Also, I wouldn’t fault SSL VPN for significant connectivity issues. Yes, some applications such as VoIP or other network/data layer protocol intensive activities can be problematic. But, these applications do not represent the majority of SSL VPN use in my humble opinion. And, I believe many SSL VPN vendors offer IPSec plug-ins, for web browsers, when there’s a need to overcome such issues.

The very convenience of SSL VPN underscores one of its fundamental weaknesses. As ANY PC can be used, then even the most malware infested PC can be used, which could leak any information that passes through the PC. In contrast, an IPSec VPN tends to be limited to PC’s that are managed by an organization. Such PCs tend to be considerably less likely to be malware infested.

Consider Banking Trojans stealing money from organizations, the newer, sophisticated ones are usually discovered after someone notices fraudulent transfers, after-the-fact. At that point, someone, frequently a forensics technician, conducts a thorough examination of the endpoints, and finds the Trojans. The existing anti-virus/spyware had not. Now, tie this back to SSL VPN remote access. What corresponding indicator would let an organization know that sensitive information is leaking from the organization? In other words, how would one ’see’ problems with SSL VPN in the context of data leakage?