We have a local virtual windows 10 server hosting some custom software. This VM is only hosting this service and nothing else. This software is made of:
- An ASP.Net core web app, public API, only returns data, never writes
- Custom UDP communication server (with its own reliable implementation), does some CRUD operations but only after authentication is certified
- FTP server configured a usual, port 21 for authentication, 20 for data transfer. Does only allow file transfer within a given folder and only to users authenticated with the correct email/password.
We want to host this service to the outside world so our customers can use our platform. When I asked the network manager to allow these connections to this specific VM, he said it is very dangerous and that there is a 100% chance that we will get hacked.
I'm wondering if he is right. In my knowledge, it is very unlikely that someone might be able to penetrate my custom software and get something useful out of it, let alone cause any harm with it.
The only weak spot I might come up with is our FTP service, which could be "hacked" and the intruder could potentially transfer malicious files to this certain folder. I could upgrade to SFTP but I'm not very familiar with this service and have no idea if it's a major improvement.
Are there any major security leaks with this setup if we port forward it? Are we, as he states, 100% going to be hacked?
Edit
The UDP Server is used for fast real-time communication. It has an internal state that is shared among all clients but that's view data only. the UDP Server itself does not execute CRUD directly, but talks to a separate layer that implements all logic which then speaks to the database layer.
This logic layer does check for authentication on the server-side, if the host is not authenticated, crucial CRUD operations are not permitted. The authentication is based on a salted hashed password which grants a session token for a limited duration (30min). This connection is not encrypted, but I have not enough knowledge of knowing why it should. This is the part where I doubt myself.
This application is not going to be used by a lot of people. I doubt it would fall into the hands of anyone who knows how to break this. But I just want to be sure.