Security at the End of the Tunnel: The Anatomy of VPN Mental Models Among Experts and Non-Experts in a Corporate Context

V.F. Binkhorst, T. Fiebig, Katharina Krombholz, Wolter Pieters, K. Labunets

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

168 Downloads (Pure)

Abstract

With the worldwide COVID-19 pandemic in 2020 and 2021 necessitating working from home, corporate Virtual Private Networks (VPNs) have become an important item securing the continued operation of companies around the globe. However, due to their different use case, corporate VPNs and how users interact with them differ from public VPNs, which are now commonly used by end-users. In this paper, we present a first explorative study of eleven experts' and seven non-experts' mental models in the context of corporate VPNs. We find a partial alignment of these models in the high-level technical understanding while diverging in important parameters of how, when, and why VPNs are being used. While, in general, experts have a deeper technical understanding of VPN technology, we also observe that even they sometimes hold false beliefs on security aspects of VPNs. In summary, we show that the mental models of corporate VPNs differ from those for related security technology, e.g., HTTPS. Our findings allow us to draft recommendations for practitioners to encourage a secure use of VPN technology (through training interventions, better communication, and system design changes in terms of device management). Furthermore, we identify avenues for future research, e.g., into experts' knowledge and balancing privacy and security between system operators and users.
Original languageEnglish
Title of host publicationUSENIX Security Symposium 2022
PublisherUSENIX Association
Pages3433-3450
Edition31
Publication statusPublished - 2022
Event31th Usenix security symposium - Boston, United States
Duration: 10 Aug 202212 Aug 2022
Conference number: 31
https://www.usenix.org/conference/usenixsecurity22

Conference

Conference31th Usenix security symposium
Country/TerritoryUnited States
CityBoston
Period10/08/2212/08/22
Internet address

Fingerprint

Dive into the research topics of 'Security at the End of the Tunnel: The Anatomy of VPN Mental Models Among Experts and Non-Experts in a Corporate Context'. Together they form a unique fingerprint.

Cite this