Balancing risk with virtual private networking during a pandemic

When the pandemic struck and teaching went online worldwide, universities had to make pressing decisions that balanced cybersecurity against other factors, including health and safety, usability, and cost. One such challenge Indiana University (IU) faced was how to accommodate the secure telecommunications needs of 130,000 faculty, staff, and students who would now be teaching, learning, doing research, and working from home. Some universities reflexively promoted virtual private network (VPN) use for all activities. Such an approach would have been unsustainable at IU, however, owing both to the licenses and resources needed for the sheer number of users and to the high-throughput applications on which they rely. Perhaps even worse, it would have increased the chances that the VPN would be unavailable during a critical incident or other situation in which secure communications must be guaranteed. Instead, IU launched an awareness campaign demonstrating exactly when VPN use is and isn’t needed. In addition, network staff employed a VPN feature called split tunneling to reduce the load. This article discusses the advantages and disadvantages of this approach and how IU made the decision to balance both sides of the risk equation to ensure the continued advancement of its mission throughout the pandemic.