.12 over the two years.

The Plus option also provides access to all servers, P2P capabilities, and highest speeds. Plus expands the coverage on up to five devices, adds the super-fast Plus servers (capable of delivering speeds of up to 300Mbps), Tor servers that enable access to Onion sites, and Secure Streaming tools that facilitate watching of popular geo-restricted content such as Netflix. The ProtonMail Visionary service is also included.

All paid plans also include NetShield - a feature that protects you from malware, online trackers, and it serves as an ad blocker as well.

You can pay using Bitcoin for better security, credit cards, or Paypal. ProtonVPN allows you to cancel your account with a refund for any unused portion of its service period within 30 days since the original purchase.

ProtonVPN: Privacy and logging

ProtonVPN uses a long list of mechanisms, tools, and features to ensure top security and privacy online. These include a kill switch - a handy option that automatically shuts down your Internet access whenever the VPN connection is cut off, DNS leak protection, as well as the integrated Tor support for accessing Onion websites.

All the apps employ AES 256-bit encryption, 4096-bit RSA key exchange, HMAC SHA384 message authentication, and Perfect Forward Secrecy. The Windows and Linux clients are built on the OpenVPN protocol, while the Android, iOS, and Mac apps employ both OpenVPN and the IKEv2/IPSec protocol. You can even customise your own OpenVPN files, depending on the platform and protocol you need. The company states it’s also working on introducing WireGuard.

You can also enable a split-tunneling option for apps and destination IP addresses you wish to bypass the VPN when the rest of the system is connected to it.

The no-logs policy states that the company does “not track or record your Internet activity,” and is therefore “unable to disclose this information to third parties”. The only thing that is stored is the time of your last successful login and email address when you sign up.

To prove its dedication to privacy, ProtonVPN has made all its native clients open-sourced and allowed them to be audited by independent security experts from SEC Consult.

It is also worth mentioning that the company is based in Switzerland, a country with a well-known reputation for keeping its nose out of people’s business, so you can be certain your sensitive data is safe.

ProtonVPN: VOD and torrents

Although ProtonVPN dedicates a lot of attention to privacy, this doesn’t mean its other important areas are left forgotten. One of them is providing safe access to popular video-on-demand services like Netflix and BBC iPlayer. ProtonVPN successfully unblocks both of them, as well as HBO Now, Disney+, Amazon Prime Video, and others, as long as you have its Plus or Visionary service package. There’s even a collection of guides on the website for every streaming service you can view with ProtonVPN.

The provider also offers P2P-friendly servers, so there aren’t any obstacles to using your favorite torrenting client to download and upload large files.

ProtonVPN: Support

This VPN vendor has a solid support site with plenty of articles divided into groups according to their content. They should be able to assist you with anything related to the platform, but if they don’t, your next choice is to contact the support team.

This may not be easy as with some of the competitors, as there’s no live chat option and the email support may take up to a couple of days to respond.

ProtonVPN: Final verdict

ProtonVPN is a superb VPN service that not only delivers bullet-proof security but also goes out of its way to convince you of its honest intentions. Its apps are available for anyone’s scrutiny and can be used in multiple languages. Furthermore, it doesn’t ignore any part of its service, including the torrenting support and successfully unblocking various streaming content. The prices may be a bit higher than the average, but top quality often is expensive.

• The best VPN services

Private Internet Access (also called PIA) is an outstanding VPN provider owned by Private Internet, the same company who is also the proud owner of other celebrated platforms like ZenMate and CyberGhost.

It features a huge network of P2P-friendly servers that includes over 35,500 units scattered across 77 countries, native clients for Windows, Mac, iOS, Android, and Linux, browser extensions for Chrome, Opera, and Firefox, as well as support for installation on additional platforms, including routers. Once you set it up, you’ll be able to run it on as many as 10 devices at the same time, which is quite a lot in this business.

You’ll also get access to various bonus features such as a blocker of malicious URLs, ads, and trackers called MACE, as well as the SOCKS5 proxy. Furthermore, there are some new and interesting extras like a secure private browser for iOS, the Shadowsocks support for getting you connected in regions that actively block VPNs, and the Snooze option to temporarily disconnect the VPN. There's an option to sign up for a dedicated IP as well.

Private Internet Access: Plans and pricing

As usual, the subscription plans begin with the most expensive option (yet not among the most expensive in the industry) - the monthly one at £9.99. Going for the one-year option will reduce the price to an equivalent of £2.71 a month, while paying for three years (and getting three free months) will bring down the price further, to only £1.67 a month, making it one of the most attractive VPN plans in terms of price. This plan will also give you Boxcryptor - an encryption software for cloud security.

Customers can make their purchase using various methods, including credit cards, PayPal, AmazonPay, Mint, Bitcoin, gift cards, and more.

A free trial is not an option with PIA, but there’s a 30-day money-back guarantee to put your mind at ease if you realise you don’t like what you’re getting after you’ve already paid. There’s another interesting detail, that we haven’t noticed with the competition - if you purchase another account after already being issued a refund, you can ask for another refund, as long as more than three months have passed since the last one.

Private Internet Access: Privacy and logging

PIA relies on the super-secure OpenVPN protocol and lots of other security toolkits to protect your privacy on desktop and mobile platforms. It not only supports various encryption models (AES-128, AES-256, CBC, GSM), but it also allows you to decide yourself which one you want to use, or turn it off completely for the sake of higher speeds. The configurability doesn’t end there, by far.

Users can also set which data authentication and handshake methods they’d like to use - RSA-2048 or RSA-4096, which connection type they prefer, as well as which local and remote ports they want. All the provider’s apps now also include WireGuard protocol support.

PIA uses its own DNS to successfully prevent DNS leaks. And guess what? This can be customised as well, at least on the Windows app, where you have a choice to either use your default DNS or any custom DNS you’d prefer. As usual, a kill switch is there as a safety measure on both desktop and mobile platforms, preventing any data leaks by disabling your entire Internet access if the VPN connection suffers an interruption.

The browser extensions don’t lack privacy options on their own - featuring blocking of third-party cookies and location access, for instance.

As for its no-logs policy, PIA claims to be the only truly verified no-log VPN platform, referring to the situations in which it was served with subpoenas to hand over users’ account information, but it couldn’t comply and the only data it delivered was the general location of the server IP addresses.

This means no user-specific information was handed over to the authorities. In addition to a history of no-logging practices, PIA also issues a Transparency Report every six months, listing all the requests for user data it received and subsequently relinquished (which, you guessed right, is none).

While this is persuasive enough for many, we’d still like to see PIA following in the footsteps of some of the competitors that opened their doors to independent outside auditors, who checked their services in detail and issued a report on their observations. That said, the vendor has made an announcement that it was working on doing exactly this.

Private Internet Access: VOD and torrents

One of the most sought-after features of a VPN is access to popular streaming services like Netflix which often introduce blocks on viewership in certain locations, for various reasons. PIA not only provides access to the US content on Netflix, but also unblocks several other localised Netflix versions, including those available only in Australia, Japan, and Canada. However, BBC iPlayer is a whole different story, and you won’t have much luck accessing it with this VPN provider.

PIA excels in facilitating the sharing of large files via P2P or torrenting clients. All of its servers are P2P-optimised and will get you unrestricted torrenting from whichever location you want. Torrenting may even be assisted with the use of PIA’s port forwarding capabilities which redirects incoming connections to bypass the NAT firewall and potentially help increase torrenting speeds.

Private Internet Access: Support

Should you require any assistance with the platform’s use, installation, and such, PIA’s Support Portal is at your disposal, providing articles about a wide array of issues you might encounter and how to deal with them.

If the support section lacks the specific information you need, you can contact the always available customer support. They can be reached via live chat and email.

Private Internet Access: Final verdict

While Private Internet Access does have a few pain points, it does deliver in almost everything else - a capable and secure privacy platform packed with various expert-level features, Netflix-unblocking abilities, and access to a huge amount of P2P-friendly servers.

• The best VPN service

Operating since 2009, ExpressVPN is considered the best VPN solution in the industry, period. There are many reasons for this, including wide platform support that includes clients for Mac, Windows, iOS, Android, and Linux, as well as custom firmware and manual setup instructions for a host of other devices, including Fire TV, Apple TV, Chromebooks, PlayStation, Kindle Fire, you name it. This VPN can be simultaneously run on up to five devices.

Installing the clients is very easy, just download them from the website, follow a few simple steps (you’ll get all the instructions on the website), and you’re good to go. You can even set up a third-party OpenVPN client as ExpressVPN provides .OVPN configuration files.

Once you install them, you’ll notice all the clients have very intuitive, clean, and familiar interfaces. The Windows app allows you to connect to the VPN in just one click on its On/Off button or you can select a specific VPN location by clicking on the Choose Location button. You can also look up servers by countries or via a Search box, as well as create a list of your favourite locations.

A kill switch is there as a safety mechanism that blocks your entire Internet access in the event of a VPN connection breakdown. The split-tunnelling feature lets you decide which of the apps on your system you feel comfortable to bypass the VPN and use your regular Internet connection.

The Android app works pretty much the same. It allows you to connect and disconnect in one tap, as well as generate secure passwords. There’s also a Location Picker where you can choose your own preferred server, a kill switch, split-tunnelling, the auto-connect option, and more. The iOS app also has a Location Picker, list of your Recent Connections, and other useful options. It doesn’t have a kill switch, though, but you can set up your device’s own kill switch.

There are also browser extensions available for Firefox and Chrome, although you need to have the actual client installed to be able to use them. These powerful extensions offer some advanced privacy features themselves, including location spoofing, WebRTC leak blocking, as well as support for HTTPS Everywhere.

Excellent speeds and strong connections, regardless of your location, are guaranteed by the immense network that counts over 3,000 servers in 160 locations across 94 countries.

ExpressVPN: Plans and pricing

As expected, top quality doesn’t come cheap and ExpressVPN is the real proof. The most expensive option would be to pay on a month-to-month basis, as this would mean a monthly charge of £10.89. Discounts are usually offered as you opt for one of the longer-term contracts, such as the six-month plan with the monthly price equal to £8.40 (charged once every six months). Switch to the annual subscription, and the price drops to £7 a month (billed annually). Unfortunately, ExpressVPN doesn’t offer any subscriptions lasting longer than one year, such as two-year or even three-year ones offered by some competitors.

The provider accepts payments made via PayPal, Bitcoin, credit cards, Alipay, WebMoney, etc. If you’re reluctant to pay this price for something you haven’t tried yourself, you can test the platform on Android or iOS thanks to a 7-day free trial. Windows and Mac users, on the other hand, have a 30-day money-back guarantee at their disposal, allowing them to ask for a refund if they don’t want to continue using the VPN for any reason.

ExpressVPN: Privacy and logging

ExpressVPN protects your privacy with a host of top-notch mechanisms that include the standard AES-256 encryption, 4096-bit SHA-512 RSA certificate, Hash Message Authentication Code (HMAC), as well as supporting Perfect Forward Secrecy (which automatically assigns new key with your every connection), DNS (runs its own 256-bit encrypted DNS on every server), IPv6 leak protection, and protocols including OpenVPN (UDP/TCP), L2TP, and IKEv2.

There’s no logging either, at least not of any information that can be traced back to you. While many VPN providers claim they don’t log any of your sensitive data, ExpressVPN goes a step further, by opening its proverbial doors to third-party auditors from PriceWaterhouseCoopers who confirmed you can trust this VPN with your private information.

ExpressVPN tells you precisely what it does and doesn’t log, so you’ll know exactly what you’re getting yourself into. Specifically, it won’t log your IP address, the VPN IP address you were allocated, the time when you logged in, any websites you visited, or your traffic. What is logged, though, are the dates when you connected to the VPN, which server you used, the version number of the client(s) you installed, as well as the total amount of data transferred by you every day. That said, none of this can be used to track you down personally.

Moreover, ExpressVPN is located in the British Virgin Islands, a Mecca of privacy with no laws requiring it to log or share any customer information, nor with membership in any intelligence-sharing alliances, like the ‘14 Eyes’

ExpressVPN: VOD and torrents

ExpressVPN will unblock whatever geographically restricted content you need access to, wherever in the world you might be. This includes the famous video-on-demand (VOD) services like Netflix, Hulu, Amazon Prime Video, HBO, and BBC iPlayer, audio streaming like Spotify, and other online services (Facebook, Gmail, Twitter, Instagram, Wikipedia…) that might be censored in some more restrictive countries.

The same goes for sharing of large files via P2P platforms (although this isn’t explicitly advertised by the provider), as every single ExpressVPN server allows you to do so, without any limits on bandwidth, traffic, content, nor with any logging that might get you in trouble.

ExpressVPN: Support

This VPN vendor is there when you need it, at all times - featuring expert customer support agents available via live chat and email 24/7. There’s also an excellent support site filled with well-written setup tutorials and troubleshooting guides for every possible problem you might encounter while using the platform.

ExpressVPN: Final verdict

Whatever you want or need of a VPN platform, ExpressVPN has it - a vast network of servers, high quality and fast platform, VOD-unblocking capabilities, P2P support, proven non-logging claims, clients for every device, and a user-friendly interface. Its prices are above average, but that is to be expected from such a powerful VPN service.

• The best VPN services

Modern times have made it important for many of us to use a VPN - virtual private network, for various reasons. Corporations are no different. In fact, they are the ones that may need it the most in these times. Due to their sheer size, large number of clients, partners, and employees, both remote and on-site, high value of their operations, and company secrets, having a strong online protection can never be understated.

Unlike smaller VPN users, large businesses require high security, support for thousands of users at the same time, ease of use for all of the employees, high level of oversight and management, dedicated resources, integration with other services, and customer support available at all times.

Another difference between enterprise-level VPNs and their smaller counterparts is in deployment. Also, consumer VPNs are often focused on offering access to otherwise blocked content, which isn’t an enterprise VPN’s primary goal. Deploying the former typically requires a high level of technical expertise, which is why it is a task for the VPN provider itself or the company’s tech department and/or security technicians.

There are quite a few VPN services oriented at offering corporations privacy, anonymity, and protection against prying eyes but not many are successful in this endeavour. In this review, we’re analysing several of those that excel in it.

• The best VPN services

The best enterprise VPNs available

1. Perimeter 81 Enterprise VPN

Intuitive VPN software for business of any size

REASONS TO BUY

• User-friendly
• Full security platform
• Single sign-on

REASONS TO AVOID

• Some sites detect it

Perimeter 81’s speciality are organisations of various sizes, to which it provides several packages according to their specific needs. The Enterprise package is fully customisable and comes equipped with a long list of enterprise-ready security features to manage and customise your network.

The platform is available both on-site and on the cloud, and you can get zero-trust, agentless access for as many apps as you need. Enterprise clients are also provided with activity audits and reports, that allow monitoring logins, gateway deployments, and app connections.

Apps exist for all the major platforms (Mac, Windows, Android, and iOS) and are highly user-friendly and intuitive. Automatic Wi-Fi security is used to protect employee’s devices when connecting to unsecured public Wi-Fi, and multi-factor authentication ensures their identity. The single sign-on capabilities are provided via Okta, GSuite, Azure AD, and Active Directory LDAP.

DNS filtering is a useful feature that allows blocking users in your network from accessing specific websites, site categories, and IP addresses with a web browser. SIEM (security information and event management) integration enables capturing, retaining and delivery of security information and events in real-time to all SIEM apps. Speaking of integration, the service is also integrated with Microsoft’s Azure SIEM and Amazon S3.

All corporate users are provided with 24/7 customer support via in-app chat, email, or phone, while a dedicated solution architect assists with all your account’s needs.

2. Cisco AnyConnect

Reliable VPN built upon sturdy network

REASONS TO BUY

• Polished and clean software
• Enterprise-level technical support
• Multi-factor authentication
• Integrates with other software

REASONS TO AVOID

• Requires credentials each time

AnyConnect by Cisco is a robust VPN tool built for a large-scale company in mind. Cisco offers several options for businesses that wish to subscribe to its VPN services, including both term (one-year, three-year, or five-year) and perpetual licenses.

A license with this provider will get you a remote access VPN, allowing you and your employees to securely connect devices outside the corporate office (endpoints), including laptops, tablets, or smartphones. AnyConnect conducts security checks to make sure they meet a certain posture before connecting.

For employees who need access to the intranet from mobile devices, AnyConnect Mobility client for iOS and Android is available, launching in just one or two seconds and remaining connected until the device is turned off.

AnyConnect supports a highly secure connection to the intranet using the IKEv2 and SSL protocols, while the Cisco Adaptive Security Appliance authenticates the user and renders the mobile data traffic unintelligible if intercepted.

The provider’s service scale to meet your company’s requirements, be it 25, 1,000, or 100,000 users and devices, systematically protecting them wherever in the world they might be, and whatever your company’s specific use case.

Multi-factor authentication ensures additional security, while automatic software updates are delivered to the endpoints from the VPN servers. AnyConnect can integrate with other Cisco solutions to provide you with complete, enterprise-wide protection. To top it all off, Cisco has speedy, 24/7 live chat on the website, as well as enterprise-level tech support for enterprise application managers.

That said, the client requires you to input your credentials every time you log in, without an option to memorise them.

3. FortiClient

Multi-layered lite VPN to get you connected in no time

REASONS TO BUY

• User-friendly and easy to install
• Multi-functional
• Unobtrusive client

REASONS TO AVOID

• Some logging in issues

Thanks to using certificates instead of additional token generators or code calculators, Fortinet’s FortiClient is integrated and deployed quickly, without any unnecessary and time-consuming configuration procedures. Managing it is easy and intuitive, allowing you to configure web filtering and firewall rules in a matter of seconds.

Once you connect to the VPN, the client is minimised in the tray icon and stays out of your way, without any annoying notifications. It provides a stable connection, giving you multiple tools in one unified package - a VPN, firewall, web content filtering, as well as endpoint protection.

Everything is kept under control through the Enterprise Management Server (EMS) - the central management console that facilitates configuration, remote deployment, and management of FortiClient, endpoint registrations and status, vulnerability scanning and patching, threat alerts, and more.

That said, we noticed some slight issues with logging in - once the password expires, it is not longer possible to connect to the VPN, forcing the user to connect to their company’s on-site device in order to sync the new password.

4. Pulse Connect Secure

Corporate-level VPN with no software to install

REASONS TO BUY

• Universal client for remote and on-site access
• Web-based apps and virtual desktop software
• Endpoint compliance check

REASONS TO AVOID

• Some connection inconsistencies

Pulse Connect Secure is an outstanding enterprise-level VPN service that provides its users with a simple UI, clients for multiple operating systems, as well as other advanced features. One of these features is the universal client that provides the same streamlines experience both on-site and for remote workers who need secure access to the company’s internal servers.

Also, there is no software to install or maintain on users’ devices - they only need a web browser to connect and access corporate resources from any location. The platform itself ensures their devices comply with security requirements before connecting.

As soon as the app detects network changes, it will launch and establish a secure connection. Added security is provided with the help of different multi-factor verification methods that include Okta, Duo, miniOrange, and others.

Thanks to the centralised management and visibility capabilities, Pulse Connect Secure gives your granular control over who is accessing what, from where, how, and when. Integration with enterprise mobility management (EMM) platforms streamlines the management of mobile devices.

Having said that, low connection times are often a pain point, but otherwise, the platform performs superbly.

5. NordLayer

Established player in the VPN field

REASONS TO BUY

• Experienced VPN with proven track-record
• Easy to use
• Has plenty of servers around the world

REASONS TO AVOID

• No third-party integrations

Designed for organisations of any size, be it small companies or large conglomerates, Nord evolved as the provider kept adding more corporate-oriented features to NordLayer, eventually creating a whole new product.

All NordLayer’s business clients receive dedicated VPN servers on premises for internal use, as well as a dedicated IP address for every VPN account. A dedicated account manager is assigned to keep everything under control, while a centralised dashboard allows you to manage user accounts, permissions, gateways, and other VPN features.

For added security, all business customers can use third-party authentication via Okta, GSuite, Sami, Azure AD, and OneLogin, to sign into user-friendly clients that include Windows, Android, Mac, Linux and iOS apps. The Enterprise pricing plan is fully customisable and includes volume discounts, API access, and other custom additional features.

