Risk of specific changes to the "Trusted" security zone

An EDI VAN is a secure outsourced network where EDI documents can be exchanged between business partners. Your company is provided with a "mailbox" or alternate means from which EDI documents are sent and received, similar to traditional paper based mail (snail mail). The “value added” part of the mailbox are often services like mail notifications, inspect, authentication, and validating the message. Messages should be tracked and recorded for auditing purposes, as well as other services available through VANs, such as backup and recovery, mapping, compliance and more.

For everything to be in order you must have high trust in the EDI VAN provider and / or be able to make sure it handles security in a sufficiently good manner. Otherwise, you may end up with something being compromised.

Setting everything as "trusted" is definitely not a good security practice. That would practically allow that software to do anything and transmit anything across your infrastructure (given the other settings).

Instead, you should ask the provider what ports or other limited settings are specifically needed to enable correct communication between the software and its destinations. Mixed content means the connection is not required to be secure, which is a big risk (you will transmit data that is not encrypted).

Therefore, you should definitely determine how trusted that provider is and warn your company in regard to security.