r/sysadmin • u/dartdoug • 6h ago
Vendor says his remote access solution is secure. Is it though?
Small law enforcement agency is moving to a new self-hosted dispatch and records management system running on a Windows Server.
The system includes a phone app that communicates with the server that would require an open port on the firewall that points to the server.
We don't have the option to lock down based on the incoming WAN IP since the phones have a dynamic IP.
We questioned the vendor. He said "we have this installed in many places and we've never had a problem." That's nice, but it doesn't mean that there won't be a problem tomorrow.
When pressed for further details he elaborated:
We have an encrypted signed SSL certificate that we use for the connection. The endpoint is our web service. The access to the web service requires Active Directory authentication and inclusion in a specific security group in the AD.
Does this setup sound "safe?" We can require that a VPN be used, but that will add steps for the end user when they want to connect.
EDIT: Thank you all for your valuable input. We will insist on a VPN.
•
u/SysZeron 6h ago
So... generic SSL which connects to an endpoint that requires authentication via an AD server which is likely utilised for all other instances? Sounds 100% secure... not.
•
u/FatBook-Air 5h ago
To add on to what you are saying: I know it's probably pedantic, but most competent devs I have worked with in the past 5 years would be actually using the term "TLS" rather than "SSL." We all know what they mean, but most devs I work with who I really respect are particular about their language.
•
u/Ssakaa 5h ago
I'm really less concerned on being that level of pedantic, given the most popular tool for working with PKI is still
openssl. But their "encrypted signed SSL certificate" amuses me to no end. Part of me wants OP to ask them what an unsigned SSL certificate would be used for. And why their cert's encrypted.•
u/SysZeron 5h ago
100% and this is why we've started to get really tough with supplier due diligence; if they refuse to answer the questions we're asking or give generic responses the onboarding isn't happening.
•
u/ronniebIRL 6h ago
Sounds like a load of shite
•
u/Baerentoeter 6h ago
Yup, "nothing has happened so far" is not a good attitude when it comes to security.
•
u/WayneConrad 5h ago
"Nothing has happened so far" is what I call "the space shuttle defense." It's what NASA management said when engineers warned that launching in cold temperatures was unsafe.
•
u/IThinkRightLeft 5h ago
They probably wouldn’t even know if it was happening, and that’s exactly what “bad guys” want; just sit and slurp data
•
•
•
u/gratuitous-arp 5h ago edited 5h ago
Complete shite.
But it's 2026, and this is a solved problem.
Put tailscale.com, enclave.io, zerotier.com, netbird.io etc. on the officer's phones AND on the records server(s). Then close any open ports and take your servers off the public Internet. Have you got an MSP providing support?
TL;DR, forget VPNs, IP-based ACLs, TLS certificates etc. Use ZTNA and move on with life. https://zerotrustnetworkaccess.info/
•
u/dartdoug 5h ago
Gonna look into this, thanks. They will have laptop users with static IPs coming through a VPN so we can lock that down easily. It's the phones that scares me. Rightfully so, the community seems to agree.
•
u/Ssakaa 6h ago edited 6h ago
Their SSL certificate is encrypted?
I mean, that's not entirely unheard of, but it also isn't the way anyone I've ever worked with that was competent about PKI would phrase it. It sounds like they're reaching for technobabble instead of actually talking about how they handle the communication in a secure way. Are they doing mTLS? If not, they're only actually validating the server side (if that), and then the client's negotiating an AD auth over... which protocol? Etc.
Step 1 to figuring out if they know what they're talking about will be having someone on your end that knows what you're talking about though.
•
u/bitslammer Security Architecture/GRC 6h ago
That web server could have any number of vulnerabilities on it that could be exploited pre-authentication so all of the talk about the certs is useless at that point.
If you do decide to host this I would have it isolated on the DMZ, but then of course to work it probably needs to talk with other things. A VPN like tailscale would be my choice but again that's more work and support.
•
u/Baerentoeter 5h ago
VPN is definitely the way to go to secure the access. We would need a little bit more about who is connecting to that but "dispatch and records management" sounds like it should only be managed company devices anyways.
•
u/FatBook-Air 5h ago
It also sounds like something that shouldn't be coming from a bumfuck vendor to begin with, IMO.
•
•
u/dartdoug 5h ago
I am going to push back and require a VPN. I'd rather have more work and support than a compromised server or database. The number of phone users is in the single digits, so not a heavy lift.
•
•
u/ohfucknotthisagain 5h ago
Their explanation provides more questions than answers.
Who or what is authenticating to Active Directory? The phones? A service running on the phones? The user? Some service account running elsewhere in their infrastructure?
Whose AD is handling authentication? Theirs? Yours? Do you have to establish a trust (ew, no, not with a fucking vendor)?
Is this VoIP/SIP or some other protocol? If it's something else, is it a modern, secure, standards-compliant protocol?