The large server network counting over 5,440 units in 59 countries is one of the largest in the industry and promises superior connectivity to your employees wherever they may be, growing together with your organisation and enabling the adding of licenses, dedicated servers, and company gateways as you go.

Having the best VPN (virtual private network) service these days is in no way overrated. After all, there are plenty of reasons to get one - governments and organisations spying on you or your business, blocking certain content based on your current location, or hackers trying to track you down and get access to your financial information.

Although there are some decent free VPN options out there, we highly recommend putting your trust into a paid-for service – and the cheap VPN services below deliver the goods without costing an arm and a leg.

Other than the price, the important things you should look at when choosing the best cheap VPN is the level of privacy and security they offer, as well as the range of platforms on which you can install and use them. Additionally, the ease of use is always a good trait for any VPN to have. Let’s take a look at the services that fit the description.

The best cheap VPN services right now

1. Surfshark – the best-value VPN on the market
   If you're looking for a cheap VPN that truly delivers the goods, then Surfshark may well be the provider for you. Its ever-increasing feature-set is a real match for premium providers, and at just £1.99 a month, it seriously undercuts them.
2. CyberGhost – an excellent alternative
   Even cheaper than Surfshark, CyberGhost is available from a measly £1.70 a month. Don't be put off by that though – this cheap VPN delivers excellent security alongside dedicated streaming features that are virtually unheard of at this price.
3. NordVPN – the best-known VPN is great value
   At £2.49 a month, NordVPN isn't quite as cheap as the above, but it offers class-leading privacy and security as well as excellent support and useful apps on tons of devices. If you want brand-name confidence, it's the one to go for.

The best cheap VPN providers available

1. Surfshark

Connect as many devices as you like for less than £2

SPECIFICATIONS

• Number of servers: 3,200+
• Server locations: 65
• Maximum devices supported: Unlimited

REASONS TO BUY

• Supports unlimited simultaneous connections
• Exceptionally cheap
• Lots of additional features

REASONS TO AVOID

• A bit basic for pro users

There’s a good reason Surfshark is the number one on our list - it will cost you less than £1.99 a month to have it if you take its two-year payment plan. This low price doesn’t mean there are many downsides to its service either. You get unlimited simultaneous connections, unblocked geo-restricted content, a solid number of servers, as well as some handy features like the Camouflage mode for added secrecy and the MultiHop feature routing your traffic through two VPN server locations.

The provider’s apps are available for Windows, Mac, Android, iOS, Linux, even Fire OS, while it also supports custom installation on game consoles, smart TVs, and routers. There may not be some super-advanced professional customisable features as in some, but consider you’re getting almost everything else.

Worried you won’t like it? Test it out during the seven-day no-charge period if you download its iOS or Android app, or the no-questions-asked 30-day money guarantee for all other platforms.

2. CyberGhost

Large server network and smart features list

SPECIFICATIONS

• Number of servers: 6,500+
• Server locations: 112
• Maximum devices supported: Seven

REASONS TO BUY

• Thousands of servers everywhere
• Superior features
• Extensive money-back guarantee

REASONS TO AVOID

• One-day Windows trial

CyberGhost has a longstanding reputation as one of the best VPN services due to the sheer size of its server network that counts over 6,600 units scattered all over the planet, support for torrenting and a long list of geographically limited content, as well as its wide platform support that includes all the popular players and then some.

And that’s not all. By signing up for its services, CyberGhost’s users are getting superior security and the possibility to use the VPN on as many as seven devices simultaneously. This number can be increased by setting it up on a router.

CyberGhost will give you an outstandingly fast and secure service for only £1.70 a month if you opt for its three-year subscription (you'll also get three extra months). If this is not enough to push you in its direction, then maybe its incredibly generous 45-day money-back guarantee will.

Also, CyberGhost will let you test out its services before you make the final decision. The trial period is one day for Windows and one week for iOS or Android.

3. NordVPN

VPN veteran with affordable and outstanding offering

SPECIFICATIONS

• Number of servers: 5,400+
• Server locations: 59
• Maximum devices supported: Six

REASONS TO BUY

• Wide server network
• Sturdy platform with pro features
• Unblocks everything

REASONS TO AVOID

• A bit more expensive than some

NordVPN is another big VPN name that prides itself on being among the cheapest in the industry. It provides superior services with a long list of advantages under the low price of £2.49 a month under the two-year pricing plan.

These features include support for all types of platforms, more than 5,400 servers, and strong security that is reinforced with the use of ‘Double VPN’ servers, directing your traffic through two different VPN locations, as well as the ‘Onion over VPN’ system that routes it over the Onion network.

In addition to the usual OpenVPN and IKEv2/IPsec protocols, the provider also uses modern, cutting-edge technology that is based on the new and fast WireGuard protocol, enhanced with a double NAT (Network Address Translation) system.

All users will be able to secure up to 6 devices at the same time, or more if they install NordVPN on a supported router, as well as get access to P2P and content available only in select countries (like Netflix, Facebook, BBC iPlayer, Amazon Prime, etc.).

You can test this all for yourself thanks to the no-questions-asked 30-day refund policy in place of a traditional free trial.

4. Hotspot Shield

Solid VPN with low price tag and limited free option

SPECIFICATIONS

• Number of servers: 1,800+
• Server locations: 80+
• Maximum devices supported: 5

REASONS TO BUY

• Free tier
• Simple to use
• High speeds

REASONS TO AVOID

• Not many streaming services supported

Pango’s Hotspot Shield has an advantage over many other cheap VPNs as it offers a portion of its services for free. The free tier includes 500MB of VPN traffic per day and one VPN location (US) but if this isn’t enough for you, there are two paid options at £6.99 a month and £10.49 a month under annual plans for premium and family packages respectively (£10.99 a month and £16.99 a month if you pay monthly). Also, Windows users can refer friends to get up to 10 weeks of the premium version for free.

This price will get you over 1,800 servers in 80+ countries, a solid range of tools such as the superior and fast proprietary Catapult Hydra protocol, and the possibility to protect up to 5 devices at the same time on a long list of platforms, including smart TVs and routers (removing the limit on simultaneously protected devices).

Many users will love its full support for P2P traffic exchange and geographically restricted services like Netflix US, Hulu, BBC, and others.

The provider is among those more generous with their money-back guarantees - giving you 45 days to ask for a refund if things go south.

5. Private Internet Access

Ideal for mobile devices

SPECIFICATIONS

• Number of servers: 29,600+
• Server locations: 77
• Maximum devices supported: 10

REASONS TO BUY

• High speeds
• Up to 10 simultaneous connections
• Huge number of servers

REASONS TO AVOID

• Slightly buggy Windows app

Private Internet Access (PIA) offers plenty under its low price tag of only £1.67 a month under the two-year subscription (you also get two extra months free). The offering includes apps for all the most popular platforms and extensions for Chrome, Opera, and Firefox.

Other advantages list all the classics - military-grade security and a handy kill switch feature which triggers a vibrating alert when activated on mobile. There is also a 24/7 live chat available.

With some guidance, the platform can also be enabled on certain routers and you can run VPN on as many as 10 devices at the same time. Additionally, it will allow you to download and upload large files via P2P clients.

That said, some downsides are present, such as the lack of access to the likes of Netflix and BBC iPlayer (despite the provider trying hard to change this) or a buggy Windows app. If that doesn’t make you any less interested, especially considering the price, you can give PIA a test ride during the risk-free 30-day money-back guarantee period.

Choosing the best business VPN service can be a critical decision for any IT leader. 

Businesses of all sizes contend with important and sensitive information daily, so keeping it safe in the face of increasingly-sophisticated cyber security threats is a top priority.

In world in which hybrid working is still highly popular, businesses must find a robust way to protect their data. The most popular way to do this is by using a business VPN, or ‘Virtual Private Network’.

Many of the best VPN services are better suited for individual users or households, while others have services tailored with small and medium business users in mind.

These typically provide a dedicated IP address and server, whereas this isn’t the case with consumer VPNs. Their IPs might be shared with other users and change each time you connect.

Another difference from consumer-oriented VPNs is that one universal account is created for the entire group of employees, while the account manager usually takes full control over it. Also note that the company will be aware of what websites their employees are viewing while using a business VPN.

The best business VPN services available right now

Choosing the right VPN for your business will depend on several things.

This spans a number of key areas, including software management tools or a dedicated account manager, number of servers, platform support range, number of simultaneous connections, and most importantly, level of security.

With that in mind, we did our due diligence and assembled a list of the best business VPN services on the market.

Perimeter 81 Business VPN

Best team-focused VPN solution

SPECIFICATIONS

• Number of servers: 700+
• Server locations: 36
• Email support: Priority response
• Split tunnelling: Yes

REASONS TO BUY

• Customised option
• 30-day refund policy
• Complete network security platform

REASONS TO AVOID

• Requires at least 5 team members

Perimeter 81 specializes in business VPN services, with three plans to choose from, based on your team’s size and requirements. 

Designed for companies whose employees work across multiple devices and switch between them regularly, this VPN platform offers plenty of business-oriented advantages.

One of them is the zero-trust network service that provides secure access to web applications and helps mitigate data loss without sacrificing efficiency. It also helps reduce the total cost of ownership (TCO) by offering one complete network security platform and managing it from the provider’s multi-tenant cloud. 

The cloud platform allows scaling as you go, removing the need for any external hardware. The provider also has integration with Microsoft’s Azure SIEM and Amazon S3.

The provider’s own software-defined perimeter (SDP) restricts network access, ensures secure and customizable access to networked systems, and provides simple cloud migration security.

Clients exist for Windows, Android, iOS, and Mac, and the service can also be set up on Linux, Linux/x64, and Chromebook. There aren’t many servers, but this doesn’t seem to get in the way of blazing speeds we have experienced during testing.

Perimeter 81 offers priority support to its business clients and if things don’t work out, there’s a 30-day money-back guarantee.

NordLayer

VPN veteran’s expanded offer

SPECIFICATIONS

• Number of servers: 5,470+
• Server locations: 59
• Email support: Standard
• Split tunnelling: No

REASONS TO BUY

• Established and trusted provider
• Access to thousands of servers
• User-friendly clients

A major player in the VPN industry, Nord has a strong solution for businesses called NordLayer. It provides companies with a dedicated VPN server for internal use, as well as a dedicated IP address for every VPN account.

Everything can be kept under control via a dedicated account manager and a centralized dashboard from where you can manage user accounts, control permissions, create and oversee gateways, as well as customize VPN features.

The outstanding security and privacy evidenced in the provider’s consumer edition is mirrored in NordLayer, where users get access to features like double data encryption and a kill switch. Users can also use third-party authentication, i.e. use their existing credentials to log in to NordLayer with Azure AD, GSuite, Sami, OneLogin, and Okta.

NordLayer's well-designed clients are available for Windows, Mac, iOS, and Android devices, and business customers can receive priority support at any time. Three pricing plans are available - Lite, Core, and Premium.

Encrypt.me Business VPN

Secures small businesses from 2+ team members

SPECIFICATIONS

• Number of servers: 100+
• Server locations: 75+
• Email support: Standard
• Split tunnelling: Yes

REASONS TO BUY

• Free trial
• Supports unlimited devices
• Easy to use

REASONS TO AVOID

• Very limited server count

Encrypt.me is a perfect solution for small teams as it requires a minimum of only two members for a business to qualify for its services, while supporting an unlimited number of devices. As your team grows, the price per user decreases. 

Limitations, however, do exist in the form of low server numbers.

That said, the provider features a list of useful tools for a business-like content filtering to protect your team and block attention-grabbing distractions like ads, malware, and social media. 

Throw in the auto-secure function and DNS protection into the mix, and you’ll get yourself a fine deal.

Team managers can easily control their entire team from a single account, and each user gets their own app. Speaking of which, provider’s user-friendly apps exist for Windows, Mac, Android, iOS, as well as Amazon Fire OS.

You can also deploy private endpoints - virtual servers hosted on Amazon Web Servers and dedicated to your team. The customer support is available 24/7 via chat or tickets.

ExpressVPN

First-rate VPN for remote workers

SPECIFICATIONS

• Number of servers: 3,000+
• Server locations: 160
• Email support: Standard
• Split tunnelling: Yes

REASONS TO BUY

• Superior speeds
• Top security measures
• Supports long list of platforms

REASONS TO AVOID

• Not the cheapest
• Doesn't have a business plan

ExpressVPN doesn’t have a specialised business VPN option per se, but it’s the ultimate VPN service for consumers. This makes it a strong solution for single business users and companies that employ remote workers.

It has thousands of servers all over the world and supports a wide range of platforms that includes Windows, Mac, iOS, Android, Linux, Chromebook, Amazon Fire OS, Nook, smart TVs, routers, and many others. 

Chrome and Firefox browsers are covered by ExpressVPN extensions.

The highest level of security and encryption is guaranteed with the use of the industry-standard features like the 256-bit algorithm and a kill switch, as well as additions such as split-tunneling, DNS on every server, and TrustedServer network that wipes all information on a server every time it is turned off and on again.

To test it out, users get a 30-day money-back period, during which they can use the service to the fullest and then decide whether they want to continue using it or ask for a refund. 

Customer support is available via live chat, email, or support ticket.

VyprVPN

Top speeds for business users

SPECIFICATIONS

• Number of servers: 700+
• Server locations: 70+
• Email support: Standard
• Split tunnelling: Yes

REASONS TO BUY

• Offers free trial
• Top-tier VPN
• Exceptional performance

REASONS TO AVOID

• A bit stingy on info

As a top-tier VPN platform, VyprVPN has full control over all of its servers, i.e. it owns and operates them exclusively, resulting in exceptional performance and improved security.

VyprVPN for Business includes multi-user management, dedicated account manager, and global business servers, offering unrestricted access to essential business tools from any location around the world, even China.

The other type, VyprVPN for Business Cloud, provides your own, dedicated business VPN server, ensuring total control of the entire stack. 

You also get your own dedicated IP, a secure access point that locks down your cloud infrastructure and protects your internet connection, as well as flexibility in connecting your existing apps and programs like Salesforce and Confluence. 

In addition, you can easily add multiple servers for your Sales, Dev, QA, and other teams, and each account supports up to 10 simultaneous connections. Additional connections are available for purchase.

Whichever option you choose, you’ll be getting access to top speeds and superb features such as NAT Firewall and Chameleon 2.0 technology that will protect you from VPN throttling and blocking, as well as deep packet inspection (DPI). Also, business users get a 7-day free trial.

Customer support can be reached at all times via live chat and email.

TorGuard Business VPN

Expert-level VPN security

SPECIFICATIONS

• Number of servers: 3,000+
• Server locations: 50+
• Email support: Standard
• Split tunnelling: No

REASONS TO BUY

• Lots of servers
• Advanced features
• 24/7 dedicated account manager

REASONS TO AVOID

• Speeds are limited

TorGuard offers four business plans to choose from - Starter, Small, Medium, and Enterprise. They differ in the number of supported users, encrypted email accounts, and dedicated IPs. 

Whichever package you choose, you’ll get access to a large server network scattered across over 50 countries.

In terms of security, it is covered by all the best tools - multiple ciphers AES-128 and AES-256, the usual list of protocols (OpenVPN, PPTP, L2TP, IPSec, SSTP, and IKEv2), SSL/SSH tunnels, and the blocker of WebRTC, DNS, and IPv6 leaks.

Stealth VPN hides your VPN use by masking it as regular Internet traffic, thus removing restrictions, bypassing DPI, and allowing you to gain permanent access to all the best online business apps regardless of the location.

Apps can be downloaded for Windows, Mac, iOS, and Android devices. All accounts receive a 24/7 dedicated account manager and access to a dedicated VPN management portal.

Having said that, the speed results hailed during our testing were at the average level.

A virtual private network (VPN) brings additional security to anyone using a public network, such as the Internet. Using a variety of security methods, such as encryption, the VPN is able to safeguard any data transmitted across the network, which may be at risk if it simply used the underlying public network infrastructure. VPNs are often employed when it would not be practical to use a physical private network, usually due to financial reasons. As businesses embrace mobile working and face increasing pressure to protect sensitive information, many are employing virtual private networks to improve their network security.

Remote access or site-to-site

There are two main types of VPNs currently being used by organisations: remote access and site-to-site. A remote access VPN uses the underlying public network to give users access to an organisation’s private network. In practice this would likely involve the user being greeted by a VPN gateway on their mobile or desktop device, which would then authenticate his or her identity. If validated successfully, the user then gains access to resources stored on the virtual network, which could include business applications and documents. Ultimately, this should enable employees to access their work network, including any local intranets, wherever they are.

Site-to-site VPNs may use some of the same software and equipment as a remote access VPN, but is usually employed for a slightly different purpose. Site-to-site virtual private networks generally connect entire networks based in one location to another network located somewhere else. This can prove extremely useful for businesses with multiple branches based in disparate locations, or organisations that wish to share resources securely with a partner or client business. Companies that employ a site-to-site VPN can benefit from enhanced collaboration without worrying about the security of their data.

• The best VPN service

VPN benefits

Security

The main reason why businesses choose to adopt virtual private networks. Having encrypted data, particularly if it is of a sensitive nature, is vitally important. Data breaches not only lead to compensation and regulatory fines, but can leave lasting reputational damage.

Mobility

VPNs give businesses the security to share their resources with employees and partners that are not based in the office at all times. This can provide a huge boost to productivity by ensuring that staff are not tethered to traditional office working times and locations. Organisations have also begun using VPNs to outsource their work, enabling them to lower internal staff costs.

Cost

Virtual private networks can prove much more affordable than a physical private network. Rather than having to lease long distance network connections to achieve a secure transfer of data, businesses use the existing public network to facilitate their VPN.

VPN disadvantages

Although VPNs are used by many businesses and individuals, there are some potential drawbacks that you should be aware of.

Complexity

Virtual private networks can be complicated to set up and configure. Businesses must ensure that the team in charge of setting up the VPN has a detailed knowledge of network security issues in order to ensure that the protection from the public network is suitably robust.

Control

The performance of a VPN hosted over the Internet is not entirely under the control of the business. They will need to rely on their Internet service provider in order to meet the agreed standards of performance.

Things to look for in an effective VPN

If businesses are looking to set up an effective virtual private network, there are a few aspects that they should keep in mind at all times. Firstly, businesses will need to decide which security protocol to go with. SSL/TLS, IPSec, PPTP, and L2TP are some of the most common VPN protocols, with SSL and IPSec proving most popular with corporate users. Although the protocol will not affect the end-user in any way, it will affect how secure your VPN is. Certain protocols are more complex to set-up, while others are straightforward, but not all VPNs provide data integrity. It is up to IT leaders to determine which security protocol is best suited for their organisation.

Scalability is another major factor to consider when setting up your VPN. Businesses need to factor in any potential growth that may occur in the foreseeable future. Their virtual private network should be able to handle not only the current levels of traffic, but any increases that may occur do to larger employee numbers or busy periods. Organisations will not want to replace their VPN technology altogether, so need to factor in scalability from the start.

Reliability is also vital, particularly across multiple devices. Mobile working is increasingly important in the workplace, so employees should receive a consistent experience from the VPN whether accessing it via a desktop PC, smartphone or tablet. It is also important to note that employees will soon grow frustrated, and therefore unproductive, if the virtual private network is slow, difficult to connect to, or unreliable.

If businesses decide to go with an external VPN service provider, it is important to consider where their servers are located. A third party vendor will be subject to their own national data governance laws, which may impact on the data that you send back and forth across the network. Although unlikely to be a major concern, businesses should consider where their VPN supplier is based before choosing a service.

To VPN or not to VPN?

Virtual private networks do not offer failsafe security, but in the light of recent high-profile breaches, many businesses will feel that any additional step that can be taken to secure their data is likely to be worthwhile. Although VPN configuration is not always easy, if it does help to prevent future data loss it will surely prove a valuable investment.

Editor's Note: What immediately follows is a rundown of the latest changes and additions since this review was last updated.

