Employees traveling for business, working from home, or visiting client sites often need access to company internal systems, including OA, ERP, finance, and inventory management applications. How can you enable access from outside the office while maintaining security? Many companies simply expose these systems to the public internet and provide an external login address—one of the riskiest approaches. This article explains the real risks of exposing internal business systems, why port forwarding and a public address invite security incidents, and what secure access should look like.
The Key Takeaway
Enabling external access to OA, ERP, and finance systems is not inherently a problem; the risk lies in exposing them directly to the public internet without adequate protection. With a public address and a username and password as the only barriers, anyone worldwide can attempt to log in. The right approach is to keep business systems invisible to the public internet: external users cannot discover them through scanning or connect to them, and only authenticated users can access the specific systems they are authorized to use, instead of exposing systems and hoping no one attacks.
What Happens When Systems Are Exposed to the Public Internet?
- Attackers worldwide can target your systems: Once a system is exposed, automated scanners can discover it within minutes, followed by thousands of daily credential-stuffing and brute-force attempts.
- One weak password can compromise security: A simple employee password or an unpatched vulnerability can give attackers access to your internal data.
- Patching may not keep pace with threats: Vulnerabilities regularly emerge in OA and ERP systems. Public exposure puts unpatched weaknesses directly in attackers’ reach.
- A single breach can spread across the network: In many internal networks, compromising one system opens the way to others, putting finance systems and file servers at risk.
- Incidents can be difficult to investigate: Complete records of who logged in, when, from where, and what they did are often missing, making accountability and compliance audits difficult.
Common Approaches: Which Can You Rely On?
| Approach | Issues / Assessment |
|---|---|
| Direct public exposure through port forwarding | Highest risk: systems are publicly discoverable and face daily scanning and credential attacks. Not recommended. |
| Internal network access through a traditional VPN | Better than unprotected exposure, but connecting grants broad internal network access, and VPNs themselves are frequent attack targets. |
| NAT traversal services such as Oray PeanutHull | Convenient, but still exposes systems to the public internet, with no assurance of security or stability. |
| zero trust: verify identity first, then grant access as needed | Keeps systems invisible to the public internet and allows authenticated users to access only the systems they are authorized to use. Recommended. |
The Secure Approach: Keep Systems Invisible to External Users
The core principle is simple: stop exposing systems directly to the public internet and introduce a gateway that verifies identity before granting authorized access. Key implementation steps:
- Remove direct public access: External scanners cannot discover ports or connect to systems, leaving automated attacks unable to identify a target.
- Verify identity before granting access: Employees must pass centralized authentication before accessing internal systems, ideally with an additional mobile verification or one-time code.
- Apply granular permissions by user and system: Define precisely who can access each system. Sales staff traveling for business can access CRM without gaining access to finance systems.
- Maintain full auditability: Log who accessed what, when, and from where, providing evidence for compliance reviews and incident investigations.
For small and medium-sized businesses, a SaaS-based zero trust solution offers the simplest implementation. With sTrust, for example, internal OA, ERP, and finance systems no longer need public exposure. Employees accessing them remotely first authenticate through a centralized entry point, while business systems remain invisible to public internet scans. Administrators manage granular permissions by account and system, with logs maintained throughout access. The control plane is hosted in China, has completed ICP filing, and can support MLPS 2.0 (China’s Multi-Level Protection Scheme) requirements. Software-based activation requires no hardware purchases, while direct connections within China provide stable connectivity. Beijing businesses seeking local implementation and coordinated planning for internal systems and remote access can also engage Siwenlide for an integrated service that supports their in-house IT team.
Three Actions You Can Take Today
- Review public exposure: List all internal systems accessible directly from outside the network through port forwarding, NAT traversal, or other means. These are high-risk assets.
- Remove unprotected exposure first: Prioritize removing direct public port mappings for sensitive systems such as finance and ERP, and require identity verification before access.
- Add another layer of authentication: Enable multi-factor authentication wherever available, using mobile verification or one-time codes. Passwords alone are far from sufficient.
Frequently Asked Questions
Q: Is it really that risky to expose OA through port forwarding and log in using a public address?
A: Yes. Once exposed, a system can be discovered by scanners within minutes, followed by continuous credential-stuffing attempts and vulnerability probing. One weak password or unpatched vulnerability can compromise internal data.
Q: Does using a traditional VPN make access secure?
A: It is better than direct public exposure, but traditional VPNs grant overly broad internal network access once connected, and VPNs themselves are frequent attack targets. A more robust approach is zero trust, with granular permissions by user and system and business systems kept invisible to the public internet.
Q: NAT traversal services such as Oray PeanutHull are convenient. Are they suitable for long-term use?
A: They can be used for temporary troubleshooting, but are not recommended for ongoing access to business systems. They still expose systems to the public internet, with no assurance of security or stability.
Q: Can we implement this without dedicated security staff?
A: Yes. SaaS-based zero trust solutions such as sTrust offer software-based activation without hardware purchases, and permissions can be configured in just a few clicks in the administration console. An IT Operations Services provider can also handle configuration and maintenance as an extension of your in-house IT team.
Still exposing OA, ERP, and finance systems directly to the public internet and hoping no one attacks?
sTrust zero trust remote access keeps internal systems invisible to public internet scans, verifies identity before access, applies granular permissions by user and system, and provides full auditability. It can support MLPS 2.0 (China’s Multi-Level Protection Scheme) requirements, requires no hardware purchases, and offers stable direct connections within China. Visit strust.siwenlide.com for a free trial. For local implementation in Beijing, call 400-686-2011 or visit siwenlide.com.
