“How can employees on a business trip or working from home securely get to the company’s ERP, finance systems and file servers?” This has been the single most frequently asked question over the past two years. Mapping intranet ports straight to the public internet is far too dangerous, and traditional VPNs often fail to connect, lag or drop out. Today we set out clearly how employees should go about remote access to the corporate intranet, what the pitfalls are, and how to choose something that is both secure and easy to use — once you have read this, you will know which direction to take.
Why you should not map your intranet straight “to the public internet”
The least troublesome approach is to map the ERP, finance and file server ports straight out on the router, so that typing the public IP from outside gets you in. This is the most dangerous approach: your business systems are effectively exposed to the public internet 24 hours a day, scanners anywhere in the world will find them within minutes, and weak passwords, vulnerabilities and ransomware follow in quick succession. The number of SMEs encrypted by ransomware each year because they “mapped a port to save trouble” is beyond counting.
Why traditional VPNs are becoming less and less workable
Many companies have used a VPN, but the experience is generally poor. A few common pain points:
- Won’t connect, or connects slowly: the handshake fails across different networks or carriers, or it connects but still lags
- Drops out at the slightest provocation: one network hiccup and it is gone, and a half-transferred file is lost
- Permissions are far too coarse: once connected you are inside the whole intranet, and managing who can reach what is very hard
- Deployment is a hassle: you have to buy hardware, configure ports and tune firewalls, and when something goes wrong there is no one to fix it
Put simply, a VPN says “let you into the intranet first, then talk about security”; the more secure thinking today is to open up only the one system you are meant to use, by account and on demand.
A more secure approach: zero trust remote access
Zero trust comes down to one sentence: trust no one by default; verify identity first, then grant access according to permissions. Applied to remote access, its biggest differences from an old-style VPN are:
| Item | Traditional VPN | Zero trust remote access |
|---|---|---|
| Access scope | Connecting gets you the whole intranet | Only the authorised server or segment is opened |
| Permission management | Coarse, hard to divide per person | Authorisation by account and by department |
| Exposure of business systems | The VPN gateway is exposed to the public internet | Intranet systems stay invisible to the public internet |
| Connection experience | Prone to drops and lag | Direct connections within China, fast and stable |
| Deployment | Buy hardware, tune firewalls | Activated in software, no hardware to buy |
For SMEs this means an employee at home or on a business trip can use a phone or laptop to securely open the ERP, finance and file servers just as if they were in the office, while those systems stay permanently “invisible” to the public internet — scanners simply cannot find them.
The least troublesome way for an SME to get this live
No need to buy your own equipment or build a server room. With SaaS such as sTrust Zero Trust, the management console is hosted in China, ICP-filed (China’s website registration requirement) and compatible with MLPS 2.0 (China’s Multi-Level Protection Scheme); access is granted by account and one employee’s access rights can be activated in 5 minutes. Give sales access to the ERP, finance access to the finance system and the project team access to the file server — each managed separately, and revoked with one click when someone leaves. If you need local hands on the ground, Beijing-based companies can also have Siwenlide deliver the networking, security and remote access as one package.
Frequently asked questions
Q: Can employees securely reach the corporate intranet from a phone too?
A: Yes. Install a client on the phone or laptop and sign in with an account, and you can reach the systems you have been authorised for; the intranet systems are not exposed to the outside.
Q: Will it lag badly? How does it compare with an old VPN?
A: The experience is the biggest improvement of this kind of solution — direct connections within China, fast and stable, without the constant dropouts of an old VPN.
Q: Can different employees be given different permissions?
A: Yes. Authorisation by account and by department lets you control precisely who can reach which system, and it is revoked with one click when someone leaves or moves role.
Q: Do we need to buy our own hardware?
A: No. It is activated in software, with no dedicated hardware appliance to buy, so even SMEs can afford it and manage it.
Want your employees to securely use the company’s intranet systems remotely?
sTrust Zero Trust: authorisation by account, an intranet that stays invisible, stable direct connections within China, activated in 5 minutes with no hardware to buy. Visit strust.siwenlide.com for a free trial; Beijing-based companies wanting local deployment can call 400-686-2011 or visit siwenlide.com.
? Related reading
