A tunneling protocol is a method for carrying network traffic through an encrypted channel so data can move securely across untrusted networks. In FinTech environments, these protocols help protect sensitive transactions and customer information by reducing the chance of interception or tampering in transit.
What a tunneling protocol does
A tunneling protocol encapsulates one network flow inside another so traffic can cross an intermediate network path without exposing the original content in transit. In practice, the tunnel may also authenticate endpoints, preserve routing behaviour, and carry protocols that would otherwise be blocked or inspected differently by the underlying network.
This makes tunneling useful for remote access, site-to-site connectivity, secure application delivery, and overlay networks. The security value comes from reducing exposure on untrusted segments, but the tunnel itself becomes a trust boundary that must be controlled and monitored.
Why tunneling protocols matter in security
Tunneling protocols matter because they can protect confidentiality and integrity while also changing what network defenders can see. A well-designed tunnel can reduce interception and tampering risk, but it can also hide unauthorized traffic inside a legitimate-looking channel if access and egress controls are weak.
That is why teams often treat tunneling as both a protection mechanism and a potential concealment mechanism. The same design that protects remote workers or transaction traffic can also be used to move data, commands, or sessions through restrictive perimeter controls.
Common tunneling forms and where they appear
Tunneling appears in several forms, including VPN tunnels, SSH port forwarding, GRE-based encapsulation, reverse tunnels, and application-layer tunnels over HTTPS or DNS. The protocol chosen determines what is carried, how the tunnel is established, and how much metadata remains visible to network controls.
In enterprise environments, the main practical difference is whether the tunnel is meant for sanctioned connectivity, such as employee access or branch interconnects, or for ad hoc traversal around network policy. The underlying mechanics may be similar, but the governance and detection implications are very different.
For a deeper practitioner view of secure remote-access tunneling, see the VPN Security Guide, which covers hardening, split tunnelling, and replacement options.
Detection and control considerations for tunneling traffic
Because a tunnel can make one protocol look like another, defenders need to watch for unusual destination patterns, long-lived connections, atypical ports, and unexpected encrypted channels. Visibility often depends on endpoint telemetry, DNS and proxy logs, flow analysis, and allowlisting of approved tunnel services.
External registries and standards matter here as well. The IANA registries help anchor legitimate protocol and port usage, while the IETF defines many of the internet protocols that tunneling mechanisms rely on. When a tunnel is unexpected, those baselines make it easier to spot traffic that does not fit the approved design.
Risk and Threat Considerations
Tunneling protocols create a security trade-off: they protect traffic in transit, but they can also provide an evasive channel for unauthorized access, command traffic, or data exfiltration. That makes the tunnel endpoint, authentication material, and allowed destinations high-value control points.
Failure mechanism: Attackers abuse sanctioned or unsanctioned tunnels to bypass perimeter filtering, obscure command-and-control, or move data through networks that would otherwise block the direct path.
Impact: The result can be stealthier persistence, weaker inspection coverage, and a loss of confidence that network controls are actually enforcing policy on the traffic they appear to protect.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Tunneling access depends on controlled authentication and access paths. |
| Recommendation — Enforce approved tunnel access with strong authentication and least privilege. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Tunneling changes information flow boundaries and can bypass filtering controls. |
| IA-5 — Authenticator Management | Tunnel abuse often involves stolen or poorly managed tunnel tokens and credentials. | |
| Recommendation — Apply flow controls to restrict where tunnelled traffic can reach. Rotate and tightly manage tunnel authenticators and tokens. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Tunnel traffic requires detection of unusual channels, destinations, and protocols. |
| Recommendation — Monitor for anomalous tunnel patterns and investigate unexpected encrypted flows. | ||
| MITRE ATT&CK | T1572 — Protocol Tunneling | Protocol tunneling is the core adversary technique discussed by the term. |
| Recommendation — Map suspicious tunnel behaviour to T1572 and hunt for bypass or C2 use. | ||
Practitioner Guidance
Why practitioners should care: Treat tunnels as governed connectivity, not just a transport feature. The key question is whether the tunnel is approved, who controls it, and whether its use is visible enough for security operations to detect abuse or misconfiguration.
What to watch for: Review tunnel endpoints, certificates or tokens, allowed routes, and any service that can create reverse or outbound tunnels without strong approval. If a tunnel is meant to provide access, confirm that its scope is narrow enough to avoid becoming a shadow path into the environment.
Practitioner takeaway: A secure tunnel is only as trustworthy as the policy, identity, and monitoring around it.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org