Introduction

If you’ve been following our recent discussions, we’ve explored a variety of critical topics, from Zero Trust models to the importance of modernizing legacy systems. Today, we’re focusing on another pivotal area: secure access to internal web applications.

In this article, we’ll dive into how organizations can safely access internal web applications without the need for a VPN. We’ll cover the limitations of traditional VPNs, discuss how Thinfinity’s Web Application Gateway offers a streamlined alternative, and explore the role of key technologies like outbound-only connections and Zero Trust principles. By the end, you’ll understand why Thinfinity is a game-changer for simplifying remote access without compromising security.

In many traditional setups, accessing internal web applications from outside the organization required setting up a VPN (Virtual Private Network) or using an ADC (Application Delivery Controller). These tools created secure, encrypted tunnels between the user’s device and the organization’s network, enabling access to sensitive internal applications. However, VPNs often come with challenges such as slow connection speeds, complex setups, and increased attack surfaces if misconfigured. This is where Thinfinity’s Web Application Gateway (WAG) comes in, providing a modern, simplified solution for securely publishing web applications without the need for a VPN or ADC.

Why Are VPNs and ADCs Typically Used for Remote Access?

1. Security for Remote Employees: Internal web applications, such as HR systems, CRMs, and ERP platforms, contain sensitive information that needs to be securely transmitted between the user and the internal network. VPNs create encrypted tunnels that protect this data when accessed from outside the organization. However, maintaining VPNs can be resource-intensive and introduces latency.
2. Access to Legacy or On-Premise Applications: Many businesses use legacy or on-premise web applications that aren’t directly exposed to the public internet. These applications, ranging from custom business tools to accounting software, are typically accessible only within the internal network, necessitating the use of a VPN or ADC to grant remote users access.
3. Multi-Site Connectivity: When businesses have multiple office locations, a site-to-site VPN is often used to link these offices into a unified network. This makes internal resources, including web applications, accessible across all locations. Similarly, ADCs help manage traffic between these locations, improving performance and load balancing across the network.

Thinfinity’s Web Application Gateway: Zero trust Access to Web Applications

Thinfinity Workspace's Web Application Gateway offers a simpler, more secure alternative to VPNs and ADCs for publishing internal web applications. Here’s how it addresses the typical needs of secure access:

1. Publishing Web Applications Securely: Thinfinity allows IT administrators to easily publish internal web applications, such as intranet sites, CRMs, or ERP systems, through the Web Application Gateway. This eliminates the need for users to establish a VPN connection, while ensuring the application is securely accessible over SSL/TLS encryption. The WAG ensures that only authenticated users can access the published applications, providing a higher level of security than traditional VPN’s.
2. No Need for Inbound Ports: Traditional VPN setups often require opening inbound ports on the network firewall, which can expose the organization to external threats. Thinfinity’s WAG, on the other hand, uses outbound connections to securely forward internal applications to remote users, minimizing the network’s exposure and enhancing security.
3. Cross-Platform Accessibility: Thinfinity's WAG allows users to access internal web applications from any device or platform via an HTML5 browser. Whether on a desktop, tablet, or smartphone, users can securely access applications without needing to install additional software like a VPN client.
4. Role-Based Access and Zero Trust: Just as with VPNs, Thinfinity supports role-based access controls. Administrators can define which users or groups have access to specific applications, ensuring that only authorized personnel can view sensitive data. This aligns with the principles of a Zero Trust security model, where every access request is authenticated and authorized individually.
5. Improved Performance: Unlike VPNs, which can introduce latency due to encryption overhead and routing through the VPN server, Thinfinity’s WAG optimizes the delivery of web applications directly through the browser. This reduces the performance issues often associated with VPNs, providing a faster and more seamless experience for end-users.

The Role of Thinfinity’s Secondary Broker in Secure WAG Connections

One of Thinfinity’s standout features is its Secondary Broker, which plays a pivotal role in securely connecting remote users to internal resources without the need for inbound ports. The Secondary Broker generates a secure connection between the Web Application Gateway and the target network by initiating outbound connections. Here’s how it works:

• Outbound-Only Connections: The Secondary Broker establishes connections to the Thinfinity Gateway from within the target network. These reverse connections are initiated as outbound traffic, which is typically allowed by firewalls, removing the need to open risky inbound ports.
• Seamless Application Access: Once the connection is established, users can access web applications securely through Thinfinity’s WAG, just as they would in a traditional VPN environment, but without the complexity and security risks of inbound connections.
• Increased Security and Scalability: By decentralizing traffic management, the Secondary Broker supports large-scale deployments and improves performance without compromising security. This feature makes it ideal for distributed environments where different departments or locations require secure access to the same applications.