• R.O.B.E.R.T. Ad+Tracker blocking is now available to free users as well (February 2020)
• A new location has been added for free users - Turkey (April 2020)
• ROBERT now fully supports blocking of CNAME cloaked trackers on all servers (April 2020)

Windscribe is a relatively new Canadian VPN platform that offers its services under a free and premium version. The free version gives you access to 10 servers and has a limit of 10GB traffic per month, giving you quite a lot of freedom when compared to other VPNs’ free plans. The only condition is to sign up for a (free) account. If you don’t feel comfortable doing so, you can still take advantage of this plan but with a 2GB maximum.

The free plan doesn’t support multiple VPN connections at the same time, while the premium option has no such limitations whatsoever. On top of that, the full plan will give you access to servers in 110 cities across 60+ countries.

Secure and fast access to Netflix is offered with the help of specialised servers called Windflix. These allow access to several localised Netflix versions - US, UK, Japan, and Canada. Torrenting is fully supported although not on all servers.

The provider has an interesting proprietary feature called R.O.B.E.R.T. It is a mechanism that blocks content including malware, ads, trackers, gambling, porn, cryptominers, fake news, and more. Users can customise this option and also add specific domains they want blocked.

Windscribe: Plans and pricing

If your VPN needs extend beyond what the free plan can give you, you should consider purchasing one of the paid options. Windscribe offers a one-month plan for $£7.37 and a 12-month option at £3.34 a month (£40.13 billed every year).

A ‘Build A Plan’ option allows you to add whichever locations you want at 82p a month per location. The only condition is that you must choose at least two locations. Each selected location adds another 10GB a month of allowed monthly traffic. You can also throw in the R.O.B.E.R.T feature and unlimited monthly data for an additional 82p a month.

Once you select or build your desired plan which renews automatically, you’ll be presented with the accepted payment methods - credit cards, PayPal, cryptocurrency, or payment wall for Mint.

Although there is no traditional free trial, you can get a good taste of the service by installing the free version. The best part? There are no time constraints so you can give it careful consideration.

However, if you’ve already paid for the subscription and something goes awry, you can request a refund in the first three days after the payment. The only condition for having it approved is that you haven’t exceeded the 10GB traffic limitation.

Windscribe: Privacy and logging

Windscribe employs all the standard mechanisms to protect your privacy, including the 256-bit encryption with SHA-512 authentication and OpenVPN and IKEv2 protocols. Additional connection modes called ‘Wstunnel’ and ‘Stealth’ are available for OpenVPN. The former encapsulates it in a Websocket, while the latter wraps it in a TLS tunnel via Stunnel.

The optional Double Hop feature available on Windscribe’s desktop app redirects your traffic through two different locations, adding another layer of protection for your sensitive information. Do note that this may burden your speeds a bit, so it should be used only when necessary.

Virtually all VPN services have a kill switch - the security feature that turns off your entire Internet connectivity outside the VPN, preventing your information from becoming exposed when the VPN connection is interrupted or you restart your device. Windscribe calls its kill switch a ‘firewall’ and it has three modes of operation - automatic, manual, and always on.

The no-logs policy details all the data that Windscribe promises never to store. This information includes connection logs, session logs, IP timestamps, and online activities. The only information that is stored is when you last used Windscribe, as well as the total amount of traffic you had in a month. The purpose of this is to enforce the free tier limitations and prevent abuse. The company states ‘this is a rolling counter and is not kept historically’.

That said, we have no choice but to trust Windscribe on these claims as it still hasn’t provided an outside confirmation of them. Other VPN platforms are increasingly enlisting the services of independent auditors to examine their operations and produce publicly available reports.

Windscribe: Client Setup

Windscribe excels in the platform compatibility department. Not only does it have clients for Windows, Android, iOS, Mac, and Linux, but it also has browser extensions for Chrome, Firefox, and Opera. And that’s not all. You can enable the service on lots of other platforms like Nvidia Shield, Amazon Fire TV, routers, and more. This can be done with the help of the detailed manual guides on the website. If your router doesn’t support Windscribe, there are pre-configured devices that you can buy from its partners.

Windscribe: Performance

While the speeds hailed by this provider aren’t always ideal and connecting can take as long as 14 seconds, these problems occur mostly when connecting via OpenVPN. The situation improves dramatically when switching to IKEv2. This isn’t always convenient but it isn’t terrible either.

Windscribe: Support

Getting assistance regarding the use of the service is only a click away. Just head over to the website and navigate to the support section or blog with plenty of useful reading material.

You can also communicate with a bot named Garry if you click on the chat button in the lower right corner of the website. If you’d rather talk to a real person, you can submit a ticket and get an email response or even reach out to the team on the company’s Subreddit.

Windscribe: Final verdict

While its performance isn’t ideal, Windscribe is a complete premium VPN service that provides all the things you need, removing restrictions on geo-locked content and torrenting, as well as hiding your identity and activities from plain view.

• These are the best VPNs of 2020

Making a decision on the best usenet providers for your individual needs can be challenging, but it doesn’t have to be. 

Usenet is one of the earliest platforms for social networking on the web. If you’re new to it, you could consider it to be similar to Reddit. It’s essentially a bulletin board-style platform where users are able to create groups and join discussions.

You’ll find more than 120,000 groups on Usenet, all of which cover everything from IT advice to science, technology, and art across the Big 8 Usenet groups.

What makes Usenet different from other social media platforms is that you can’t simply access it through your web browser, although it is possible to access Usenet for free if you want to put the work in.

Usenet is a globally distributed system with no single company behind it. To get access to the network, you need a dedicated Usenet provider. There are plenty to choose from, and most quality Usenet providers won’t cost you more than a few dollars per month.

To help you navigate this market, we've reviewed the 10 best Usenet providers available today, so you can access this hidden corner of the internet in the best way possible.

What are the best Usenet providers?

Based on our Usenet provider reviews, we think Newshosting has the most to offer. It offers high-quality connections, Usenet archives extending back more than 4,000 days, and a built-in browser. We also like Easynews for its excellent search functionality and Eweka for its fast browsing speeds. 

If you use your own Usenet newsreader, UsenetServer is an inexpensive and fast service.

GigaNews comes with a VPN, although its archives extend back fewer than 10 years. Supernews offers a straightforward service for Usenet beginners, and TweakNews offers a VPN and 99.99% uptime at a reasonable price.

Astraweb lets you pay as you go for Usenet downloads, while Newsleecher enables you to automatically download new content from Usenet. Newsgroup Ninja, which rounds out our top 10, stands out for its budget-friendly pricing.

The best Usenet providers you can buy today

Newshosting

Top recommended Usenet provider

SPECIFICATIONS

• Retention: 5,657 days
• Newsgroups: 100,000+
• Maximum connections: 100
• SSL: Yes
• Newsreader: Yes
• Free trial: Yes

REASONS TO BUY

• Best file retention/largest database
• Free newsreader (Usenet browser) with search and a Usenet Index
• Previews included with search results
• Free Zero-log VPN service

REASONS TO AVOID

• Limited payment options
• Email support-only

Score: 4.5/5

Newshosting is the clear winner of our Usenet providers roundup. This service stands out first of all for its industry-leading 5,657 days retention. 

That describes how far Newshosting’s Usenet archives go back, and 5,657 days is equivalent to more than 15 years. Newshosting also offers access to more than 100,000 newsgroups with 99.99% connection completion.

The best feature of Newshosting, though, is its newsreader — the Usenet equivalent of a web browser. This handy tool offers advanced search options, built-in file previews, and support for NZB files (downloadable binary files for content on Usenet).

Newshosting’s Lite plan starts at $10 (£7.91) a month and includes everything you’ll need to surf Usenet. 

It offers up to 30 simultaneous network connections, which is far more than most users will need to browse and download content. If you want up to 100 connections or unlimited bandwidth, you can upgrade to the Unlimited plan for $12.95 (£10.24) a month.

The only notable drawback to Newshosting is that support is available by email only. This is common among Usenet providers, but we hoped for more from a provider that got everything else right. 

However, Newshosting does not monitor usage, so you can download as much as you want without having to worry about your speeds getting throttled or your account getting paused.

Read our Newshosting review.

Easynews

Simple newsreader for your browser

SPECIFICATIONS

• Retention: 5,676 days
• Newsgroups: 110,000+
• Maximum connections: 60
• SSL: Yes
• Newsreader: Yes (mobile-friendly)

REASONS TO BUY

• Download and access files from your web browser
• Best quality Usenet search
• Works on mobile & desktop devices
• Well-designed interface

REASONS TO AVOID

• English-only support

Score: 3.5/5

Easynews is another top Usenet provider that makes getting onto Usenet as simple as possible. The platform’s free newsreader integrates with Chrome, Firefox, and Safari browsers, so you can search Usenet and download NZB files right from your browser. 

We especially like this because you can easily switch back and forth between Usenet and any other tabs you have open in your browser.

The newsreader also has several great search features. You can sort Usenet posts by file type, posting date, and size, as well as search groups and posts with keywords. File previews are available right in your browser, making it easy to browse media-heavy discussions.

Easynews offers up to 60 connections and unlimited connection speeds with all plans. However, the plans can get a little pricey if you want to download a lot of content. 

The lowest-tier Classic plan costs $9.98 (£7.89) a month and comes with 20GB bandwidth for downloads. The Plus plan, which offers 40GB, costs $14.97 (£11.84) a month. 

The Big Gig plan includes 150GB of download bandwidth, and costs just $9.99 for the first three months. This also comes with a free VPN included. 

The Classic and Plus plans, however, do charge an additional fee for VPN support.

Read our Easynews review.

Eweka

High-speed independent Euro server farms with impressive retention

SPECIFICATIONS

• Retention: 5,673+ days
• Newsgroups: 125,000
• Maximum connections: 50
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• Unlimited speeds with an annual plan
• No download limits
• Accepts PayPal
• Can pay month to month

REASONS TO AVOID

• No built-in newsreader or VPN
• Doesn’t accept credit or debit cards
• All servers are based in Europe

Score: 3.5/5

Eweka is our top pick for getting the fastest Usenet connections possible. Annual subscribers can get unlimited speeds and up to 50 connections, while prepaid users receive connection speeds up to 300Mbps. 

In addition, Eweka promises a 99.5% connection completion rate, so you can count on the service being up anytime you want to surf Usenet.

Eweka doesn’t offer a built-in newsreader or a VPN, but it works seamlessly with leading third-party newsreaders like Newslazer. All users get access to a Usenet archive that stretches back 5673+ days. 

Notably, there are no limits on how much data you can download from Usenet with your account.

This provider is based in the Netherlands and all of its server locations are in Europe too. 

An annual subscription costs €9 per month month (£7.71). In addition, Eweka doesn’t accept credit or debit cards. You’ll need to pay with PayPal, a bank transfer, or one of several e-wallet services popular in Europe.

Read our Eweka review.

UsenetServer

High-quality unlimited Usenet for hard-core users

SPECIFICATIONS

• Retention: 5,676 days
• Newsgroups: 110,000+
• Maximum connections: 20
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• Inexpensive annual plan
• Unlimited downloads
• Offers a free no-log VPN
• Servers in the US and Europe

REASONS TO AVOID

• No built-in newsreader
• Maximum 20 simultaneous connections

Score: 4/5

UsenetServer packs a lot of features for surprisingly little money. With this connection service, you’ll get unlimited Usenet connection speeds and unlimited downloads starting from just $7.95 (£6.28) a month when you sign up for an annual plan. You also get access to a 5,676-day Usenet archive.

UsenetServer uses 256-bit encryption to keep your connections secure. In addition, the company has partnered with PrivadoVPN to offer a no-log VPN option for even more privacy and security. It’s included for free when you sign up for an annual UsenetServer plan.

This company manages servers across the US and Europe, which means you get fast and reliable connections no matter where in the world you are. UsenetServer promises 99% connection completion.

One potential drawback is that you cannot have more than 20 simultaneous connections with UsenetServer. That’s more than enough for most browsing activity and downloads, but super-users might find the connection limit to be too low.

Read our UsenetServer review.

GigaNews

All-inclusive Usenet provider

SPECIFICATIONS

• Retention: 2,367 days
• Newsgroups: 110,000
• Maximum connections: 100
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• Includes VyprVPN for free
• Inexpensive monthly and annual plans
• Zero downtime thanks to server switching
• 100 connections with all plans

REASONS TO AVOID

• Binary retention limited to 2,367 days
• No built-in newsreader

Score: 4.5/5

GigaNews is among the most expensive Usenet providers, but it offers quite a lot for the price. Some of the perks you get with GigaNews include 50 SSL connections to four different server locations, over three years of binary retention, over 17 years of text retention, a speed accelerator and the premium version of Golden Frog’s VyprVPN service.

The number of features that GigaNews has to offer might be overwhelming and not worth the money to users who won’t use them all. However, if you want quality and more choice, then GigaNews is right for you. 

Plans are based on one-month, six-month, and one-year cycles, respectively costing $9.99 (£7.90), $9.17 (£7.25), and $8.33 (£6.59) a month.

Read our GigaNews review.

Supernews

Straightforward Usenet provider for beginners

SPECIFICATIONS

• Retention: 2,357 days
• Newsgroups: 110,000
• Maximum connections: 30
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• No speed or data limits
• 256-bit SSL encryption
• Server switching for 100% completion
• Discount for new customers

REASONS TO AVOID

• Limited retention for binary files

Score: 4.5/5

Supernews is one of the simplest Usenet providers for beginners, in part because the platform offers just one plan option. You get unlimited connection speeds and no data transfer limits, so you never have to worry about exceeding monthly limits. 

In addition, the platform uses 256-bit SSL encryption for all connections and doesn’t integrate a VPN. For most users, this provides plenty of security without adding more complexity.

One thing Supernews doesn’t provide for first-time Usenet users is a newsreader. However, you can use any free Usenet newsreader with the platform. SuperNews has a detailed online knowledge base that walks you through the integration process.

Supernews offers only 2,357 days of retention for binary and media files, but you can access text discussions going back more than 18 years. 

In addition, the platform uses multiple servers across the US and Europe to ensure everything is backed up. If a connection isn’t working for any reason, SuperNews will automatically switch you to another server to complete your connection.

Supernews costs $11.99 (£9.48) a month if you pay month to month, or $8.25 (£6.52) a month if you pay annually. 

Read our Supernews review.

Tweaknews

Advanced Usenet provider with several options

SPECIFICATIONS

• Retention: 4,500 days
• Newsgroups: 110,000+
• Maximum connections: 60
• SSL: Yes
• Newsreader: Yes

REASONS TO BUY

• Two included newsreaders
• Multiple pricing options
• 4,500-day retention
• Unlimited downloads

REASONS TO AVOID

• Plan options can be confusing for beginners
• Trial limited to seven days

Score: 4/5

TweakNews is one of the best Usenet providers for more advanced users. This service lets you choose from three different plan options and offers integrations with a variety of different newsreaders and VPNs so you can customize your browsing experience. No matter what add-ons you choose, you get access to a 4,500-day Usenet archive, 256-bit encrypted connections, and unlimited downloads.

TweakNews offers three different plans that differ in maximum connection speed and the number of open connections you can have. The Fast plan costs €7.95 (£6.8) a month and comes with speeds of up to 50Mbps and 30 connections. 

The Lightning plan, which costs €9.95 (£8.52) a month, upgrades you to 100Mbps speeds and 40 connections. 

Finally, the Ultimate+VPN plan offers unlimited speed and up to 60 connections for €9.07 (£7.77). All plans can be paid monthly or annually.

When you sign up, you can choose from two different included newsreaders: UsenetWire and SABnzbd. Both work across Windows, Mac, and Linux computers. UsenetWire is a little easier to use, but SABnzbd offers several advanced search options.

Astraweb

Best Usenet provider for block accounts

SPECIFICATIONS

• Retention: 4,000 days
• Newsgroups: 110,000+
• Maximum connections: 50
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• Block accounts up to 1TB
• 100% connection completion
• 4,000-day retention
• SSL encryption for subscription plans

REASONS TO AVOID

• No SSL encryption for block accounts
• No free trial

Astraweb is our top pick if you’re searching for a Usenet block account. Block accounts let you buy a certain amount of bandwidth on a pay-as-you-go basis. 

At Astraweb, you can buy 25GB for $15 (£11.85), 180GB for $25(£19.74), or 1TB for $50 (£39.48). 

Block account data credits never expire, there are no limits on your connection speeds, and you can have up to 50 simultaneous open connections.

Astraweb doesn’t provide a lot of bells and whistles with these accounts. There’s no SSL encryption, so you’ll want to use your own VPN when browsing. In addition, you’ll need to connect your own Usenet newsreader. 

That said, Astraweb does offer redundant servers in the US and Europe, which allows the company to promise 100% connection completion.

If you’d rather purchase a subscription, Astraweb does offer those, too. Annual plans cost $8 a month for a yearly unlimited speed plan with 50 connections and 4,000 days of retention. You can also pay for three months for £13 (£10.26) a month, or you can pay month to month for $15 (£11.84) a month. 

There’s no free trial, but you can cancel within the first 24 hours and get your money back.

NewsLeecher

A pioneer in Usenet browsing with Usenet access included

SPECIFICATIONS

• Retention: 5,800 days
• Newsgroups: 100,000+
• Maximum connections: 30
• SSL: Yes
• Newsreader: Yes

REASONS TO BUY

• Unlimited data downloads
• Included newsreader with automatic downloads
• 256-bit SSL encryption
• Servers in the US and Europe

REASONS TO AVOID

• Can be complicated for beginners
• No discounted annual subscriptions

Score: 2.5/5

Newsleecher is a do-it-all Usenet provider that especially stands out for users who want to download a lot of data. That’s because Newsleecher offers unlimited connection speeds, unlimited data transfers, and an incredibly powerful newsreader. 

The company only offers a single plan option for Usenet Access, which costs $£7.75 a month paid monthly. Otherwise, you pay for the reader and access at £9.79 a month.

Newsleecher’s newsreader is the star of this service. It offers a wide range of filtering and search tools, plus it enables you to set up rules for automatically downloading new files as they’re added to Usenet. 

The newsreader can also create and export NZB files directly from search results, making it easy to build your own Usenet data archive.

All of the tools available with Newsleecher make it a bit unwieldy for new Usenet users. However, the software is relatively easy to get used to with some practice, and we haven’t found a newsreader that offers quite as many tools for saving discussions and files.

Read our Newsleecher review.

Newsgroup Ninja

Best budget Usenet provider

SPECIFICATIONS

• Retention: 5,676+ days
• Newsgroups: 110,000+
• Maximum connections: 50
• SSL: Yes
• Newsreader: No

REASONS TO BUY

• Very inexpensive annual plan
• Unlimited speed and bandwidth
• 5,676+ day retention
• 50 simultaneous connections

REASONS TO AVOID

• No newsreader or VPN included

Newsgroup Ninja is an incredibly budget-friendly Usenet provider. It costs as little as $5.83 (£4.68) a month when you sign up for an annual plan. So, this service is a great option if all you want is to surf Usenet for as low a cost as possible.

Despite its low price, Newsgroup Ninja offers many of the same features as the top Usenet providers we’ve covered. Its Usenet archive includes 5,676+ days of data and you’ll get access to more than 110,000 newsgroups. 

All connections are encrypted with 256-bit SSL and you can open up to 50 connections at once. Most importantly, there’s no limit on your connection speeds or bandwidth for data transfers.

Newsgroup Ninja doesn’t come with a newsreader or VPN, but it works with any third-party platform. You can try out Newsgroup Ninja free for seven days before committing to a plan.

How to choose the best Usenet provider for you

Choosing the best Usenet provider for you comes down to how you plan to surf Usenet. If your goal is simply to browse and join discussions, then you’ll want to choose a provider that offers a built-in newsreader. 

Check out Newshosting or Easynews, both of which offer their own newsreader platforms with built-in file previews, search, and more.

On the other hand, if you want to download content, including NZB files, then you’ll want to prioritize unlimited connection speeds and bandwidth when choosing a Usenet provider. We covered several providers that make unlimited bandwidth for downloads standard, including Newsleecher, Newsgroup Ninja, and GigaNews.

It’s also essential to think about retention when comparing Usenet providers. All of the services we covered have archives stretching back at least 2,300 days, or around six years. 

If you want to check out archived discussions from before 2010, though, you’ll need a provider with longer retention. Newshosting, Easynews, and UsenetServer each offer 4,881 days (around 14 years) of Usenet archives.

