VPN and intrusion prevention (IPS) are two jobs that a company's firewall does. A VPN, or virtual private network, is an encrypted connection between a laptop outside the office and the office network. Intrusion prevention, done by an intrusion prevention system (IPS), compares traffic with patterns of known attacks and blocks any traffic that matches. Both are usually part of the next-generation firewall.
The VPN first. The laptop runs a VPN app. The app connects to the firewall over the internet. Everything it sends is encrypted, which means it is scrambled so that only the firewall can read it. This encrypted connection is often called a tunnel. Once the tunnel is open, the laptop can reach the office systems as if it were inside the office.
Now intrusion prevention. Many attacks use a known flaw in software. A publicly listed flaw is called a CVE. When a flaw becomes known, the security company writes a signature for it. A signature is a pattern that appears only in attempts to use that flaw. The IPS reads the passing traffic and compares it with thousands of signatures. The firewall maker sends new signatures at least once a week, and often more frequently. An older product, the intrusion detection system (IDS), only raised an alert. An IPS also blocks the traffic.
Consider a sales executive at a tile manufacturer, working from home in Indore. At 9:05 a.m., she opens the VPN app and types her password. She then approves a prompt on her phone, through multi-factor authentication (MFA). The firewall at the head office in Morbi checks both. It opens the tunnel and gives her laptop an office address, 10.20.5.34. She opens the order system as if she were at her desk. At 9:40 a.m., someone on the internet sends the firewall a request that matches the signature of a recently published flaw in web server software. The IPS drops the request before it reaches any server, and logs it.
The VPN has one weakness. Once connected, the laptop can usually reach almost the whole office network, not only the order system. If an attacker steals the executive's password and her phone approval, the attacker gets the same reach. VPN devices that face the internet are also a frequent target of attacks themselves. For these reasons, many companies now use zero trust network access (ZTNA) instead. ZTNA connects each user to one application only.