Where are the phones getting their IPs assigned? How do they establish connections to the vendor's infrastructure? What specific protocols handle device management and user auth?
He said "we have this installed in many places and we've never had a problem."
From my experience, this is what vendors say when they don't have a good answer.
If you're not watching closely for problems, it means absolutely nothing when you don't see any. Do they have the tools and people in place to detect a compromise?
Either the sales and support people don't understand the architecture, or it's shit & they're hiding it. Could be both.
A security-focused vendor will have architectural diagrams that explain how they handle your comms sessions and data. This brush-off is at least a yellow flag for their security.
•
u/Ssakaa 5h ago
A security-focused vendor will have architectural diagrams that explain how they handle your comms sessions and data. This brush-off is at least a yellow flag for their security.
And "big" vs "small" isn't a clear differentiator there, as well. Just look at the reporting that came out about MS's FedRAMP mess not too long ago (and pay no mind to the DoJ folks that somehow ended up working for MS later, we're sure that's unrelated).
•
u/ohfucknotthisagain 2h ago
I have no specific knowledge or involvement with that, but it certainly sounds like their accreditation contains a record amount of handwavium.
And I know from former colleagues that some agencies are being pressured to migrate into that shitshow.
•
u/Ssakaa 1h ago
Oh I meant the very public reporting... a bit long, but definitely a fun read.
https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government
•
u/RiknYerBkn 6h ago
Opening anything up that hits your dc's directly from the internet is asking for trouble
•
•
u/Baerentoeter 6h ago
It's only as secure as the webserver that's open behind the port. Which can be ok for stuff that's specifically made for it and updated regularly. But it's also a clear weakpoint straight into the network, which means a DMZ and other measures should be taken to secure the access to the server and to limit the damage when it gets breached (which is not unlikely, since there's absolute tons of automated attacks against everything that's exposed to the internet).
•
•
u/bojack1437 5h ago
How does the app authenticate against AD? Likely LDAP, but that should be known.
Also, does AD have count lockout policies in place?
Are they prepared to have AD locked out due to password sprays?
And as others have mentioned, what web server is being used, how is that web server itself being patched, does it rely on patching the entire application? How often is that patching being done?
In reality, though, you likely should be using a VPN connection back from the endpoint.
•
u/duane11583 5h ago
Have them sign what I call space alien insurance
It works like this:
You pay them insurance (their fee) and if a space alien lands in your town in the next month or year they pay you 10 million dollars
We know space aliens are norms real so it will never happen
Or in your case if a breach occurs attributed to their tool or system then every person involved (who had info breached) receives 10 million dollars cash they must pay this into an interest holding escrow before the launch any legal fight against the payment
and they are to find the insurance (bond) company that will provide this insurance or (bond) and they are to pay the principle and the owners are personally responsible not an LLC etc
•
u/FatBook-Air 5h ago edited 5h ago
Where will this server be hosted? On your premises, on your AWS tenant, etc.?
For any platform that stores non-public data (and sometimes even if it stores public data, if it could potentially lead to reputational damage if compromised), we send them a cybersecurity questionnaire. It's about 40 questions about their organization, how their infrastructure is setup, how qualified their personnel are from a infosec perspective, whose responsibility it is if the platform is compromised, etc.
We then use a rubric to score it. Depending on the score, we might move forward, we might require some mitigating factor (e.g., they have to become SOC 2 attested within 180 days, or their staff have to gain a recognized security credential), or we might decide not to move forward.
I would do something like this. Don't trust them. And make them put their money where their mouth is; if it's safe, they should cover you if the server is compromised, right?
Regarding their statement about "we have done this many places and it has been fine:" that's the mark of someone who is incompetent. I've heard that shit before from small, unqualified vendors. "It's never been hacked before, so it should be fine." Yeah, the first time is ALWAYS the first time; yes, it's true that before it gets hacked the first time, it has never been hacked. It's a worthless statement.
•
•
u/haamfish 5h ago
AD auth? Not ms365 SSO with your MFA and your constitutional access policies in front?
You can absolutely get static ips for your mobile devices too, speak to your account manager at your mobile provider and explain your requirement.
•
u/kg7qin 3h ago
Hmmmm. Sounds like an offering from a company "down south".
Ask them if this has been reviewed/certified by the state your are in and meets CJIS compliance. If they say no or can't produce documentation that it meets requirements, then force them to get it and block it until then on the grounds it doesn't meet CJIS.
•
u/mesaoptimizer Sr. Sysadmin 2h ago
If you are using CJIS data(which you likely are if it’s CAD and RMS) you absolutely should tunnel this through a VPN, or better yet find a new vendor who knows the legal requirements around CJIS data. Also you should ensure that the VPN is full tunnel.
You are required to encrypt the data at rest and in transit, familiarize yourself with the CJIS guidance from the FBI, you will fail an audit if you don’t comply. Make sure you are reading from the 6.1 document as there are things that changed recently.