Further reading on Usenet

Learn how to download from Usenet, if you're interested in downloading files from the platform. Usenet can be a great platform for marketing your business and growing a community.

One modern way to access some of Usenet is via Google Groups, while it's worth establishing which of the best Usenet newsgroup readers you'd want to use. Once you're all set up, learn how to download from Usenet, as well as how to access Usenet for free.

The demise of the office was a popular talking point during the pandemic, and although it never quite came to pass, the central workplace we left in early 2020 isn’t the same today. For starters, not everybody came back. Remote work turned into a permanent deal for many, and this has forced companies to rethink the way their employees collaborate.

Within this cultural shift, however, a subset of workers are often forgotten – the IT team that maintains the technology which allows for hybrid offices. These professionals keep your device clean and connected no matter where you are, and they do so with remote access software from providers like Keeper Security.

Before the pandemic introduced more of us to remote working, virtual private networks (VPNs) were the go-to solution for remote workers. VPNs were fine when only a very small number of people worked remotely, but when the entire world shifted to distributed work, the limits of VPNs quickly became apparent. In addition to being expensive, sluggish, difficult to scale and complicated to use, the majority of VPNs don’t support modern zero-trust network access (ZTNA), which is key for securing today’s distributed data environments and workforces.

As an alternative, remote desktop gateway software provides organisations with fast, scalable and zero-trust remote access to IT infrastructure, with features such as least-privilege access, role-based access control (RBAC) and multi-factor authentication (MFA).

Use cases for remote desktop gateways

Remote desktop gateways work by capturing control of a remote device’s screen, mouse and keyboard controls and transmitting them to another computer, where a user can view and use the remote machine as if they were sitting right in front of it.

The most common use cases for remote desktop gateways involve IT and DevOps teams, who must remotely connect to IT infrastructure to perform upgrades, maintenance and troubleshooting. For example, help desk personnel can remotely connect to employees’ machines to find and fix software or operating system problems, security teams can use remote desktop access to investigate potential security incidents and DevOps teams can perform infrastructure monitoring and maintenance.

Non-technical employees can use remote desktop gateway software to transfer files from one computer to another, such as for sales demonstrations, or to print out documents stored on the remote machine. Remote desktop access enables employees to work from anywhere – home, a coffee shop, even abroad – and still access a central work computer to use the work-related programs and files that are stored on it.

Remote workers can also be taught to use their machines in new ways, or have new software demonstrated by a more experienced colleague via remote access. If the main office is looking to keep the organisation compliant with GDPR, for instance, the person in charge of data protection can reach out to all colleagues and remotely demonstrate what constitutes company policy.

The value of zero-trust remote access

Having a workforce spread across a region or an entire country (or internationally) presents a number of security challenges. Compromised credentials were a common attack vector for ransomware attacks prior to the pandemic, and the shift to remote work exacerbated the issue. Remote desktop protocols (RDP) are a major vector for ransomware attacks, as they frequently lack multi-factor authentication.

Without modern zero-trust network access, all cyber criminals need to access the wider network – or remotely tap into an individual device – is a working set of login credentials. Threat actors can crack passwords using a number of different tactics, such as brute-force attacks or password spraying. Your business is literally one compromised password away from a ransomware attack or data breach.

Keeper Security’s Keeper Connection Manager is an agentless, remote desktop gateway that can be installed in any on-premises or cloud environment to provide DevOps and IT teams with effortless, zero-trust access to RDP, SSH, databases and Kubernetes endpoints through a web browser. All users and devices are strongly authenticated before they are permitted to access organisational resources. Once properly authenticated, end users interact with remote desktops via a secure session from their web browser – there are no special plugins or client software to install and maintain.

Keeper Connection Manager enables administrators to provide access through RDP, SSH, VNC, MySQL and other common protocols without having to share credentials with end users. Unlike VPNs, which give every user full, unfettered access to all systems, Keeper Connection Manager’s fine-grained controls enable administrators to provide access to select systems – or just one machine. Access can be revoked at any time, and a robust audit trail identifies when and how the system was used.

Furthermore, all activity in the system is tracked and monitored with complete event logging, reporting and alerts. The zero-trust security model prevents lateral movement through an organisation’s systems unless permitted by the platform’s control and enforcement policies.

The hybrid work model is here to stay – and zero-trust network access is key to supporting and empowering a dispersed workforce. Keeper Connection Manager enables organisations to adopt zero-trust remote access for their distributed workforces, with granular visibility and control across all designated endpoints.

Try Keeper for free today or book a personalised demo to learn more about the best way to protect your organisation from cyber attacks

US Democrats have urged the Federal Trade Commission (FTC) to unmask transparency-hindering practices in the virtual private network (VPN) industry on the heels of the Supreme Court’s ruling overturning Roe v. Wade.

Earlier this month, Representative Anna Eshoo (D-CA) and Senator Ron Wyden (D-OR) wrote an open letter urging the FTC to “curtail abusive and deceptive data practices in companies providing VPN services to protect internet users seeking abortions.”

Citing data from consumer reports, Eshoo and Wyden stressed that abortion-seekers in the US are prone to a false sense of security with 75% of the most popular VPNs making hyperbolic claims and/or misrepresenting their products.

The lawmakers also underscored reports that accuse various VPN services of misusing users’ data, and the lack thereof “practical tools or independent research to audit VPN providers’ security claims.”

“With abortion illegal or soon to be illegal in 13 states and severely restricted in many more, these abusive and exploitative data practices are simply unacceptable,” the letter reads.

“We urge the Federal Trade Commission (FTC) to take immediate action... to curtail abusive and deceptive data practices in companies providing VPN services to protect internet users seeking abortions.”

Additionally, the democrats urged the FTC to develop a ‘brochure’ detailing internet privacy, as well as the risks and benefits of using a VPN.

“We will vigorously enforce the law if we uncover illegal conduct that exploits Americans’ location, health, or other sensitive data,” stated Kristin Cohen, FTC’s acting associate director in the division of privacy and identity protection.

Details of a new Microsoft Edge feature that appears to mimic Apple’s iCloud Private Relay have emerged on an official support page.

Called the Microsoft Edge Secure Network, the feature aims to help keep users’ browsing sessions safe and private. It's currently available in ‘preview’, which Microsoft uses to let experienced users and developers trial experimental features before pushing them to its wider user base.

There are a number of key elements to Microsoft Edge Secure Network, the first of which is encrypted network traffic. Microsoft said users’ internet connections will be routed from the Edge browser, through an encrypted tunnel to create a secure connection, even if the website is unsecured itself, helping stop hackers browse data over a public Wi-Fi network, for example.

The second benefit is tied to the encrypted traffic which will also help prevent online tracking, similar to the key selling point of Apple’s Private Relay.

Microsoft said that encrypted network traffic means internet service providers (ISPs) cannot collect user browsing data, such as the websites they visit, thus preserving user privacy.

Microsoft Edge Secure Network is not officially being touted as a virtual private network (VPN), or a VPN-like product, but comparisons have been drawn by onlookers, nonetheless.

While the new feature does offer the functionality of masking an IP address, browsing with a virtual one to further improve online anonymity, users are unable to pick a specific location from which they want to appear to be browsing.

The IP address masking used by Microsoft will replace a user’s geolocation with a similar regional address in a further bid to prevent online tracking from the likes of ISPs.

The feature is free for users, up to a point. In its early preview build, users can get 1GB of free data per month and there does not seem to be an option to purchase a greater limit at this time.

If Microsoft Edge Secure Network is made generally available, it’s likely that paid subscription tiers will be introduced, but Microsoft is just gathering feedback at this stage.

To enable the new feature, users running a preview build can simply head to Edge’s settings and click ‘Secure Network’. Microsoft will ask users to register for a Microsoft account if they have not already done so and then the feature will be activated.

Microsoft Edge Secure Network is being rolled out in partnership with leading web performance and security company Cloudflare which is providing a secure remote proxy for the browser.

Cloudflare said it will only collect limited amounts of data about the HTTP/HTTPS requests sent to the Cloudflare proxy by the Edge Secure Network and will delete temporary logs after a maximum of 25 hours.

The global virtual private network (VPN) market is projected to grow from $38.56 billion in 2021 to $45.89 billion in 2022, according to a new report.

A compound annual growth rate (CAGR) of 19.0% is anticipated for the forecast period, as companies continue to cater to consumer demands that had risen exponentially following the pandemic, according to Research and Markets.

Additionally, the agency estimates that the VPN market will reach $91 billion in 2026 while growing at a CAGR of 18.7%.

North America accounted for the vast majority of virtual private network market revenue in 2021. During the forecast period, however, the Asia Pacific region is expected to grow at the fastest rate.

Providers of VPN services are increasingly investing in technologies that enable reliable internet connectivity and remote access, further propelling the market.

Some of the key players in the VPN market include Check Point Software, Cisco, Golden Frog, Juniper Networks, and Microsoft. There are also a variety of VPN types considered in the research, including IP VPNs, cloud VPNs, mobile VPNs, and multiprotocol label switching (MPLS).

Microsoft has, for instance, integrated advanced features into its VPN Gateway in 2020. Particularly, Microsoft Azure VPN Gateway lets users connect their surrounding networks via site-to-site VPNs, much like they would for a remote branch office.

A growing number of cyber attacks will increase demand for virtual private networks in the coming years, according to the report.

Cyber crime has increased 600% since the outbreak of the Covid pandemic, encapsulating everything from identity theft to hacking, the World Economic Forum warned in its 2020 Global Risk Report.

Avast has launched Avast Secure Browser Pro, a premium, Chromium-based browser for Windows PCs.

The new browser features an integrated virtual private network (VPN) for users seeking lightweight yet robust security, privacy, and performance utilities. Avast Secure Browser Pro also includes advanced ad blocking technology to maximize user privacy.

Avast introduced a built-in VPN for its premium mobile browser for Android and iOS in 2020. Extending the support to premium version of Avast Secure Browser on PC underscores the firm's commitment to providing secure and fast browsing experiences across devices and operating systems, the company says.

"The browser is the modern day operating system, and with browser-based web threats one of the most common avenues of attack, we have a responsibility to protect our customers online by keeping their internet connections secure and private," said Fiona Cliffe, director of browser product at Avast.

"We've built our browser around a Security & Privacy Center to provide this in a way that is frictionless for the user and based on the belief that in order to preserve people's digital freedom, security and privacy needs to be simplified and demystified."

As part of its latest browser offering, Avast also offers privacy and compatibility features that complement its existing anti-phishing technology, anti-tracking, Bank Mode, and password manager technologies.

The Advanced Adblock feature blocks all ads that violate the Acceptable Ads Standard, including pop-ups and auto-play videos, while the built-in VPN secures all incoming and outgoing connections with encryption.

Avast Secure Browser Pro can be installed on Windows 10, iOS and Android, with support for Mac coming soon. The monthly subscription is priced at $5.99 per month, the annual subscription at $4.17 per month, and the two-year plan at $2.92 per month. A seven-day free trial is also available.

NETGEAR has announced an add-on service for its Orbi Pro Series business Wi-Fi router mesh systems (SRK 60 and SXK 80).

Dubbed Insight Business VPN, the new service lets small and medium-sized businesses (SMBs) extend corporate networks to branch offices and employees' homes via an always-on virtual private network (VPN).

Secure and centrally managed, the solution utilizes the same service set identifier (SSID) at the headquarters and remote sites, easing administrative burden.

“The Orbi Pro units at the remote and home sites, once powered on, connect the employees to the headquarters using the same corporate SSID, while performing standard Orbi Pro home router and WiFi functions. The connection is encrypted and persistent, requires no repeated authentication, and provides the equivalent level of security and user experience as if the employee was working from a HQ location,” explained NETGEAR.

Orbi Pro routers (SXR80 and SRR60) serve as prerequisite hardware for establishing the virtual private network (VPN) tunnels within the headquarters and at remote offices. An intuitive web GUI within Business VPN makes it easy to administer VPN access on a group/department level, monitor VPN access for remote employees and branch offices, generate performance reports, and more.

According to NETGEAR, its Insight Business VPN solution is ideally suited for managed service providers (MSPs) supporting multi-site and remote networks.

Insight Business VPN also comes with a 30-day free trial. Existing SXK80 and SRK60 Orbi Pro systems users can enable the service by installing the latest firmware on their systems.

“In the big shift to work-from-home, we’ve seen many challenges for the remote workforce, including security concerns and declining employee productivity levels due to unreliable access to company applications and networked systems, and storage,” said Douglas Cheung, senior product line manager at NETGEAR.

Cheung added, “NETGEAR Insight Business VPN tackles these concerns with a secured and persistent connection, running on Orbi Pro, a high performance business WiFi mesh system, all the while providing a seamless experience equivalent to that of working at the headquarters.”

Rishi Sunak has warned young workers against falling into the trap of permanent remote working, suggesting that going into the office can be beneficial to building their careers.

Speaking about his own experiences with LinkedIn News, the chancellor said that working from home wouldn’t have allowed him to build strong relationships and argued that video conferencing is not an adequate substitute.

He also warned against remote working becoming the norm for businesses in the UK.

“I was telling them that the mentors I found when I first started my job I still talk to and they have been helpful to me even after we have gone in different ways,” he said, according to the Times.

“I doubt I would have had those strong relationships if I was doing my internship or my first bit of my career over [Microsoft] Teams and Zoom.

“That's why I think for young people, in particular, being able to physically be in an office is valuable.”

Before becoming a politician, the chancellor enjoyed a career in finance, including working for Goldman Sachs.

He added that the government has stopped saying people should actively work from home, and has left it up to businesses to figure out the right approach.

In terms of a return to the physical workplace, Sunak said it will be gradual, cautious, and careful, but that there should be an eventual full return to normal working.

His comments echo the government’s longstanding messaging around remote working, with government ministers and the prime minister, Boris Johnson, periodically encouraging workers to return to offices.

In Autumn last year, the government embarked on a public messaging campaign for workers to abandon remote working and return to the workplace.

This was immediately prior to a significant rise in COVID-19 cases and a subsequent lockdown. This was largely spurred by the loss in economic activity due to workers not being out and about in town and city centres during the day.

Contrary to the government’s messaging, many office-based businesses, particularly those in the tech industry, have embraced remote working and are enjoying the benefits of cost reductions and productivity gains. This has been made possible due to an array of technologies such as cloud computing and virtual private networks (VPNs).

Most workers, too, have enjoyed the flexibility that remote working brings, with research conducted in August last year suggesting 90% of Brits wanted to continue working remotely.

However, a significant proportion of office-based workers have equally expressed a desire for a return to in-person working, however, due to the benefits of in-person collaboration and the office culture that’s missing from home-based working.

It’s why many businesses are opting for a hybrid model, which borrows from both remote and in-person working to create a flexible approach that most employees can get behind. KPMG, for example, has offered staff a ‘four-day fortnight’ as part of its remote working strategy, while the Bank of England has told staff to come into the office one day a week.

The increased pressure from remote working during the COVID-19 pandemic is putting pressure on existing virtual private network (VPN) implementations, according to new research from security company Zscaler.

In January, Zscaler surveyed IT and cyber security professionals in companies spanning multiple sizes and sectors to assess their approach to VPNs. The survey focused mainly on senior executives, but it also got opinions from managers and consultants.

Companies are coping with a challenging remote work environment. The survey found complex conditions, as 45% of companies cope with employee-owned devices connecting remotely to their infrastructures. They also ran their private applications on a range of infrastructures, with 67% running in the data center and 44% in private cloud environments. The public cloud also featured heavily in respondent infrastructures, with 37% running their applications in AWS, 32% in Azure, and 12% in Google Cloud.

This complexity extends to the VPNs they're using. The research found 41% of companies had over three gateways, with 21% running five or more. COVID-19 has contributed to VPN usage growth, as a third of companies that increased their VPN capacity did so by at least 50% to cope with the growth in remote working sessions.

The report suggests these VPNs aren’t keeping up with the increased pressure created by work-from-home mandates. A lack of visibility into user activity was the biggest concern, worrying almost a quarter (24%) of respondents. Nearly one in five (19%) were concerned that VPNs still required giving people access to the corporate network.

The VPNs themselves are also subject to attack, as 94% of respondents are aware their VPNs were open to cyber attacks and other exploits. Social engineering and ransomware are the biggest concerns, keeping three-quarters of respondents up at night. Malware came third, with six in ten people identifying it as a top threat.

Nearly three-quarters (72%) of respondents worry these security concerns might hinder their ability to secure their environments. Nevertheless, VPNs are still the top choice for remote access, as 93% of the companies surveyed use VPN services. People are gradually moving beyond VPNs, though, with 67% of respondents considering alternative remote access forms.

Zero-trust models are at the top of the list of alternatives, with 30% of companies already rolling out those solutions. Another 42% are in the early planning stages of zero-trust access. Work-from-home pressures have created a greater sense of urgency, with 59% accelerating their efforts due to the remote work focus.

This research echoes another report released in early February that also highlighted VPN security concerns among IT professionals.

Companies were already unhappy with their virtual private network (VPN) servers before the pandemic put extra pressure on them, according to a survey released today by security software company DH2i.

DH2i worked with a third-party market-research company to interview people whose companies used a VPN for network security. They spanned a range of IT job functions in companies that ranged from 500 to over 10,000 users.

The biggest concern was inadequate security, cited by 62% of respondents, the survey said. Two-thirds of the people with security concerns were worried about the security of the devices accessing the VPNs, and 59% also fretted over the privileges given to VPN users. A lack of visibility was also a concern, with 39% of people not clear on what VPN users were doing on the network.

While security was by far the biggest complaint for customers, VPNs also caused some other headaches. Reliability for data recovery came in second, with 45% of respondents identifying it as an issue. The cost of the VPN equipment, its performance, and its manageability were all problems for users.

DH2i concluded the survey in summer 2020. Complaints about performance would likely have increased as people continued working from home, placing more stress on office VPN equipment.

Security is also likely to have become an even greater concern during the pandemic. Even before the COVID-19 outbreak, the world dealt with a bug in the Pulse Connect Secure VPN that left its servers vulnerable. Intelligence agencies warned about attacks exploiting this and other VPN flaws in October 2019.

Since the pandemic lockdowns began and people started working from home more frequently, governments have warned again about attacks on VPNs. The US Cybersecurity and Infrastructure Security Agency (CISA) warned about VPN exploits in April last year, while several VPN bugs featured on the NSA's top 25 list of flaws targeted by Chinese state-sponsored hackers.

In October 2020, CISA issued an advisory warning about attackers chaining a bug in Fortinet's VPN with the Windows NetLogon flaw.

The top three use cases for VPNs in the survey were remote user access, identified by 83%, followed by site-to-site connections, which 57% of organizations were using. Cloud communications was also popular, with 48% of respondents using VPNs for communicating from their on-premises infrastructure to the cloud, or between cloud infrastructures.

DH2i is planning an updated survey to reflect changing attitudes during the pandemic.

The sudden surge in remote work and direct-to-cloud consumption of SaaS applications are putting pressure on the role of the physical security perimeter to business applications. Users need access to on-premises applications from multiple locations, and IT and cyber security teams have an imperative to provide secure access to these critical resources across a hybrid cloud environment.

With this challenge comes the need to reevaluate existing approaches to and controls of the perimeter. Organisations are moving away from the traditional method of using Virtual Private Networks (VPNs) because the way VPNs require a connection between the corporate network and the individual’s device allows for threats to be introduced through unmanaged devices.

This whitepaper champions zero-trust as the perfect approach for securing access while also providing operational efficiency. It can secure both cloud and on-premises applications with its improved mobility, threat detection, and data-loss prevention. Download this whitepaper for a framework to successfully implement a zero-trust strategy.

VPN usage has soared during the coronavirus lockdown, with more people than ever turning to virtual private networks to help them work from home or keep themselves entertained. Not only does a VPN protect your internet connection against snoopers and hackers, it lets you access streaming content that might otherwise be unavailable to you, so it’s easy to see why these tools are proving so popular now.

However, while most VPN users simply download a program to run on their PC, this versatile technology has many more benefits when expanded to other devices. For example, you can encrypt data on your phone, protect every device connected to your Wi-Fi network and watch US-only shows on your smart TV.

