Sales Chat - Click Here

Knowledge Base

Search by either entering keywords/KB_ID or by selecting a category.

KB ID: 5926

RMS Remote Settings Security FAQ

Last Updated: 10/31/2024


This FAQ has been published to help users understand the RMS Remote Settings feature’s security implications. If you are looking for how to set up and use this new feature, please refer to the following KB article:
https://buffaloamericas.com/knowledge-base/how-to-use-remote-settings-to-manage-your-terastation-remotely

 

Disclaimer: Any time you allow external access to any device on any network, the potential risks for misuse and exploitation will exist. No company can guarantee 100% security, and anyone claiming otherwise is not prioritizing your data's safety.

 

Buffalo Americas has implemented multiple measures to ensure that our new Remote Settings feature within the RMS suite is as secure as possible by modern security standards:

• All web sessions use HTTPS
• All communications use SSL encryption
• All communications utilize certificates provisioned through the RMS system to authenticate
• All communications utilize certificate exchange validation instead of one-sided authentication
• All communications between the remotely connecting PC and NAS are secured using AES-256 encryption
• Every remote session attempt requires a one-time use session authorization token facilitated by an active session login to the RMS system that will expire after a set period of time and/or inactivity
• Communication is possible only in 2 ways and always initiated through the RMS system[1]
      - Direct using STUN[2] & UDP hole punching[3]
      - Indirect using TURN[4] through Buffalo Relay servers[5]

• This feature does NOT provide direct access to the device’s administration settings page (Settings). Although visually identical, all settings and displayed information are relayed through a locally installed application[6] to ensure a secure session. This novel method avoids the risks associated with static and persistent open access that internet-exposed configurations such as port forwarding entail!
 

[1] The use of any deep packet inspection or redirect security features that may exist on some networks will not allow these features to function, it is recommended to whitelist this unit from those features where possible

[2] Common feature found in all networks using NAT: https://en.wikipedia.org/wiki/STUN

[3] Common feature found in all networks using NAT: https://en.wikipedia.org/wiki/UDP_hole_punching

[4] Common feature found in all networks using NAT: https://en.wikipedia.org/wiki/Traversal_Using_Relays_around_NAT

[5] Secured Relay servers operated by Buffalo Japan, check Geo-blocking if unable to enroll device in RMS services

[6] “Remote Settings Connections App” can be downloaded and installed from the RMS portal and other official locations

X