VPN and public Wi-Fi: protecting remote work

Short answer: when is a VPN enough on open Wi-Fi?

A VPN is an important encrypted transport layer for internal systems, administration interfaces and non-public applications. It is not sufficient on its own. A defensible baseline combines VPN with MFA, managed and current devices, least privilege, segmentation, sign-in logs and a clear reporting path for suspicious events.

Guide scope and technical review

This Virtline guide identifies items to examine: VPN architecture, MFA, segmentation, accounts, certificates, logs and response scenarios. It is not a test record for a customer environment. Document scope, completed tests, results and limitations during the actual review.

Assess the network and the connection

A public network may have an unknown operator or a fake access point. Correct HTTPS use with a valid certificate protects connection content against Wi-Fi eavesdropping alone. Fake portals, unencrypted services, exposed metadata and device attacks still matter. Do not bypass certificate warnings or install profiles offered by a portal.

What a VPN solves and what it doesn't solve

A VPN protects traffic routed through the tunnel between a device and the VPN gateway. The onward path to an application needs its own protection, such as HTTPS. The tunnel does not remove phishing, malware or excessive permissions. Check DNS, IPv6 and behaviour when the connection drops.

The minimum standard for working outside the office

Secure remote access requires a set of simple organisational and technical decisions. The most important thing is that employees know when to use a VPN, how to report problems and which systems can be opened from a public network.

• Enable MFA for email, Microsoft 365, VPN, and administrator accounts.
• Determine which applications require a VPN connection and which run through secure cloud services.
• Update laptops, systems, browsers and security software before allowing remote work.
• Restrict administrative access and block old login protocols.
• Monitor unusual logins, locations, devices and after-hours access attempts.
• Prepare instructions for employees: what to do in a hotel, cafe, train and during an internet failure.

How to connect VPN to Microsoft 365 and home office

Define which routes use the VPN and how traffic outside it is protected. Split tunnelling can reduce load but needs risk assessment, device protection and alternative monitoring. For public Wi-Fi, check company policy, DNS, IPv6 and failure behaviour; MFA does not replace transport encryption.

Common mistakes in a corporate VPN

The greatest risks arise when a VPN acts as a permanent gateway to the entire network. Too broad permissions, lack of segmentation, shared accounts, lack of MFA and an outdated VPN client mean that a single compromised device can open the way to many systems.

• Access to the entire network instead of just the required applications and segments.
• No separation of user and administrative accounts.
• No overview of active users, unused accounts and old certificates.
• No monitoring of failed logins, new locations and unusual working hours.
• No testing of emergency scenarios when VPN or Internet connection is unavailable.

How Virtline helps secure remote access

Virtline can perform a remote access review, sort out MFA, Microsoft 365 policies, segmentation, monitoring and user procedures. The goal is a model that protects the company but does not block everyday work.

Choosing VPN access for company resources

Start with the applications and user groups. Define the resources each group needs, its sign-in requirements and who approves access. The services below connect VPN design with device and account protection.

How to protect data in transit

Secure data transmission requires a combination of technical security and organisational policies. Connection encryption is important, but a company also needs to know which systems are remotely accessible, who can use them, how a user is identified and what happens if a laptop or phone is lost.

• Use approved access, such as a VPN or controlled application access, for non-public systems. Grant only the resources needed.
• Enable MFA for VPN, Microsoft 365, email, administrator accounts, and services with critical data.
• Update your system, browser, VPN client, EDR and device configuration before allowing remote work.
• Restrict access to network segments and applications rather than opening the entire infrastructure through a single tunnel.
• Monitor logins, locations, access times, authentication errors and unusual data transfers.
• Prepare instructions for users on how to work in a hotel, cafe, train and airport.

How can open Wi-Fi risks be reduced?

Open Wi-Fi can pose risks because its owner and configuration may be unknown. Check the network name, use HTTPS and approved remote access, and do not bypass certificate warnings. A VPN protects the channel to its endpoint but does not eliminate phishing, malware or every device threat.

Fake networks – a way to obtain data

The fake network may use a name similar to a hotel, airport or coffee shop and direct the user to a login page that phishes for a password. The risk increases when an employee automatically connects to remembered networks, uses the same password in multiple services, or works on a device without updates and endpoint protection.

• Confirm the network name with staff and follow company policy. A Wi-Fi password alone does not establish safety; use an approved hotspot when in doubt.
• Don't enter your company password into windows that don't belong to a known service or corporate identity provider.
• Use a work hotspot or trusted mobile data when processing sensitive data.
• Disable automatic connection to public networks and remove old Wi-Fi profiles from your devices.
• Stop if a certificate warning appears, do not install unknown profiles or certificates, and report the issue to IT.

What should a remote access review include?

An overview of VPNs and working on open Wi-Fi networks should give the company a list of technical and organisational decisions. What matters is not only whether the tunnel works, but who can use it, for which systems, from which device, with what level of authentication and how quickly IT sees abuse.

• Map of remotely accessible applications and decide which require a VPN and which should run via a secure cloud.
• List of users, groups, certificates, administrative accounts and exceptions requiring removal or confirmation.
• Recommendations for MFA, segmentation, firewall rules, VPN client updates and network access restrictions.
• Response scenarios for a lost laptop, suspicious login, fake Wi-Fi, VPN failure and password compromise.
• A plan covering remote-work policy, user guidance, monitoring and service availability tests.

Related services

These services combine VPN implementation, MFA, Microsoft 365, home office, IT monitoring and user training into a remote-access model that can be tested.