In this feature, we explain how to install and configure a VPN on any device that would benefit from it, and reveal the best tools for the job.

Using a VPN on your computer

Installing a VPN on your PC is very simple, and it’s the option people are most familiar with. Essentially, you download and install the VPN just like any other program and enable it when you need it, choosing a server in the location you require. If you want access to a website that’s only available in the US, for example, pick a server from that country. There are lots of VPNs to choose from, both paid and free,

but our favourites are Windscribe (windscribe.com) and NordVPN (nordvpn.com) because they’re trustworthy and affordable, and offer all the features you’re likely to need.

Windscribe offers both a paid and a free service. The free VPN gives you a choice of 10 server locations, including the US, and a fairly generous 10GB of data per month, which you can use on an unlimited number of devices. As an additional sweetener, the company has just upgraded its free service to let users stream content from overseas versions of Netflix and Disney Plus in most of its free locations. Don’t get too excited about this, however, because one hour of streaming or downloading from Netflix will quickly eat through your free monthly allowance: SD-quality video consumes 1GB of data per hour, while HD uses up to 3GB per hour and 4K requires a whopping 7GB per hour.

If you need a greater choice of servers (110 cities in 63 countries), unlimited data and a configuration generator to help you install the VPN on other devices, including your router, you can upgrade to Windscribe Pro for £7 a month or £39 a year. There’s also a great value ‘Build a Plan’ option, which lets you add specific locations for 77p each per month and gives you an additional 10GB of data. An impressive DNS-level blocking tool called R.O.B.E.R.T. (Remote Omnidirectional Badware Eliminating Robotic Tool), which kills ads, trackers and bad domains, is available for another 77p a month. You can try Windscribe Pro free for a day by clicking the Team Garry button (the floating green circle) on the website and asking for a Pro trial.

Unlike Windscribe, NordVPN doesn’t offer a free version, but you can try it free for 30 days at free.nordvpn.com. The company also offers a 30-day money-back guarantee on full subscriptions, so you’re not tied in if you try NordVPN and then decide it’s not right for you. As well as being easy to set up and use, it offers a whopping 5,200 servers across 59 countries, as well as advanced features such as the optional CyberSec tool, which removes ads from web pages and can help protect your browsing from malware, phishing and other threats. There’s also a Kill Switch, which suspends your internet connection if your encrypted VPN connection accidentally drops, protecting your identity. NordVPN has a strict no-logs policy, offers 24/7 support and can be combined with Tor for extra privacy and security, albeit at the expense of browsing speed.

NordVPN costs £9.20 for one month or £5.38 per month on its one-year plan, but if you sign up for three years, the price drops significantly to £2.69 a month, which is a bargain. At the time of writing, a two-year subscription was available for the same discounted price.

You’ll find a guide for installing and using NordVPN on PCs running Windows 7 and later here – the process is simple, and choosing a server is as easy as clicking on the global map and selecting ‘Quick connect’.

On your Mobile device

Most people use their mobile phone or tablet as their primary method of getting online these days, so it makes sense to install a VPN on those devices, too. All our preferred VPN services, including NordVPN, Windscribe and ExpressVPN offer apps for iOS and Android devices as part of the same subscription as their desktop VPNs.

There are lots of ‘free’ VPNs in the mobile app stores, too, with secure-sounding (but unfamiliar) names and scores of five-star reviews. However, you should be very wary of installing these, because many of them log your online activities and sell the data to advertisers and other third parties. Some free services request invasive permissions (such as the ability to access your email and text messages), while others fail to secure your traffic in the way you’d expect. While you might get lucky and discover a decent free VPN app, we’d definitely recommend paying for a VPN service from a known organisation.

The easiest way to set up a VPN on your mobile device is to install a trusted app, but the Android operating system supports VPN functionality, too. You can enable this feature through the Settings app. Open ‘Wi-Fi & Internet’ or Wireless & networks’ and tap VPN followed by the plus sign in the top-right corner. Enter the requested VPN information, such as a server address, username and password, which your VPN service will have provided you.

Apple iOS also supports VPNs and the setup process is much the same. On your iPhone or iPad, open Settings, then go to General and scroll down to VPN. Tap it, then select Add VPN Configuration and fill in the details.

On your router

Installing a VPN on your router is a great idea because it protects all the devices that connect to your home network – including PCs, phones, tablets, TVs and games consoles –

and means you don’t need to install individual apps. You can buy routers that have a built-in VPN client mode, but if you’re not ready to upgrade just yet, consider replacing your current router’s firmware with DD-WRT, which adds VPN support. Search for your router’s manufacturer and model in the DD-WRT website’s router database, then follow the instructions provided.

Once you’ve installed the new firmware on your router, you need to install and configure a suitable VPN, such as Windscribe, NordVPN or CyberGhost, all of which use the OpenVPN protocol. Most paid-for VPNs offer guides you can follow on the web. Windscribe provides instructions on setting up a router here (you will need a paid-for account or a one-day free trial of Pro), while NordVPN’s guide is here. Whichever VPN you choose, just search for ‘router’ in the support section of its website and you should find the details you need.

While there are many benefits to installing a VPN on your router, it can lead to a noticeable performance drop when visiting websites or streaming video. The extent of the slowdown will depend on your VPN, router and devices. Switching the protocol from TCP to UDP (see box below) can speed things up, so it’s worth a try. Open your router settings and locate the OpenVPN Client page. Click the arrow next to Tunnel Protocol and select UDP there.

On your smart TV

There are a number of ways to run a VPN on your smart TV. One is to install a VPN on your router, as we explain above. Alternatively, you can use a VPN app on your Android TV or a device such as an Amazon Fire TV Stick, or share your Windows PC’s VPN.

If you have an Android TV, you can access the Google Play store through it. Buy a subscription to a VPN service such as ExpressVPN or NordVPN and download the app. It will come in the form of an Android Package File, or APK, which you can install.

Then log into your account and connect to a server. If you own an Amazon Fire TV Stick you can install a VPN on that. Open the Amazon Appstore on your TV, search for a VPN and download the app. Sign into the VPN (or create an account if you don’t have one), then connect to it. The Fire TV Stick typically costs around £40, but Amazon regularly discounts it, so you should be able to pick one up for less if you’re patient.

Another option is to share a VPN connection in Windows. Install and set up the VPN on your PC, then connect your computer to your Smart TV using an Ethernet cable. Open the ‘Network and Sharing Centre’ on your PC by typing control panel into the Windows search box and pressing Enter. Open ‘Network and Internet’, click ‘Network and Sharing Centre’ and select ‘Change adapter settings’ on the left. Find your VPN connection (it will be called something like ‘TAP-Win32 Adaptor V9’), right-click it and select Properties. Click the Sharing tab and tick ‘Allow other network users to connect through this computer’s internet connection’. From the drop-down menu, select Local Area Connection and click OK. Restart your PC and your TV, and hopefully your secured connection will be available.

If you plan to access Netflix from a different country, such as the US, make sure the VPN you choose lets you do this, because the streaming service actively clamps down on such behaviour. This also applies to accessing BBC iPlayer from outside the UK.

On your games console

The most obvious benefit of running a VPN on a games console is that you can access games that aren’t currently available in your country. However, you can’t simply install a VPN on your Xbox One, PS4 or Nintendo Switch, because it’s not something providers offer, and the consoles don’t support it. That said, there are some ways round this. The best option is to install a VPN on your router because your console traffic will go through it. Another option is to set your console to use your VPN provider’s DNS servers, which will help you avoid some geographic restrictions. The process for this varies, but you’ll find your VPN’s DNS server addresses on its website. NordVPN users should go to bit.ly/norddns504, for example. Once you have the DNS addresses, check your console’s manual to find out how to change its DNS settings.

ExpressVPN offers a MediaStreamer service which, while not a full VPN, lets you watch online content that wouldn’t otherwise be available to you, and works by faking your location. Before you can use it, you have to create a dynamic DNS hostname using a service such as Dynu. Register this name with ExpressVPN, then configure the DNS on your console. You can find guides for setting everything up here. Select your console from the options.

On a USB stick

The main advantage to running a VPN from a USB stick is that you can use it to browse the web anonymously from any computer that has a spare USB port. That sounds useful, right? Unfortunately, it’s not as easy as you might imagine, because you need administrative rights to the PC you’re using. The VPN requires system access to change the PC’s network configurations, which includes installing new network interfaces. This means you can’t simply run the VPN from your stick – you need to install it.

An easy way around this problem is to use a portable browser, such as Firefox, with a VPN add-on installed. Simply install the browser on your memory stick, launch it and then install a VPN add-on and create an account or sign in using your existing account details. Alternatively, you could install the portable version of Opera, which comes with its own VPN built in.

The downside of this approach is that the VPN/proxy only protects any browsing you do. You can’t use it to hide other forms of internet activity on the computer you’re using, such as system activity and apps.

In your browser

Unless you need a VPN to hide your location while downloading content over BitTorrent, the chances are you’ll mostly use it to browse the web anonymously. If so, installing a VPN add-on in your browser makes a lot of sense. You could even have a browser for everyday use and another purely for accessing geo-blocked sites or those you don’t want snoopers to know you visit. All the major VPN services provide browser add-ons, including NordVPN, ExpressVPN, Windscribe and TunnelBear. The latter is particularly easy to use and offers extensions for Chrome (and therefore Edge), Firefox and Opera, although the free version limits you to just 500MB of data per month. Once you’ve installed your preferred VPN add-on, sign in and activate your protection by clicking its button on the browser’s toolbar.

Some browsers have a VPN built in. The best known of these is Opera, which introduced a free VPN with unlimited data four years ago. While most users appreciate its inclusion, it has attracted criticism from people who point out that because it only anonymises browser traffic, it’s actually a secure proxy rather than a VPN. Worse still, it collects data (connected to a unique device ID) for “promotional campaigns and advertising” and to help the developers make improvements. There are other downsides to bear in mind, too. The location categories it offers are very broad – Americas, Europe or Asia – which isn’t particularly helpful if you want to use a server in a particular country. What’s more, while Opera was originally a Norwegian company and still has its office in Oslo, it’s now owned by a Chinese firm, which might set alarm bells ringing. Opera is not alone, however. A recent survey discovered that more than half of the top free VPN apps in the Apple App Store and Google Play Store (both the UK and US versions) have Chinese owners.

If that doesn’t bother you and you simply want to disguise your browsing to access geo-blocked sites, for example, Opera’s VPN/proxy will be more than adequate. To enable the feature, press Alt+P to open Settings, then select Advanced in the sidebar and click Features. Toggle on the Enable VPN setting under VPN.

Opera’s VPN feature is also built into the company’s Android browser. This replaces the standalone VPN app, which was available for free on iOS and Android but was discontinued in April 2018.

Epic Browser for Windows, Mac, iOS and Android is another option with a built-in VPN, and offers servers in eight countries. Firefox doesn’t come with its own VPN built in, but Mozilla is testing one called the Firefox Private Network. This costs $4.99 (£3.85) a month and looks promising, although it’s currently available only to users in the US who sign up to a waiting list.

It’s possible that the service will be available globally in the future.

Finally, although it’s not a VPN, Tor Browser offers a great way to safeguard your web browsing by routing traffic through the Tor network. Unlike a VPN, Tor’s main advantage is that its network is run by thousands of volunteers, so you’re not putting your trust in one single organisation. This means there’s no danger that your browsing activity will be logged or sold

With most of us currently self-isolating and social-distancing to avoid spreading and catching the coronavirus, we’re likely to be spending more time online than usual. This makes it more important than ever to keep our web activities private and secure.

One option is to disguise what you’re doing by using a VPN, but another, more intriguing proposition is to connect to an alternative internet that better protects your identity and lets you access sites that are otherwise unavailable or censored. Often misleadingly called the ‘dark web’, the decentralised internet may sound legally dubious, but it’s actually a very effective way to browse and communicate anonymously online. However, you can’t just jump onto hidden networks through your standard browser.

In this feature, we lift the lid on the invisible web, reveal the tools you need to access it, suggest the best hidden sites to visit and explain how to stay completely safe and private.

Anonymous web FAQs

There are lots of misconceptions about the so-called dark web, which detract from its many benefits. Here we address the most frequently asked questions.

Why would you want to access the dark web?

It’s exciting to explore web content that the vast majority of people never get to see, and you’ll find things there that may not be available on the normal web. You can also have completely anonymous and unmoderated interactions with other people, without worrying that Google will index and display everything in its search results. People can be themselves – for good or bad.

What content can you find there?

The dark web has a reputation for being a ‘hive of scum and villainy’, and there is certainly some truth in that – some of its online marketplaces sell illegal products such as weapons, drugs, fake passports, counterfeit currency and so on. But you can buy perfectly legal things, too, usually paying with Bitcoin or another cryptocurrency, with the benefit that you don’t need to worry about a ‘middle man’, such as Amazon, taking a cut, trying to sell you additional products or tracking your movements and building up an advertising profile.

Reputable companies including the BBC, New York Times, DuckDuckGo, ProtonMail and Facebook offer access to their websites on the dark web through ‘.onion’ addresses (so called because onion services have multiple layers, like onions). These onion versions aren’t really any different to the standard sites, but they provide a channel for people who might not otherwise be able to access them – for example, if the country they are based in blocks or censors their content.

Is the dark web legal?

Yes. Think of accessing the dark web as akin to using BitTorrent. You can fire up the tool you need to access and explore content without breaking the law, but downloading a copyrighted film, TV show or some music is illegal – and that’s also true if you purchase something illicit from one of the dark web’s marketplaces.

Just visiting the hidden web won’t get you into trouble. It’s also important to point out that you’ll only see bad stuff on the dark web if you go looking for it, so you’re not going to stumble across anything illegal unless you choose to.

The team behind Tor, the most popular way to access the dark web, states categorically that “it is not a tool designed or intended to be used to break the law”, but to “enable anonymous communication and combat network surveillance that threatens personal freedom and privacy”.

Is it safe?

It’s mostly as safe as the standard web. Just take the same precautions as you usually would online, and don’t click any unknown links or download anything unless you’re sure it’s harmless.

Purchases can be more risky – if you buy from one of the marketplaces, you may end up receiving fake goods – or nothing at all. And if that happens, you won’t be able to complain to customer services, and you’ll lose your money.

Don’t be tempted to engage in illegal activity, either, because you could end up being arrested. Law-enforcement agencies have officers monitoring hidden sites and forums.

Who uses it?

Mostly people who live in oppressive regimes where the regular internet is restricted and access is monitored, but also anyone who just wants to browse the web away from the prying eyes of their ISP and other snoopers.

Recent research by cybersecurity website PreciseSecurity.com found that more than 30% of North Americans used the dark web regularly in 2019. Globally, users have cited their main reasons for accessing the dark web to be anonymity, privacy from internet companies and the ability to access content not available in their own country.

How do you access it?

The most common way is to use the Tor Browser, but you’ll need to know the exact web address of the sites you want to visit. These usually consist of a jumble of 16 (sometimes 32) characters and the domain ‘.onion’. You can also use Google or another, more private search engine to track down sites – search for ‘BBC .onion Tor’, for example, to find the address of the BBC’s dark-web site (bbcnewsv2vjtpsuy.onion). There are also a few dedicated search engines for finding hidden sites on the dark web, of which Ahmia (msydqstlz2kzerdg.onion) is the best-known – and least dubious!

Aside from Tor, there are other tools you can use to access the hidden web, which we’ll look at in the next section.

How to access the anonymous web

You can’t just hop on the dark web using Chrome, Firefox or another standard browser – it requires special tools for access. Here, we look at the main options

Tor Browser

Available for Windows, Mac, Linux and Android, Tor Browser is based on the same engine as Mozilla Firefox, but with a privacy-focused twist, using the Tor network to protect your browsing and disguise your location. Your traffic gets transmitted and encrypted across Tor relays around the world, and you can request a new “circuit” for any site at any time. This means you can browse the regular web anonymously, but the software is also adept at handling ‘onion’ addresses with ease, just as if they were HTTPS addresses, which makes it the best – and certainly the simplest – gateway to the dark web.

Unlike a VPN, there’s no single entity behind Tor that you need to trust – the network is run by thousands of volunteers, so there’s no chance of your data being harvested and sold to third parties.

Tor also does a good job of hiding where you’re browsing from and preventing you from being tracked, although visiting an unsecured website (HTTP instead of HTTPS) could allow an exit node to spy on you. You can use Tor with a VPN for additional anonymity.

Why you should use it: Tor is very easy to use – not much different from browsing the web normally – and, in addition to its built-in Tor functionality, the browser comes with a number of privacy-focused features and add-ons. It uses DuckDuckGo as its default search engine, disables risky plugins, such as Flash, and lets you adjust the security level of the browser – you can choose from Standard, Safer and Safest. The higher levels disable additional elements, such as JavaScript, and stop audio and video autoplaying.

The biggest downside of using the Tor Browser is a drop in speed. Your traffic gets routed through a number of relays, which can slow down your browsing noticeably. It’s not a tool you should use for protecting your torrenting, either. In fact, the developers strongly advise against using it for that purpose, because it slows down the network even more.

I2P

The Invisible Internet Project is an anonymous, peer-to-peer decentralised network layer (written in Java). It is essentially an internet within the internet, and lets you send messages, browse and host websites, chat and perform other web activities in complete privacy.

I2P employs ‘garlic’ routing (as opposed to Tor’s ‘onion’ routing), which adds an extra level of privacy by encrypting multiple messages together, to make them harder to snoop on.

Incoming and outgoing messages in I2P use separate tunnels, which improves privacy. It’s also designed to anonymise traffic within the network, protecting communication and preventing your ISP from seeing what you’re up to.

I2P is faster and more secure for accessing hidden services than Tor, and you can use it to access normal websites anonymously. However, it’s more complicated to set up and use than other anonymous services and while there is a browser configuration page you can follow, the website doesn’t do a great job of explaining how to get started. Additionally, I2P relies on Java, which could be seen as a security risk.

ZeroNet

ZeroNet is a peer-to-peer decentralised service that uses the BitTorrent network and Bitcoin cryptography to deliver “open, free and uncensorable” websites. Where Tor uses ‘.onion’ addresses, ZeroNet has ‘.bit’ domains. You can create your own websites and, just as with torrent files, the content remains online as long as there is at least one peer connected.

You need to install ZeroNet’s software to access it (available for Windows, macOS and Linux), and can then browse the available sites and services from the interface in your browser.

Because it uses the BitTorrent network, which isn’t very anonymous at all, ZeroNet offers less “out of the box” privacy than some other options. However, you can hide your IP address by using it in conjunction with the Tor Browser. There are instructions for how to do this in this FAQ.

There are a number of benefits to ZeroNet, primarily that it is very fast and it lets you access hidden sites even if you have no internet connection. Sites are updated in real time, so you don’t need to refresh your browser to get the latest content, and there are some excellent sites to browse. As mentioned above, however, ZeroNet isn’t anonymous by default, and it can be overwhelming when you first start using it because the list of available sites constantly refreshes (sort it by English to make it more manageable). Because ZeroNet relies on BitTorrent, you work as a peer to serve the sites you visit, which uses some of your bandwidth. You continue serving them, too, until you pause or remove them.

Freenet

Freenet has been around for 20 years, so it predates other, similar services. It’s a peer-to-peer decentralised platform that lets you share files anonymously, chat on unmoderated forums and browse and publish so-called “free sites” that can only be accessed through Freenet.

If you’re wondering how anonymous you will be, the answer is “very”. As the site explains: “communications by Freenet nodes are encrypted and are routed through other nodes to make it extremely difficult to determine who is requesting the information and what its content is”. There’s also a ‘darknet’ mode, which is where you only connect to your friends, making your activities even harder to detect.

Freenet’s purpose has always been to provide a private, anonymous service, and that remains the case today. You can chat on forums without fear of censorship, and publish and share files anonymously.

On the down side, it’s a peer-to-peer service. When you use Freenet, you contribute to the network by providing both bandwidth and a chunk of space on your hard drive. Popular content from Freenet is kept in this “data store” (in an encrypted format) and updated regularly. You can choose how much space to devote to it during setup.