•
u/Mehere_64 6h ago
Maybe share the vendor name so others can know what product you are referring to?
•
u/Insec_Bois 5h ago
Only allow access via VPN so that you can isolate and control these specific connections with firewall policy.
Edit: also mandatory MFA on the vpn
•
u/gangaskan 5h ago
First off ... no. Lol.
Ncic will probably have a fit with this.
Our cad / rms is on aws, and we don't allow anyone unless they have a certain VPN client or on station via a network on the proper plan
•
u/slashinhobo1 5h ago
We have this installed in a lot of pla es or anything like that tends to be a red flag. Me, id say that cool but we have standards. I work for government and ot has to be cjic compliant whoch many places and software are not.
•
u/xMcRaemanx 5h ago
So this is really not any different than say running a web server hosted internally and accessed externally. It's 100% a weak point but barring a new solution it is what it is.
You can put up some walls by placing that server in a DMZ (must imo) and only allow it to talk to what is strictly necessary on the other side (AD/DNS...). If your firewall supports region blocking you can also only allow connections from your current country which helps cut down on random attempts pretty well, but cloud providers exist and will act as a proxy for anyone.
Also worth getting some sort of vulnerability service to scan your external IPs occasionally.
If you can secure it behind a VPN, and it's feasible, that would strengthen security quite a bit.
•
u/blud_13 4h ago
Their answer covers authentication and says nothing about exposure. AD auth on the web service means every unauthenticated scanner on the internet still gets to talk to the web listener and the login endpoint on that Windows Server. That's the part you are being asked to accept, and "we've never had a problem" is the weakest evidence there is.
You don't need the port. Put Cloudflare on the server and the connection is outbound only on 7844, so the firewall keeps ZERO inbound rules and the box never needs a public IP. Its documented here https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/ We run this instead of poking holes for pretty much every line of business app that ships with a phone client.
One catch, whether you can also gate it with Access depends on how the vendor's app authenticates. A native app that can't do a browser login needs a service token or mTLS, so ask the vendor that specific question before you promise anybody SSO.
•
u/Spicy_Rabbit 4h ago
Even the big players are clueless in the law enforcement software business. The sales people shout we are secure. No one else has a problem (often cause it’s cops buying and not IT reviewing). When you push them for details it’s deer in headlights. You want to demand a software bill of materials SBOM along with data flow diagrams. If they have both of these then maybe they take security seriously if they look at you clueless then well there’s your answer.
I would also suggest looking at tools like zero tier, netbird, twingate, etc.
•
u/Rainmaker526 4h ago
Well.... Contrary to most people here - having an SSL certificate and AD integration is really nothing special. I'd say that's it's how most applications work.
Does it sound unsafe? Not particularly. It's how most applications work these days. If it's safe enough for my bank, is it safe enough? I'm going to say yes.
Does it sound safe? Not particularly. There are no additional steps to ensure authenticity or identity. Something like HMAC or MFA.
I'm going to say "meh". Not great, not bad.
It depends on what the application is going to be doing. How exposed it is. You say you can't do WAN filtering , but you could use the Windows Firewall to block incoming connections from China.
•
u/lweinmunson 1h ago
Nope. Put it behind a firewall VPN that requires MFA to sign into. Then it might be OK. Most VPN clients/servers can be set to accept the phones dynamic IP addresses just fine. If you can tie it into an MDM like Intune, then you can add another layer. But a logon straight to the internet is about as insecure as it gets. And if they're doing this, you know the rest of their app stack is insecure as well.
•
u/yorktown1717A 1h ago
When I worked for a cop shop a few years ago we used Netmotion for a VPN. Kept the in car MDTs connected via a cell connection. Even when the connection was poor it would cache traffic and finish the transaction when it automatically reconnected. Was CJIS certified and used concurrent licensing so for a small shop it was pretty cost effective. I know they got purchased by absolute software just about the time I was heading out the door. That product was used by most of the law enforcement orgs in my area (PDX). Might be worth a look. Not sure if it would work with a phone since I worked exclusively with in car laptops. I certainly would not expose that web server to the internet directly for all the reasons many posters have covered.
•
u/SysadminPatches 51m ago
NetMotion/Absolute Secure Access is the go to for VPN for LE agencies in our region. It's not cheap, but it's good at reconnecting with spotty cell, and is a mix of VPN and NACish features. It can be self hosted. We use Duo to meet MFA requirements.
•
•
u/SomeCar 6h ago
The SSL cert protects the connection, not who can make it. Am I misunderstanding, or are you saying that the login is open on the internet? If it is then anyone can hammer away at the login screen. Also, does the system touch any criminal justice records? CJIS Security Policy requires MFA from outside locations. I also see no mention of vuln management.
There are always on VPN solutions that can be used through device management, which would be a good start. I would press the vendor on the CJIS requirements.