Virtual Private Network (VPN) Definition
How your employees can work remotely — and even use public Wi-Fi — safely
A VPN (virtual private network) is like a tunnel — it establishes a way to transmit data securely over the Internet between your laptop and your nonprofit’s server. In this article, we walk you through why it’s needed and what your options are in setting up a VPN.
If you pay any attention at all to tech security, you probably know by now that you should be very careful about using public Wi-Fi networks, particularly if you’re handling personal information or other important data. And if your nonprofit’s employees work remotely, you’ll want to be absolutely sure your organization’s data doesn’t fall into the wrong hands.
What’s the answer? You could ban your remote workers from using public, unsecured Wi-Fi at cafés, but that isn’t a very practical solution. Maybe it’s time to consider a VPN.
What’s a VPN, Anyway?
VPN stands for virtual private network — it’s a buzzword-y name, but it’s essentially a way of securely transmitting data between your computer and another server over the Internet. A VPN server allows far-flung employees to effectively become a part of your nonprofit’s secure in-office network over the public Internet. Think of it as a secure “tunnel” through which your data travels. The data that travels though this tunnel is encrypted, which goes a long way toward keeping would-be data thieves from eavesdropping on your remote workers.
How you connect to a VPN server depends on the system you use, but you usually connect using a special piece of software called a “VPN client.” Once you connect, you can generally use the Internet as you normally would.
If you’re at your nonprofit’s office and on its network, you probably don’t need to worry about going through a VPN server, but if you’re away from the office, it can be a boon if you want to securely connect to your organization’s internal file servers or back-end systems.
VPNs should not be confused with proxy servers. Both VPN servers and proxy servers can help safeguard your privacy, but they are different beasts. A proxy server acts as an intermediary to obfuscate your identity, allowing you to browse the Web relatively anonymously. A VPN server can do that too — or make it seem as though you’re browsing the Web from a different country — but a VPN server also secures your communications as they travel from point A to point B.
Put another way: You use a proxy for anonymity; you use a VPN for data security.
Using a VPN Provider Versus Running Your Own
There are pros and cons to both options: running your own VPN server or going with an outside provider. Operating your own VPN server for your workers gives you a little more control over your electronic destiny, so to speak, since you can control the exact hardware and software configuration you use. A number of options for business-grade VPN systems exist, such as those offered by Cisco and OpenVPN. In addition, VPN services are available out-of-the-box if you already have Windows Server or OS X Server running in your office environment. (Editor’s note: business-grade VPN systems are available at a discounted rate through TechSoup’s Cisco donation program, and Windows Server is available through TechSoup’s Microsoft donation program.)
That said, setting up your own VPN server means that you may have to purchase additional hardware and software to make it all work. You’ll also need someone on staff who can manage and maintain the VPN server. If your nonprofit doesn’t have a large IT budget, or if you’re a small outfit to begin with, that might not be an option.
Going with a third-party VPN provider might be worth considering, particularly if you’re a small organization, since you wouldn’t have to invest in and maintain a VPN system. They’re usually fairly inexpensive — or free — but using one requires you to make some tradeoffs.
Many VPN providers — such as Hola, AnchorFree, and StrongVPN — are geared toward home users, so while they’ll protect you from prying eyes on public Wi-Fi, they may not cater to the needs of your nonprofit.
In addition, third-party VPN providers generally don’t offer the same level of security as what you would get if you ran your own. According to PCMag, using a third-party VPN provider means that your data is only protected between you and your VPN provider’s servers. Your data won’t be encrypted once it leaves the VPN provider’s servers unless the server or website you’re ultimately connecting to uses an encrypted connection (look for “https” at the beginning of the website address to tell if it’s encrypted). This is useful if you want to keep casual eavesdroppers from snooping in while you’re on Wi-Fi, but if you want end-to-end encryption, you’ll need to set up your own VPN system.
Long story short: If you’re dealing with highly sensitive personal information, you should probably consider investing in your own VPN system. If, on the other hand, you’re concerned mainly with snoops on the Wi-Fi network at a local Starbucks eavesdropping on your remote employees as they check email, post a blog entry to your site, or update your organization’s social media pages, you’re probably fine with a third-party VPN provider.
A Few More Things to Consider
When you look for a VPN, you should consider your nonprofit’s needs first. But there are a few other things to look out for, namely:
Supported platforms: You’ll want to make sure that your VPN technology supports the operating systems and platforms your nonprofit uses, so take a close look at the system requirements before you commit to a VPN.
Mobile support: Mobile devices are increasingly important for nonprofits, so as my colleagues at PCWorld note, you should check and see if your VPN provider works well with smartphones and tablets in addition to Macs and PCs. You’ll want to pay close attention to the requirements for mobile devices as set forth by your VPN provider, and make sure that your provider will be able to meet the needs of your mobile users. Some VPN providers, such as Hola, offer mobile apps for iOS and Android; those apps can make it quick and painless to sign in to your VPN provider. Mac OS X, Windows, Android, and iOS all support various popular kinds of VPNs, so you may not need to install a separate app. If in doubt, check with your VPN provider to see the requirements for each platform.
Multi-user support: Since many third-party VPN providers are geared toward consumers, you’ll want to make sure they’ll be able to support your entire organization, so check and see whether they allow for multiple users or have any restrictions on how you can use them.
Compliance with data privacy laws: If your organization must comply with government-mandated data privacy regulations — such as the privacy provisions in the Health Insurance Portability and Accountability Act (HIPAA) — you may want to check and see if your organization would still conform to those regulations if it used a third-party VPN provider.
Location: Where in the world a VPN server is located can impact which services you can access while connected to that server, as PCWorld pointed out. For example, if your nonprofit relies on an online service that is only available in the US, you may not be able to access it if you connect to it via a UK-based VPN server.