Would a VPN suit you better?

A VPN (virtual private network) is similar to Tor in that your traffic gets routed through its own servers, hiding sites you visit from your ISP and disguising your location. The main benefit of using a free VPN over Tor is simplicity – you can visit sites as you would normally, in your usual browser; and access geo-blocked content by choosing where to appear to be browsing from, whereas Tor assigns your location randomly.

On the downside, free VPNs come with data limitations – even the more generous, such as Windscribe, only give you 10GB of data a month – or there’s an ongoing cost of at least £3 a month if you use a paid-for service providing unlimited data and choice of servers. There are also privacy concerns, with reports of free services selling user data to third parties.

Both Tor and VPNs have their pros and cons, but combining the two gives you the strongest possible anonymity. However, you will definitely experience a noticeable hit to your browsing speeds if you do so

Google has announced the launch of a zero-trust remote-access service designed to give remote teams access to their companies’ internal web-based applications without needing a VPN. Known as BeyondCorp Remote Access, the subscription-based service will be included in Google Cloud's portfolio. Google’s goal is to help keep companies forced to work remotely from overburdening their VPN infrastructures.

For now, the BeyondCorp Remote Access platform can only enforce access controls for web-based applications. For companies, this means they must connect their previously internal web-based apps to Google Cloud. Fortunately, Google plans to expand this technology in the future.

“This cloud solution — based on the zero trust approach we’ve used internally for almost a decade — lets your employees and extended workforce access internal web apps from virtually any device, anywhere, without a traditional remote-access VPN,” Google Cloud leaders Sunil Potti and Sampath Srinivas explained in the announcement.

“Over time, we plan to offer the same capability, control, and additional protections for virtually any application or resource a user needs to access.”

Currently, the BeyondCorp Remote Access platform leverages signals and metadata collected through the browser or an optional endpoint agent to establish user identity and determine the device’s secureness. For improved accuracy, IT teams can also ask employees to install the endpoint agent directly.

Google based the components of this remote-access solution on its experience implementing the BeyondCorp model in its offices. Further, many Google Cloud customers have already implemented BeyondCorp Remote Access within their organizations.

Colin Ahern, deputy CISO at New York City Cyber Command and BeyondCorp user had this to share in the company’s recent announcement, "We are responsible for leading the cyber defense of America’s largest city. It is vital that our Agency personnel are able to access critical applications no matter the situation or location. Google's BeyondCorp has allowed us to build a zero-trust environment where our team can quickly and securely access essential resources from untrusted networks."

A security vulnerability in the latest version of Apple’s iOS software prevents third-party virtual private networks (VPNs) from encrypting all user traffic.

When a VPN is activated on a device, the operating system typically shuts off all existing connections and them re-establishes these through a VPN tunnel. Version 13.4 of Apple’s iOS, however, doesn’t close existing connections when connecting iPhones to a VPN. This is an issue first discovered in version 13.3.1.

This is an issue that affects some apps, but not all, because a wide swathe of connections are short-lived and are closed automatically, anyway.

Some connections, however, remain open for minutes or even hours, and will remain established outside of the VPN tunnel, according to researchers with ProtonVPN.

Apple’s push notifications, for example, fall into the latter category and maintain a long-running connection between the device and Apple servers. Any messaging apps or web beacons could also be affected, for example.

“The VPN bypass vulnerability could result in users’ data being exposed if the affected connections are not encrypted themselves (though this would be unusual nowadays),” ProtonVPN said.

“Those at highest risk because of this security flaw are people in countries where surveillance and civil rights abuses are common. Neither ProtonVPN nor any other VPN service can provide a workaround for this issue because iOS does not permit a VPN app to kill existing network connections.”

The developer added the most common problem is IP leaks, with attackers able to see users’ IP addresses and the IP address of the servers they’re connecting to. The server a user may connect to would also be able to see the true IP address, rather than that of the VPN server.

ProtonVPN used Wireshark to capture iOS device network traffic in order to establish proof for the vulnerability. They found direct traffic between the iOS device’s IP address and an external IP address that was not the VPN server, but Apple’s server instead.

Should the connection have been encrypted, they would have expected to see traffic only between the device’s IP and the VPN server or local IP addresses.

Apple has acknowledged the VPN bypass vulnerability and is looking into ways to mitigate the issue, according to the researchers

In the past 12 months there have been 480 million downloads of mobile VPN apps – an increase of 50% on the previous year. That’s according to the 2019 Global Mobile VPN report and it shows that consumers around the world are starting to understand the benefits of connecting to the internet via a virtual private network when out and about.

But what about businesses? Have you ever stopped to think whether your business ought to be providing a VPN service to remote workers, or taking advantage of one to protect your sensitive data? We talked to industry experts to find out whether your business needs a VPN.

What is a VPN anyway?

Before we can address the question of whether your business needs its own VPN, you need to understand exactly what a VPN can do for you – and what it can’t.

“The network encryption provided by a VPN provides a business with confidentiality – your data can’t be read in transit – and integrity – your data, messages and transactions can’t be tampered with,” explains Charl van der Walt, chief security strategy officer at security services provider SecureData. VPN services achieve this by creating a virtual tunnel between a remote device and your corporate network, requiring strict user authentication and allowing you to enforce access control.

The benefits of this should be obvious. “When employees need to provide additional credentials remotely,” said Chris Hykin, technical services director at Stone Group, “it reduces the chance of the system being accessed by third parties, and prevents flexible working becoming a compromise to security.”

That’s not necessarily all your VPN will do. “As most VPN products require the installation of a low-level agent on the endpoint, many products also extend into the broader domain of endpoint and internet protection, providing features like content filtering and blocking malicious sites,” adds van der Walt.

Your company VPN can, therefore, be more than simply a network service: you can think of it as the foundation of secure communication between systems, people and sites. With remote working becoming an increasingly important aspect of the business environment, the value of that is clear.

What doesn’t a VPN do?

This all sounds super, smashing and lovely, but there are certain misconceptions about VPNs to clear up. SecureData’s van der Walt told us that, as VPNs have gradually become a commodity, some people have lost sight of their actual capabilities.

“VPNs are often seen by the enterprise as a catch-all system that offers everything from confidentiality to access control,” he said. “Products are frequently over-simplified when they’re sold and deployed; subtle points are overlooked, sometimes resulting in more harm than good.”

One important thing to realise is that all of the features offered by a VPN work differently in different phases of the data journey – from the endpoint itself onto to the internet, through the VPN gateway and onto the LAN. As an example, let’s think about cloud-based VPN products, where the gateway is hosted by a provider somewhere in the cloud.

“The confidential data passing through the tunnel terminates at a single point, managed by a third party, which makes it a highly attractive target for attack, compromise or lawful (or unlawful) interception,” van der Walt points out. “These third parties often store logs and authentication data in ways which are vulnerable to compromise, as we saw recently with the breach of NordVPN.”

It’s also important to recognise that a VPN product can provide complex functionality on both the endpoint and the gateway, which increases the potential exposure to attacks.

“Enterprise VPN products that integrate with a directory (like Microsoft Active Directory) are susceptible to phishing, credential reuse, credential stuffing and other forms of credential theft – exposing critical internal systems directly to an attacker over the internet,” warns van der Walt. Indeed, he mentioned that he’d seen precisely this type of attack being used successfully, both by “red teamers” – security experts who carry out simulated attacks to expose holes in a company’s defences – and by genuine bad guys. It’s safest to assume that all VPN gateway technologies – even from the biggest names – will be aggressively targeted in the wild, and any vulnerabilities will be exploited mercilessly.

Another vital point is that, while VPN services may be integrated into broader security solutions, the secure tunnel itself doesn’t do anything to detect, block or remove malware – or other unwanted content.

“If the data payload travelling over the VPN is infected,” says Ryan Orsi, director of product management at WatchGuard, “the VPN will securely deliver it to the endpoint – where it could run wild if the endpoint doesn’t have proper malware protection.”

Lastly, we need to talk about the encryption misconception. That may sound like an episode of The Big Bang Theory, but it’s actually even less funny – indeed, the consequences to your business of getting this concept wrong could be pretty darn serious.

“A VPN does not encrypt any data at rest, only in transit,” explained Paul Bischoff, a privacy advocate at Comparitech.com. “If the VPN server is acting as a middleman between the user and the internet, that user’s traffic is only encrypted up to the VPN server. The traffic between the VPN server and the final destination – a website, for example – is not encrypted by the VPN.” In other words, the VPN doesn’t provide true end-to-end encryption, and if you’re relying on a third-party provider they could theoretically be monitoring your traffic, or storing it in a form that could later be released under the weight of legal pressure.

Indeed, the possibility of data logging is more than just a theoretical threat: in certain countries, such as China, it’s required. In other words, in some territories, private networks are fundamentally compromised by design

So, does your business need its own VPN?

Now we’ve got a grip on those issues, we can start to address the actual question: does your business really need its own VPN, or not?

If you’re looking for a simple answer, it’s yes. As David Emm, principal security researcher at Kaspersky, told PC Pro: “A VPN is a necessary part of a business’ cybersecurity strategy, as it helps ensure that the credentials used to access corporate systems and websites that require input from a login and password can’t be intercepted.” In a cybersecurity landscape that’s dynamically evolving with new threats and vulnerabilities at every turn, it makes sense to embrace all the protection you can get.

At this point you might be wondering whether that really applies to all businesses. What if you don’t have any remote workers, and all your office computers are connected to a wired LAN that’s managed by a competent IT services provider? In such a scenario, VPN services are admittedly less critical. “The added layer of encryption is good,” notes Paul Rosenthal, CEO and co-founder of Appstractor. “But for many companies, I would consider putting a VPN on each workstation as icing on the cake rather than essential.”

Even then, though, a VPN has benefits, as it ensures that your activities can’t be snooped on, and cuts down the possible avenues for a data leak.

And things change as soon as you introduce Wi-Fi into the equation, as this greatly increases your exposure to possible attacks. “It’s very easy for hackers to either intercept your traffic or trick you to connect to a fake access point, where all kinds of attacks can be launched, potentially exposing confidential and sensitive data,” Rosenthal remindes us. In his view it’s pretty much essential that every non-wired device used by every employee should use a VPN.

Choosing a VPN service

For home users, choosing a VPN provider largely boils down to simple metrics such as speed and price. As Rosenthal puts it, “arguably there isn’t a huge amount of difference between the main consumer VPN brands, in terms of the technical level of security they provide.”

In a professional context, however, there are other issues to think about. “Businesses face a fundamentally different challenge,” Rosenthal says, “making sure that every device used by every employee has the VPN not only installed, but also switched on and used properly.”

This is a key reason why you shouldn’t rely on a consumer VPN service for business security: the client software doesn’t support central management. “Look for a VPN that’s designed for deployment in a business,” advises Rosenthal, “where installation and administration are simplified, and compliance can be enforced. Otherwise you’re leaving huge gaps in your cybersecurity defences.”

The other option is to operate your own VPN, which you might do either by installing or enabling services on your internal servers, or investing in a dedicated gateway appliance.

Either way, the self-hosted approach has the advantage of putting you fully in control of your own security – and the use case really kicks in when your business has multiple locations requiring access to a central network. Indeed, the value of this sort of system is understood even in environments that are broadly unfriendly to VPN usage.

“In many cases, even countries that block VPN usage will allow corporate entities access to one by requiring either a fee or the collection of data relating to how the VPN is used,” explains Larry Trowell, principal security consultant at Synopsys.

That said, there are scenarios where running your own VPN is an unnecessary investment. Trowell points out that if your workers aren’t actively collaborating on documents, and you just need to periodically exchange and synchronise data, a secure FTP or email server may be all that’s needed.

Configuration matters

If you have decided to set up your own VPN, you will need to confront the question of how it’s configured. The simplest approach is to route all your traffic through the VPN tunnel, but this can have an impact on performance. “If you’re forcing all your network traffic through the VPN tunnel, your latency will increase, and the connection will be slower,” warns Ron Winward, a security evangelist at Radware.

The solution could be split tunnelling, which routes only certain types of traffic over the VPN.

“Perhaps you have a resource inside of the network that needs remote access, but don’t want all your internet traffic to go through the VPN server,” Winward says. “Split tunnelling allows this. But if you do use split tunnelling, make sure your users understand that not all traffic traverses the VPN tunnel. Don’t create a false sense of security for them.”

The right tool for the job

Clearly there are multiple reasons and ways to use a VPN, and many people actually use several VPNs for different purposes. “As a global business traveller,” Winward says, “I run my own VPN servers at trusted locations where I control the network devices on the remote end.” Doing so gives him the confidence that his traffic is kept secure as it traverses networks outside of his control. But that’s not the whole story: “I also connect to other VPNs for different needs, including work, lab access, and basic security hygiene.”

The upshot is that it’s essential to properly consider exactly what you want to achieve by using a VPN. Your needs could be best met by a third-party provider, or by running your own VPN – or a combination of the two approaches.

“Each option has its own considerations,” Winward concludes. “A service requires that you trust the vendor with your data and your privacy. Buying your own device requires knowledge and support of the device, as well as the cost of purchasing and maintaining it. Open source might reduce your capex spend, but at the cost of not having support from a vendor when you might need it most.”

An IP address is your device's own personal identifier used by your internet service provider (ISP) to deliver the right internet services to you. When you want to access your email or go to checkout your online shopping basket, you're sending 'requests' over the internet that your network provider either approves or denies in its 'responses'. These responses can only be given to you (or, rather, your device) as that's the return address tied to your initial request, much in the same way a return address is attached to a physical parcel sent in the mail.

IP addresses can change frequently, connecting to a new network will leave you with a different address as it's a different ISP servicing your device. Each ISP needs to assign your device an address so you'll get a different one at home to work and from your friend's house to a hotel. Addresses aren't carried over devices either. Each device will be assigned its own address by the ISP so it knows how to route traffic to the right one.

IP addresses don't hold much information about you at all names, addresses, payment information and all the other things attackers like to get their hands on can't be ascertained simply from having your IP address. But your internet activity can be tracked using it, meaning you can become a receiver of targeted ads a constant reminder that someone or something is monitoring what you do online, which can upset some people.

Why you might consider hiding your IP address

An IP address can also give your ISP and other organisations, such as the police or government bodies, a rough estimation of where you were when you logged on.

But, there are many other reasons you may want to hide your IP address from prying eyes, aside from no longer being hounded by advertisers. For example, you may want to send confidential information over the network or use Internet services not available where you reside (such a Netflix USA).

Although there's often a little mistrust associated with those that want to hide their IP address, it's actually a much more secure way of sending data over the internet, so hackers will find it a lot harder to intercept data.

If you're using a public Wi-Fi hotspot, your IP address, as well as other information on your computer, could be left open to interceptors. Hiding your IP address from unprotected networks where hackers could be waiting to steal data is always a good idea, and makes it harder for advertisers to track you online.

Another reason you may consider hiding your IP address would be to use services not available in your country. For example, if you want to stream content from the US version of Netflix, you need to have a US-based IP address to use it. By hiding your IP address, you are able to access such service, even if you're not currently in the country the service originates.

If your workplace blocks certain websites it deems unsuitable, masking your IP address means you should be able to access them. Of course, this may be against your company's IT policies, so if it's a website you need to access as part of your job role, you may want to check in with your IT department to make sure they're happy for you to access the blocked website.

Finally, hiding your identity online also means you can hide from surveillance and tracking programmes, including those used by search engines, governments and your ISP.

How to hide your IP address

There are really only two reliable ways to hide a computer's IP address - either by using a virtual private network (VPN) or a proxy server. It's possible to mask your identity by using the Tor browser, which is designed to hide your IP address, or by using a third-party network provided by a coffee shop or hotel, but these come with their own security risks.

By far the safest method is to use a VPN, software that's typically installed on your system and reroutes web traffic through an address in a different location. Most VPNs allow you to choose which country you would like to appear to be working from, which is useful for getting around regional restrictions to certain websites. Once connected, anyone trying to trace your location would be directed to the country of your choosing, with your true IP address remaining hidden.

VPNs allow you to access websites and content that would normally be restricted to, say, only those residing in a particular country. For example, it was possible to bypass Netflix region locks by directing traffic through a US-based VPN, allowing you to watch US shows - at least until Netflix blocked access to those using such methods.

There's a host of VPN services available at varying prices, so it's important you choose the right one for your needs. If you need some pointers, try our guide to the best VPN services in 2018.

The second method is to use a proxy server, a service that allows you to redirect network requests through a third-party server, acting as a middleman between you and the end server. The server essentially acts on your behalf (a proxy) to access information from a site, meaning that only the server's IP address is revealed, and not your own.

There are lots of different types of proxy servers. Some allow your IP address to be seen, others assign a 'fake' IP address, while a third type completely hides it. It's important to choose the right one for your business, so check out the options before committing.

Image: Shutterstock

Proxy servers are an essential tool for staying anonymous while surfing the web, serving as an intermediate between a user's device, whether a phone, tablet or PC, and the server it's requesting information from.

As the name suggests, these tools act as proxies on behalf of the user and mask their true identity by sending false information to a target server. This prevents the server from discovering who is requesting information, including the location from which that request originated.

The main appeal of using proxy servers is they normally block the communication of personal data, however, somewhat understandably, proxy servers have a reputation for facilitating online crime due to the anonymity they provide.

However, there are plenty of benefits to everyday users and businesses. Some organisations use proxy servers in order to test the quality of connections to their services from specific regions around the world. Consumers, too, can bypass regional locks on online content, such as Netflix, or simply use them as an added layer of security while using the internet in public settings.

How does a proxy server work?

Every user accessing the internet from a device is assigned their own unique IP address, an identifier that is used to assess where the connection is coming from. For example, if a user was to open a web page and navigate to Google, the user’s IP address would be sent over to Google, which would then alter its home page and search results based on the user’s location.

A proxy server functions as an intermediary between the user and the website server, meaning the IP address must first pass through the proxy before being sent onwards. Proxies have a variety of functions depending on their setup (see below), but most prevent a user’s location from being discovered by sending a different IP address to the server. As far as the server is concerned, the IP it receives is the one sent by the user’s device.

This has a number of implications for the user, but most notably it allows the user to hide where they are accessing content from, or alternatively trick the server into thinking the device is being used in a specific country.

What are proxy servers used for?

Proxy servers have a variety of uses depending on how they’re configured, but most revolve around the idea of identity obfuscation.

Proxy servers can be used to protect a user’s identity when accessing sensitive material, help site admins test the usability of their website when accessed from different countries, and bypass controls that either block IPs from certain countries or prevent users from accessing region-locked content.

Organisations also have use for proxy servers. Most notably, they are deployed to help filter content, such as blocking workers from accessing certain websites or preventing sensitive content from leaving the company firewall. Proxies are also good for improving security by hiding the IP addresses of staff, as well as for speeding up websites and web-based servers by load-balancing and caching information.

Types of proxy server

Proxy servers come in a number of guises, each boasting varying functions to suit a host of purposes.

For instance, gateway proxy servers, or tunnelling proxies, are used to pass on unmodified requests the source of information, and users deploy a forward proxy to extract information from a source. The latter type is more internet-based normally. Meanwhile, a reverse proxy monitors access to a server via a private network.

Reverse proxies can also be used to hide the IP address of the server at source. A request is forwarded from the proxy to the ordinary server, and then this response is forwarded as if it's coming from the ordinary server - meaning the user won't know the exact origin.

These are normally used in corporate settings to encrypt sites using the secure sockets layer (SSL) cryptographic security protocol. It means that businesses won't need to implement individual SSL Server Certificates for multiple hosts.

Other potential applications include load balancing, in which the server used as a middleman that distributes loads to servers on which applications sit.

Moreover, reverse proxy servers are key to boosting the operating speed of a website. The mechanism takes advantage of caching to locally load content from the browser rather than the original server and compresses content, such as javascript, to make the content load faster and offer a better user experience.

Open proxy servers are a type of forward proxy that allow anyone to access them. There are hundreds of thousands all across the internet, with some (anonymous open proxy servers) allowing users to hide their IP address while they're browsing. This type will tell the source it's a proxy server, but it won't pass on the user's IP address.

Other IPs that hide a user's identity include a distorting proxy that gives an incorrect IP address, but tells the source it is a proxy server, a transparent proxy that identifies itself as a proxy and passes your address along anyway, and a high anonymity proxy that gives a fake IP address and doesn't tell the source server it's hiding the identity of the requester.

It's okay if you're not certain if you need a virtual private network (VPN), or how you'd go about setting one up. Those three little letters represent a minefield around compatibility, terminology, even legality: ask the younger generation what VPNs are for and they'll think of untraceable, anonymous access to the shadier corners of the internet. Or, they might picture ransom-demanding pirates and hackers taking control of their victims' machines.

Those bad actors and cyber criminals are using a VPN, since technically the term can mean any encrypted, encapsulated link from one internet address to another. That says nothing about what it's used for, what it can or can't do, who owns it or whether it's even working. What attracts the bad guys to such technology is the fact that no one can peer into the data that moves inside those encrypted packets although the destination and source addresses aren't encrypted, so it's always going to be apparent that a link is active. This is why business VPN solutions generally offer extensive security features: the value of the proposition lies in its impenetrability.

Unfortunately, as a result, the marketing spiel can lean towards impressive-sounding gobbledegook, intended to bamboozle senior management types simply looking for "the most secure VPN we can buy."

To make the right choice, you need to start by understanding what's possible and what's not possible. Then you can choose a way to do it and stay on top of the accompanying security obligations.

The benefits of a VPN

The most important benefit of a VPN is that it cuts your internal security problems down to size. Recently, embarrassingly so, there was a time when a Windows network could be constructed over global, public IP addresses, and many early design documents and even practical implementations made use of this configuration. It quickly became clear how inadvisable this was: even now, the interval between opening up an unsecured machine to the internet and its being compromised is typically measured in minutes.

A VPN can help here in two ways. First, you can shut off malicious connections entirely if you make a blanket rule only to accept VPN traffic. Second, you can close off the most prevalent exploits by using a border device that doesn't run Windows. Adopting these two simple measures is much less onerous than keeping on top of patches and threats to your entire Windows ecosystem.

This isn't to say that Windows makes a bad entry point for a VPN, or even a bad firewall. But it tends to be used best as part of a multi-device design, with routers, firewalls and SSL concentrators all playing their part in directing, filtering and brokering the traffic before it gets to the server. And there's certainly no need to use it for regular VPN duties: one thing that's moved forward in this field over the last half-decade is the burgeoning variety of ways you can land a VPN. Let's not get bogged down in the technology, and look at this from a business perspective.

Small businesses

The most common way to deploy a VPN in a small business is via a slightly smart router, with some small-scale features to support roaming Windows and Apple software clients. This kind of system will do the basic job, but it's likely to be using L2TP/IPsec for encryption and tunnelling, which often has a painful effect on internet performance as the router struggles to do all the required processing.

It's also not guaranteed to keep up with changes in the environment. Many organisations relying on setups like this have hit unexpected problems recently, thanks to changes in the VPN client in Windows 10. On paper, these promise better security and more versatility, but old routers have been left out, and the recommended solution has often been simply to go out and buy a new one. To be fair, it's difficult to blame manufacturers alone, because communication on Microsoft's part has been woeful, too. If you can't make your VPN work on Windows 10, not only are you unlikely to get a clear explanation as to why, you'll also look in vain for reassurance that whatever solution you come up with won't be borked in an update.

Even if your router-based VPN is nominally working, many businesses experience intermittent service (causing high levels of user irritation) because the kit has to work hard and doesn't cope well with issues. It's difficult to run tests on a router that can't reliably tell you when you need a hard reboot especially when your whole organisation is relying on it for connectivity.

One solution is to move your VPN services into the cloud, rather than keeping them inside a box with some LEDs on it. However, if you're only dealing with a dozen clients, this may be overkill. Businesses tend to assume it's the necessary next step when their low-cost router starts to struggle, when in fact stepping up to a slightly more capable local appliance could solve their problems more cost-effectively.

Mature mid-sized businesses

Larger organisations are more likely to have specialist IT staff guys who've been doing remote access since the days of the character-based terminal and noisy modem. For them, VPN is the latest faddy way to do it, and they're happy to jump aboard.

But this presents risks of its own. These guys tend to be early adopters, which might be fine for them but can create a steep learning curve for everybody else. They're also likely to want to set things up just so. This can lead to situations where changing anything at all outside the LAN, inside it, with software, hardware, supplier or anything else has unexpected consequences. A single cable popping loose might result in two routers both advertising as the single authoritative endpoint, causing security errors and leaving users locked out. Tracing the trail of cause and effect in a lovingly designed VPN can be agonising.

Let's not panic too much, though. Such situations are rare and high-end architecture can deliver legendary levels of reliability, especially when the people connecting to the VPN are doing so in consistent ways, from their branch or homes offices. It's when things are more unpredictable and chaotic that issues arise. Which brings us to the cloud.

Modern cloud-based ventures

If you've managed to cast off the traditional shackles of information technology, then good for you. But when your services and assets are all up in the cloud, the demand for secure access doesn't just evaporate: it becomes ubiquitous.

Accordingly, both Microsoft and Amazon prefer you to present your entire pool of client phones, machines and tablets in a privately connected way. This can go as far as setting up a dedicated, physical fast link between you and their nearest cloud-access point. Whether you go that far or not, both use a popular VPN technique, namely connecting over Secure Sockets Layer (SSL).

Most people are familiar with SSL in the form of HTTPS, which provides secure access to web services, but that's by no means all it can do. Transporting data through a secure pipe between your browser and a website is functionally indistinguishable from a regular VPN workload and, while many public hotspots and ISPs will block unusual connection types, they can't block SSL, as this would make most of the web inaccessible. It's no coincidence that firewall vendors charge extra for SSL connections, controlling how many VPN users you can have operating simultaneously.

If your business transacts a lot with the cloud, passing your VPN traffic over SSL out to be a no-brainer. Unfortunately, it comes with an extra level of complexity to deal with in the form of SSL certificates. These require renewing biannually, and come with their own classes of spam, phishing attack and malware. You'll even have to contend with competing certificate issuers engaging in dodgy customer-capturing strategies.

Once you're in a cloud-centric business, it's very likely all of this grief will come to visit anyway. All the same, you'll need to take a step back and evaluate how to manage the risks associated with relying on certificates. It should be fairly simple in theory, but failures can be protracted and fantastically disruptive: being cut off from your entire computing resource is something that modern cloud businesses don't fire-drill for enough.

Another potential pitfall for heavily cloud-connected businesses is not paying enough attention to local infrastructure. A typical issue that might arise is a router wanting to do its own thing with SSL packets, rather than loading up the certificate that's been issued. It may not be easy (or possible) to resolve the problem, short of replacing the router with a better-behaved, more expensive model.

VPNs and the distributed business

The stereotypical use case for a VPN involves executives travelling around the world with their laptops, but this isn't how most people work in daily life. In many cases, it's about working from home, while maintaining secure, reliable access to professional-grade resources.

This sort of environment is what the big firewall companies make small firewalls for. Rather than messing with the challenges of remote support and distributed traffic gateways, it's far easier to look at the lifecycle costs of setting up little IP subnets at each home office, each one supporting whichever devices the job requires.

Ensuring that an arrangement like this is properly fault-tolerant isn't a trivial matter. There are pressures from all sides. Plenty of ISPs will offer something like this as a turnkey solution but they'll run it over their own wires, rather than over the public internet. This means you're stuck with the provider's timetable for maintenance operations, which can be in the order of weeks rather than days, and users can't connect to their home router and go.

And what if the line goes down? You can get routers with 4G SIM cards, to keep an internet connection going if the main line is lost, but there's no way to guarantee performance. Apart from anything else, your teleworking neighbours may be in the same boat and hitting the same cell. No wonder distributed businesses are becoming increasingly interested in the new wave of collaborative productivity platforms, which can be used over any consumer-grade connection and are usually presented via web browsers.

A few final caveats: remote access can be tricky to manage if you have a high staff turnover. Very few distributed VPN services are responsive enough to disconnect a departing staff member in the time it takes them to leave the office and drive home. Another issue is whether the local council approves of turning an employee's home into their regular place of work: there have been cases of two-up two-downs being re-rated as business premises, with all the associated tax implications.

Cloud VPN providers

As mentioned, there's no technical need to invest in a full physical VPN hardware solution. Cloud VPN services let all your clients connect (via the provider's endpoint software) through a hosted server, which then connects to your central resources.

One big advantage of these services is that they're normally timely with fault rectification, since they do nothing else all day. They can also be much simpler to manage for an uncomplicated business setup but you may hit conflicts if you're signed up with a big cloud provider that requires you to use its VPN to access your hosted resources.

Another disadvantage is that several of them only do IPsec and not SSL, so you can't rely on being able to connect from any old hotel lobby or caf. This can cramp a mobile workforce's style.

Nearly VPNs

Depending on your needs, a classical VPN might not be the only, or best, solution. One alternative is remote desktop access, via services such as LogMeIn, TeamViewer and GoToMyPC. These products appeal to managers who fear the complexity and costs of a full VPN, and they tick the key boxes: you can normally connect from anywhere, and the traffic between the controller and the controlled PC is encrypted.

But if you want to take this route, there are some significant issues to consider. Offering a convenient gateway for users to connect to a machine inside your company's firewall means opening up the same opportunity to unscrupulous hackers. Some businesses address this by sending their remote-control traffic over their VPN, just to make you think about that combination. What's more, while the costs may seem low at first, the licensing structure can quickly become expensive and restrictive. Some of the product-support remote-control apps come in at 1,500 per year per starting licence, which may quickly turn you back onto more traditional VPN solutions.

Another idea that could, in theory, replace a conventional VPN service is taking advantage of IPv6 to open a secure connection directly to any internet-accessible device. I've seen Microsoft staff do this in meetings: if they've left a relevant file on their desktop PC back in Redmond, they simply pop open an IPv6 Teredo tunnel, from wherever in the world they happen to be at the time, and grab it.

This shouldn't be taken as a recommendation, however, not least because I honestly have no idea what sort of defences Microsoft has at the edges of its IPv6 network. I suspect that its security resources are formidable indeed, and the number of companies who can match them is evidently small, because I seldom see anyone else even trying to dip a toe in the water.

Indeed, although IPv6 was originally envisaged as a general-purpose transport for connecting any two devices in the universe, there's a whole range of alternatives out there, including completely private protocols, such as those underpinning Amazon's services. Rather than becoming the universal transport, IPv6 may end up being an ancestor of the eventual winner which isn't at all clear right now, and may not even exist yet.

A virtual private network (VPN) is crucial for those worried about staying incognito online. As its name suggests, a VPN creates a private network from a public internet connection and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Simply put, a VPN acts as a barrier between you and the content you're attempting to access, concealing your identity from those trying to snoop on your online actions.

For general internet use, VPNs function as a cover for your IP address, acting as a broker between a website's server and your device by simply showing the address of the VPN.

Connections going through a VPN benefit from an added layer of security, which means they are also a staple of remote working, something which has become widely adopted during the COVID-19 pandemic. Using a VPN enables employees to access confidential work documents safely and securely while away from the office and using potentially less secure internet connections.

Aside from masking your IP address and remotely connecting you to business systems, VPNs are also used as a means of getting around regional locks, but some websites block access to known VPN technology to prevent the circumvention of their geo-restrictions.

In some parts of the world, the use of a VPN is prohibited. In China, for example, it's illegal to access the internet using a VPN unless you have been given express permission from the government. Even in the UK, there have been attempts to ban such blocking software, most notably under the Investigatory Powers Act, given concerns that it could make it more difficult to crack down on domestic terrorism.

Given the similarities between VPN services, it can be tough to choose a VPN provider. There are free VPNs available, but the paid-for services often tout better identity protection, a greater number of hosting locations, and often live support.

To help you cut through the marketing fluff, we decided to put these claims to the test, pitting some of the market's best-known VPNs against each other to see which is the best value for money and time.

How we tested our VPNs

To assess each VPN's performance, we installed its PC client within a Windows 10 virtual machine (VM), running on a Windows 10 host. Testing one service at a time, we connected to the nearest server location - usually London - and conducted a five-minute ping test in parallel on both the VM and host. In each case the host experienced no packet loss, allowing us to measure any losses through the VPN.

Within each VM we also used speedtest.net to compare broadband speeds before and after connection to the VPN. We should stress that the number of variables involved means that these tests can only provide an indication of how well each service might perform.

With each service connected in turn, we checked the DNS configuration using the extended test at DNSleaktest.com. Here it's ideal to see only servers owned by the VPN provider itself: the presence of any third-party server means that anonymised and aggregated DNS requests are being passed on by the service. A server belonging to your ISP is likely to mean that DNS traffic is leaking outside of the VPN altogether - a red-flag for anonymity.

To test the stealthiness of each VPN service we carried out a long test at Whoer.net, which would help expose potential problems such as a blacklisted IP address, or other issues that might give away your use of a VPN. Typically these include mismatches between system and ISP time zones, or between ISP and DNS territories. Again, we should stress that many variables can affect the results we saw here: we experienced variations even between servers belonging to the same VPN service.

We tested how well each service could defeat geoblocks by connecting to a US server and attempting to view US content on Netflix. Where necessary we tried multiple servers and enabled any additional features that might help, such as Smart-Play in NordVPN. For each service, we also tried to view iPlayer content when connected to a UK point of presence. Our results here confirm that content providers are successfully barring access from many known VPN servers. It's an ongoing battlefront, however: we'd be wary of assuming that a service we found to work will continue to do so, and vice-versa.

F-Secure Freedome VPN

F-Secure's Freedome VPN is ideally suited to beating surveillance. It's based in Finland, so while it's subject to rigorous EU data protection laws, it's not a member of the 14-eyes surveillance consortium. It's not designed to circumvent geoblocking, though, and territorial options are much more limited than other offerings with no locations in Central or South America. The upside is that it's blazing fast, with just 1% packet loss.

Price when reviewed: From £24.99

Read our full F-Secure Freedom VPN review for more information

AnchorFree Hotspot Shield

With a series of eight icons advertising various content services unblocked by Hotspot Shield, it's not hard to guess what the primary focus of this VPN is. There's a Chrome extension, 20 locations to choose from, and video streaming is smooth and high quality. User anonymity is a slight problem though, so if you're after total privacy and security rather than just unlocking US Netflix, you may want to consider an alternative.

Price when reviewed: From $5.99 per month

Read our full AnchorFree Hotspot Shield review for more information

NordVPN

If privacy is your motivation for using a VPN, then NordVPN is one of the most effective examples you're likely to find. There are numerous privacy-protection features in place, including a 'double VPN' setup that filters your traffic through two separate VPNs. Unfortunately, it won't work for accessing US Netflix content, and there are some significant variations in features between different servers. Overall, however, NordVPN is an excellent option for those looking to shield their surfing from prying eyes.

Price when reviewed: From $2.96 per month

Read our full NordVPN review for more information

What to consider when choosing a VPN

It's important to note that each VPN service's performance will vary over time and with the exit point in use. This is particularly true of geo-blocking, where we couldn't test every content provider or server for each service – it’s here that we would expect constantly changing results as streaming providers will doubtless attempt to close existing backdoors. With that in mind, it's hard for us to make a recommendation solely on performance.

We're confident that each of the services here provides additional security for anyone connecting over an unsecured or public network, but we saw significant variation in whether third parties could potentially log our DNS requests and in how well each service disguised the fact that we might be using a VPN. F-Secure's Freedome managed to combine stealth and privacy with superior performance, so it's our recommendation for those who need neither P2P nor router support. For those who do, we'd recommend NordVPN.

Even in the consumer space, VPN providers are seeing an uptick in interest. Perhaps that's not surprising as the Snowden files detailing widespread online surveillance, on both sides of the Atlantic, have caused many users to look for ways to cloak their online activity. It's more a matter of principle than anything else.

As each new user logs on, they become part of the provider's WAN, in much the same way that businesses have been using VPN for years: to connect their remote offices to centralised resources.

Implementing a corporate VPN needn't be complicated. Neither is there any requirement for its users to understand how it works - or even that they're using one.

"[It lets you] store your files, intranet servers, authentication servers and so on at the head office, and connect to them via the VPN," said Dan Harris of business ISP, Beaming. "You'd have a router with a VPN server at the head office and routers in the branches with specific configurations that allow them to connect back to it... You can do other things like fibre between buildings, which will work, but it's debatable whether this is secure, and it's certainly expensive."

What Harris describes is one of the most common VPN implementations within a disparate business. Called hub and spoke, the corporate HQ or data centre sits at the centre and its remote sites call in. For a long time, this was the only viable infrastructure, but it's latterly been joined by the mesh-configured VPN.

"These have got redundancy built in," explained IT security manager Daniel Prendergast. "If the primary connection back to the hub goes down, the remote offices will refer back to their routing tables to find an alternative track to the resources they need, often through their sister offices. Basically, it's how the internet works, but on a much smaller scale."

Beyond VPN

VPNs may be grabbing the headlines at the moment, but they're not the only option. "Traditionally, you'd have opted for MPLS [Multiprotocol Label Switching] because it guaranteed you a set bandwidth when the internet was still fairly slow," said Prendergast. "That's no longer the case, of course, when broadband frequently tops 500Mbits/sec on fibre, but it remains an option."

Yet MPLS has its detractors. It doesn't offer the flexibility of a VPN, setup costs are higher to reflect the more involved process, and contracts are often longer.

"[It's] really about stitching together a lot of different network protocols," explained Bob Hendy of Cerberus Networks. "When you had multinational companies, they might have a frame relay in one country, an ATM network somewhere else, but now everything is IP everywhere."

IP traffic can just as easily be routed over a VPN, which can be set up in a few hours, taken down instantly and reconfigured whenever business needs change. "You could easily buy another office anywhere in the world, get your connectivity and set up a VPN," said Harris. "You can immediately give your customers peace of mind that their data is being handled securely, which a business might like to use to market itself."

The only downside is that speed isn't guaranteed because the connection passes over the internet, and is thus contended.

A managed solution

Larger businesses with in-house IT will naturally oversee their own VPN, but there's no reason why VPNs can't be handed off to a third-party and hosted in the cloud, effectively making the head office just another node on the WAN.

As far as its users are concerned, they're paying for a virtual gateway in exactly the same way they'd rent a virtual server. It can be scaled up or down as required and managed entirely from one central point, rather than requiring IT support at each office, or for a technician to travel between sites. As the hub is already cloud-based, additional services, such as online backup and PBX, can be added at the same point.

"It's exactly the same as an MPLS service provider would do, but without all that additional kit that's there to support MPLS networks," Hendy said. "We just do it as an Ethernet VPN. The net effect is the same but it's cheaper and more flexible, and we can deploy a lot of VLANs across our network."

Moving the firewall to the cloud and using that as the hub of a virtual spoke-based network consolidates the organisation's out-facing nodes to a single egress point and centralises its security configuration. There are also fewer variables to consider when diagnosing problems as there isn't a separate firewall or authentication server at each remote site.

Partnering VPN

In many cases, it won't be an either/or decision. VPN's flexibility, simplicity and affordability mean that it's easily combined with complementary tech.

"Larger businesses - and particularly those that don't want to consider contention on a daily basis - might opt for MPLS for their primary WAN infrastructure," said Prendergast. "But this could be backed up by an inexpensive VPN, which remains dormant until and unless the MPLS connection goes down. It would be up to the business to decide whether all of its services are available across both connections, but it could offer just a subset over the VPN, perhaps cutting external internet access or bandwidth-hungry applications."

It's a policy that works both ways. Beaming's ProtectNet Plus offering, aimed at the security sector, connects remote sites using a secure VPN backed up by a 4G connection. Monitoring devices, such as cameras and alarms, feed a central monitoring point across the VPN, which is configured to restrict access to only authorised users. Should an outside agent bring it down, service continues via the failover connection which, because it's physically distinct, offers a second level of defence.

Making the right choice

VPN, MPLS and rival technologies such as ATM, Frame Relay and GRE are, ultimately, delivering a single end result: binding multiple remote LANs to act as a single WAN. In each case, the choice of technology deployed will be determined by its use. For insurance brokers accessing databases on a provider's network, VPN would be ideal. A research institute sharing data between remote labs may opt for MPLS, reasoning that the additional cost would be offset by the faster iterations and shorter time to market that the guaranteed speed and security could deliver.

As Prendergast advises, it's a matter of evaluating your use and picking a technology to fit. "Do you want secure internet access? Do you need to expose your services to the internet, in which case you'll have to consider authentication?

Maybe that poses a security risk, and you need to offer remote access without an internet front end. There are many possibilities, all of which VPNs can address, but it's not the only choice, and won't always be the right choice, either."

Certainly, VPN remains the most flexible option, giving organisations of all sizes the freedom to scale as required, and even move the infrastructure from site to site simply by boxing their pre-configured routers and shifting them to the new location.

However, as Harris explained, minimising the number of third-party providers involved is good practice, where both security and complexity are concerned.

"We could provide a VPN service as an add-on to an existing connectivity package," he said, "[but] we wouldn't recommend it. It's still better to be dealing with a single provider who's handling the encryption and the VPN-based stuff because then it's going across [a single] network. That way we're aware of everything, including any attempted breaches, and it's fully encrypted as it traverses our secure network."

IPVanish has had a major redesign, but we suspect it will still appeal to its key target audience: technical users. Where some VPNs launch in a minimal, applet-style window, this one is a big, multi-tabbed affair full of bandwidth graphs and real-time info updates. Even the Quick Connect mode is more in-depth than usual, letting you select not just a country, but an individual server in a specific city. It's not difficult to use, but the emphasis is clearly on control rather than simplicity.

This makes it an ideal choice for advanced users who like to tinker. Want to change the VPN protocol or toggle different types of leak protection on and off? Go ahead. You can also choose to obfuscate OpenVPN traffic (to foil services that try to use deep packet inspection to detect VPN usage), automatically switch IP addresses periodically, or use IPVanish's own DNS servers for additional leak prevention. It's safe to say that, when it comes to privacy, IPVanish always goes the extra mile.

Despite its rich feature list, IPVanish is easy to get around. The Quick Connect mode gets you protected in a few clicks, while the server list lets you browse a mass of useful information, with proper search tools and options to sort the servers by country, response time or load. The map view that used to dominate the Windows app is no longer front and centre, but it's still there if you prefer to pick locations in a visual way. And while we're not quite sure what purpose the real-time bandwidth graph really serves, it looks pretty cool.

IPVanish boasts over 1,000 servers across 60 countries, and while the vast majority of these are in North America or Europe, there are also outposts in Brazil and South Africa, plus a decent selection in Asia -- particularly in Hong Kong and Singapore. Whatever your requirements, you shouldn't have any problems finding a suitable server, and it rarely takes more than a few seconds to make the initial connection.

Connection speeds are somewhat mixed. We found that short-distance connections, to servers in the UK and the Netherlands, retained between 83% and 86% of our regular connection speed, which is fine if not exceptional. Where IPVanish shines is in UK to US VPN connections: here we saw download speeds of over 22Mbits/sec -- a clear step ahead of NordVPN's 20.3Mbits/sec and Avast Secureline's 19.1Mbits/sec.

That makes IPVanish brilliant for US-based video streaming services -- aside from the unfortunate fact that the service is currently blocked by Netflix's ever-evolving anti-VPN measures. You should also be aware that speeds in Asia are far less impressive: when we tried routing our traffic via Hong Kong and Singapore, our download speeds remained stuck below 4Mbits/sec across multiple tests.

IPVanish states that it doesn't monitor, record or store any information on your traffic or your use of its services, and it also has a tolerant attitude to torrenting. However, the company is based in the US, so any information it does collect could be shared with various intelligence agencies -- including those of the UK. If that concerns you, a service based in another country might be a better option.

Price-wise, IPVanish sits roughly in the middle of the VPN market. It's not hugely expensive, with a $10 monthly plan and a discount $78 annual subscription, but some rivals are $10 to $20 a year cheaper.

So where does that leave us? Certainly, it doesn't knock NordVPN from its perch as our pick of the VPN services: it's almost as fast as IPVanish, just as reliable, and it's currently doing a better job of unblocking US streaming services.

Nevertheless, IPVanish is a polished, well-designed VPN with an impressive and highly configurable set of privacy features. Other services may be cheaper or faster, and some customers may be put off by the idea of US jurisdiction, not to mention the lack of Netflix. If you're looking for control, however, you'll struggle to find another VPN that comes close.

Verdict

IPVanish is a polished, well-designed VPN with an impressive and highly configurable set of privacy features. If you’re looking for control, however, you’ll struggle to find another VPN that comes close.

Virtual Private Networks (VPNs) let you use the internet anonymously, concealing your identity as if you're connecting via an alternative service or from somewhere different to where you really are.

It all sounds a bit sneaky, like something out of a high-tech espionage novel or a hacking tool to evade detection from the government or activists, but using a VPN is useful for anyone worried about their browsing security. It's particularly useful for at-risk groups such as human-rights campaigners or anyone using a public Wi-Fi for working remotely. It also plays a rather important role in the business world and can be used to build a layer of security.

Simply, when using a VPN, it means your location is concealed, leaving you to act as if you are not attached to your current location, which is a great option for testing out services that are usually only available if you're in a certain place.

Some VPN services can be quite expensive, particularly if it's not something you need to use all the time, but there are enough free VPN services that provide a decent level of quality without the financial burden.

Keep reading for our guide to the best free VPN's.

Browsec

Browsec is a browser plugin that is supported for Chrome, Firefox, Opera and on iOS and Android if you want to stay anonymous on any device you may own. It features a clear and easy to use UI and you won't need to input any of your details to use it.

It's fast, totally free and there aren't even any annoying ads to deal with. An upgrade option exists if you want to speed up your connection, but this isn't needed for most tasks you may want to undertake without giving your identity or location away.

Cyberghost

Like most VPN tools, Cyberghost is available for free, but also has premium, paid-for tiers available too, for those that want to boost their connection. The free version shouldn't be sniffed at though, because it offers full, unlimited VPN access and although isn't completely reliable for intensive applications like streaming video, it's good enough for general browsing.

It's available as a desktop client, which uses OpenVPN to connect to the internet and with servers dotted around the world, you can choose pretty freely from which country you would like to connect via.

Freelan

Freelan is one of the more complicated free VPN services in our roundup, because it's open source and requires some command line work to get connected. It installs software on network drivers on your computer to re-reroute web traffic, but that all has to be done via the command line rather than a graphical interface.

However, if you're comfortable tweaking with your machine on a much deeper level rather than just using a browser plugin or desktop app, Freelan offers a whole lot more than its simpler rivals.

TunnelBear

TunnelBear's Little plan is its free offering, which offers up to 500GB of free browsing data every month. After that, you'll have to upgrade to Giant Bear for $7.99 for unlimited data if you want to subscribe to a monthly plan or $49.99 for the whole year. The free plan itself is pretty good if you don't need to use a VPN very often and with 20 servers located around the world, it's pretty likely you'll be able to find one in your specified region.

Probably the most impressive feature of TunnelBear is that you can connect up to five devices at the same time, including desktop, mobile, tablet and router. GhostBear is the service's extra-secure addition on Mac OS X, Android and Windows that claims to make your data undetectable even to governments, ISPs and businesses.

WindScribe

WindScribe also offers a free version with a download limit, although here, you can use up to 10GB of data without splashing out (provided you sign up with your email address, 2GB without registering), making it a better option for those that need to stream content. It also benefits from unlimited device connections across Windows, Mac, iOS and Android.

However, it's not as fast as some of the other freebies, so it's likely you'll want to upgrade to a faster, paid-for service. Also, WindScribe only has servers in eight locations, so you may be limited by that too.

It's the end of the line for Opera's free mobile VPN app, but there are discounts on offer for old users.

Last November, Symantec acquired VPN developer SurfEasy from browser-maker Opera. While most consumers barely blinked at this news, a small subset sensed trouble ahead and their hunch was right. Opera has now closed its excellent Opera VPN app, which provided iOS and Android users with that rarest of rare things: a free, ad-free VPN with unlimited data.

Firstly, if you paid up for Opera Gold a version of the service which sped up connections, doubled the regions available and added dedicated customer support then Opera is giving you a free year's subscription to SurfEasy Ultra. Given that's the same VPN platform on which Opera's system was based, most people likely won't notice too big a shake up and given it usually costs $12 per month, they're getting a decent amount of software for their previous $30 per year.

But what if you were just enjoying the free version? Well, there's a fair argument to say the company doesn't really owe you anything, but all the same, Opera is offering you something to apologise for the end of the service. If you have the apps installed (and you still seem to be able to download it for some reason), Opera says you'll be able to redeem an 80% discount on the SurfEasy Total VPN, which usually costs $5 per month, and has 12 fewer regions than the Ultra version.

If you're used to paying nothing for your VPN, then 99 cents per month may still feel like a slap in the face but it may still be preferable to the long, thankless search for a free VPN that can offer similar quality to what Opera managed. Personally, I think I'd value the time at more than 99 cents...

McAfee has announced the acquisition of VPN business TunnelBear, allowing it to take advantage of growing consumer demand for keeping personal data secure and identitieshiddenwhen browsing the internet.

"TunnelBear has built an engaging and profitable direct-to-consumer brand, and we're confident this acquisition will serve both our end users and partners by embedding its best-in-class, hardened network into our Safe Connect product," said Christopher Young, chief executive officer, McAfee.

"This investment is strategic for McAfee's consumer business as it further showcases our commitment to help keep our customers' online data and browsing private and more secure at a time when the threat landscape is growing in volume, speedandcomplexity."

The company revealed that 19% of consumers had said they were already using a VPN solution in a recent market survey. However, while more than half (58%) said they know how to check their Wi-Fi connection is safe when using an open Wi-Fi network, less than half of these actually do so before connecting.

This means a significant number of people are putting their security at risk whenever they connect to a network in a public place, such as a cafe or restaurant, McAfee said. Using a VPN such as TunnelBear will allow customers to hide their identity online from both malicious parties looking to steal their data and advertisers that could use their details to serve intrusive ads.

TunnelBear said it will continue to develop its VPN products, currently used by around 20 million customers to date, only now with the added input of McAfee, which will ensure security at the forefront of its customers' minds. McAfee already owns its own VPN service called Safe Connect, so it's likely this was a more strategic decision to expand its reach.

"McAfee shares our passion to help everyone browse a more secure and private internet," Ryan Dochuk, co-founder, TunnelBear said. "The acquisition provides us with the resources to develop our service, expand into new regions, and continue leadership of privacy and security practices in the VPN industry."

TunnelBear was sold to Intel eight years ago, but it was spun out to become an independent company last year. Intel still holds a 49% stake in it.

Image courtesy of TunnelBear

Samsung has released details of its new mobile VPN service, offering enhanced privacy and data-saving features to preserve data limits.

Samsung Max is an app for Samsung-branded Android devices, replacing Opera Max. The app's data-saving mode offers tips for saving data, including offering a breakdown of the apps consuming the most bandwidth and compressing images and video automatically when rendering them in apps and your browser.

Privacy mode ensures user data stays safe, even when using open Wi-Fi networks or their own mobile network. When accessing the internet, Samsung Max employs one-tap encryption, tracker blocking and a DNS masking service that Samsung said ensures your data is always secured.

"All over the world, data has become a commodity, but many plans are simply still too expensive for consumers that want to get the most out of the latest technology built into their devices," said Seounghoon Oh, vice president of Samsung's R&D Institute in India.

"With Samsung Max, our users in every corner of the globe now have increased autonomy and control over their data usage and privacy in an era of rising security threats, fraudulent apps and user profiling."

Max replaces the Opera Max VPN service previously available on Samsung devices. Opera discontinued the service last August and although it's still operational, users aren't able to download the app from Google Play. Samsung's version will come preinstalled on the budget Galaxy A and Galaxy J series and is available to download from Google Play and the Samsung App store now.

Unfortunately, the Samsung Max app won't replace Opera Max on non-Samsung devices, so if you're an avid user of the app on a non-Samsung device, you'll have to kiss it goodbye.

Picture: Samsung Galaxy A5/Credit: IT Pro

t's not a good day for internet freedom. Just over a year ago, the UN ruled that "the same rights people have offline must also be protected online," although the non-binding resolution has some notable dissenters including Russia and China. So it should come as little surprise that a year on, both nations aren't taking the resolution terribly seriously.

Blocked in Beijing

Let's start with China. Back in January, the country's Ministry of Industry and Information Technology announced that developers creating Virtual Private Networks (VPNs) must obtain a license from the government. VPNs give citizens a work around the so-called "great firewall of China" which not only censors politically sensitive websites, but also prevents access to other websites blocked in the country for fairly predictable reasons: Google, Facebook, Twitter and YouTube amongst others.

This weekend, Apple has complied with the tough regulations, banning at least three VPN apps from the Chinese App Store: ExpressVPN, VyprVPN and StarVPN.

In a statement to TechCrunch, Apple justified the move is a fairly prosaic way, treating the ban as just a case of following local laws as they would with any other country. "Earlier this year China's MIIT announced that all developers offering VPNs must obtain a license from the government. We have been required to remove some VPN apps in China that do not meet the new regulations. These apps remain available in all other markets where they do business."

That's fine, except China isn't just any other country, and many are appalled that a company of Apple's declared values would abet political censorship. Golden Frog, VyprVPN's distributor, said it would be appealing to Apple, arguing that it hoped the company "would choose human rights over profits."

It may not be that simple. Apple makes much of its hardware in China, and it's becoming a big sales market too. China doesn't tend to mess around when Western companies put their foot down on censorship issues, as Google did back in 2010 the search engine has been banned in the country since 2012.

Russia following suit?

Meanwhile, 3,598 miles away from Beijing in Moscow, similar ominous mood music is playing. President Vladimir Putin has just signed a law banning VPNs and proxies in Russia from 1 November. This, along with another law that requires chat apps to attach phone numbers from 2018, is ostensibly justified as a means to block access to extremist content, but critics view the crackdown as yet more political censorship. Especially given we're just seven months away from the next Russian presidential election.

The move will mean Russia joins the likes of Syria and Iran in blocking the use of VPNs. All in all, it's not a good time for the freedom of the internet no matter what non-binding UN resolutions may tell you.

The past three years have dramatically changed the way we do business and, despite initial misgivings, many companies are now firmly set on the path to flexible working. This can be a great boost to productivity, but for it to work properly, companies need to provide effective remote support software regardless of whether their staff is in the office, on the road, or working from home.

The good news is the answer has been around for a while: remote access software is a mature technology that's helped IT teams for decades. Why waste time on unproductive and frustrating phone calls or expensive site visits when support technicians can put themselves in front of a user's computer without leaving the comfort of their desk – or even their own home?

The biggest decision facing SMBs is choosing the right product, as there's a wide variety of solutions available. For this article, we recommend looking at four affordable remote support products that we have reviewed: IDrive, LogMeIn, NetSupport, and Wisemo. We have tested these on-premises, cloud-hosted, and hybrid solutions to help you decide which one will make your support department's life a lot easier.

Remote access software

Remote support products require an agent loaded on client systems to allow technicians to access them, and there are two distinct methods of achieving this. For instant access in times of trouble, technicians can use on-demand or attended, access where the user is present at their desk.

From their web portal or personal console, the technician sends a request to the user with the message containing a unique session PIN and a download link for a temporary agent. A session only starts once both sides have agreed to join and, on completion, the agent software is automatically removed without trace from the remote system.

There will be times when technicians need to access unattended systems and for this, a different agent is used which is installed permanently. Running in the background, an unattended agent stays connected to the remote support service, allowing technicians to access the system as and when required.

Cloud vs. on-prem

Cloud-hosted remote support is ideal for small businesses with a mix of office-based and remote workers. They're simple to deploy and their subscription-based licensing makes it easy to control costs. 

Technicians are provided with a personal web portal account to access the service, allowing them to open support sessions from anywhere on the internet. Users require minimal training, as in most cases they just need to follow the instructions in the email sent to them by the technician.

On-premises support solutions are great for businesses that don't want to rely on a third-party provider and need greater control over security and access. Most require an on-site central management server, but don't let this put you off: their hardware requirements are minimal and the on-premises product we tested took only ten minutes to install.

Originally developed to support systems on the same local network, most on-premises solutions now include a gateway component that extends secure access to remote workers. If you want the best of both worlds, consider a hybrid solution that teams up an on-premises console and a cloud portal allowing you to support local systems on the LAN and use the internet to access remote ones. 

Remote access security

Security must be a top priority when choosing a remote access software solution as it can be extremely dangerous in the wrong hands. If it isn't configured correctly, it can punch a hole clean through your perimeter defenses and allow intruders to access systems as though they were sitting in front of them. 

First, standardize on a single remote support product and ensure all your staff know which one you're using. If a scammer can find your email address, they can easily send a bogus support request from another product in an attempt to gain control.

A common attack vector is the use of trial versions of support software. Fortunately, most vendors have wised up to this and either block on-demand access in trial versions or warn users that the invitation may not be a bona fide request.

Choose products that can enforce multiple authentication methods for support sessions, including unique access codes, password protection, and support for services such as Active Directory. On the technician side, activate two-factor authentication (2FA) to further protect access to their portal and make sure the product employs AES 256-bit encryption for all communications between technicians and users to prevent eavesdropping.

Free remote access tools such as Chrome Remote Desktop and the Windows Quick Assist apps should be avoided in a business environment as they're impossible to manage and audit. For the same reasons, you shouldn't allow Remote Desktop Protocol (RDP) in the workplace.

Remote access software tools

Check what support tools are included as these will improve the support experience. Naturally, all products provide remote control but other valuable features are file transfer, screen sharing, note taking, remote registry editors, and audio, video, and chat services.

Workstation inventory speeds up troubleshooting as technicians can see what is installed on the user's computer before starting a support session. Session recording can create a video audit trail of support sessions, which can also be used for training purposes.

Most products focus on Windows endpoints, but if you have a mix of desktop devices, check what other platforms they support; most offer agents for macOS and Linux. Mobile support is an essential requirement, too, and you should expect to see technician and client apps for Android devices. You can't remotely control iOS devices due to the operating system's strict security model but, along with technician apps, some products offer facilities to broadcast screen contents and stream live video and audio to a technician.

In today's hybrid working environments, a properly configured remote support solution can pay dividends in terms of increased efficiency and productivity. All of the products we have reviewed offer a wealth of support services and tight security, so read on to see which one will best suit your business working model.

The Opera browser now includes a free VPN that you can use without logging in.

The Norwegian browser maker remains a niche piece of software in most markets, but often leads rivals with new features.

Now it is offering a free virtual private network built into the browser - the first major browser to do so, though Firefox and Chrome both have extensions that do a similar job.

Opera announced the plans in spring, but the tool is only now making its way from the developer build to the full version of the browser.

Opera said it was offering the feature built-in rather than via an extension or add-on in order to encourage more people to make use of the tool.

"We strongly believe that if more people knew how the internet truly works, they would use a VPN and we hope that by making our browser VPN free and easy to use, it will become an essential tool for everyone," wrote Krystian Kolondra, Opera Software's senior vice president of products, in a blog post.

Kolondra noted that VPNs are mostly used by "people who have a good understanding of how the internet works". The company's own survey showed only half of people asked knew what a VPN was, but 80% of respondents in the USA and Germany were concerned about online privacy.

But lack of knowledge isn't the only reason web users don't use a VPN. "More than 70% of people who knew what a VPN was but still didn't use one, when asked why, said it was because they found VPN services difficult to use and were not willing to pay for the subscription," Kolondra added.

To use the free VPN in Opera, head to Settings, choose Privacy and Settings, and then flip the button next to "Free VPN". "An icon labelled 'VPN' will appear in the browser, from which you can toggle VPN on and off, and choose a location," Kolondra explained.

You can either choose a specific location, or let Opera choose the best automatically based on network speed, latency and server capacity, the company said. You can also choose to turn VPN on all the time or only when using "private" windows. There is a limit to which countries you can choose as your virtual location, however: the USA, Canada, Germany, Singapore and the Netherlands.

The VPN tool is run by Opera's SurfEasy, and as you don't have to login to use it, neither company can store any information about your browsing history.