We are installing a vendor-supplied ASP.net application on IIS 7.5, giving access to sensitive customer details for remote access by our staff. I am wondering whether it is necessary to use a VPN to secure it. Using a VPN would be considerably more inconvenient for the staff and provide more access for connected clients to the rest of the network than I would like.
With no VPN, the application would be secured by HTTPS using TLS. The only part of the software that should be accessible to the web at large would be the login page. The application can be set to either use a completely built-in authentication method or Active Directory authentication via NTLM (probably preferably).
I am slightly concerned about the application's security-soundness. The developer has not had any 3rd-party penetration testing done and it appears from my investigation that passwords for the built-in authentication are stored with reversible encryption rather than hashed.
How much additional security do you think using a VPN would offer over relying on HTTPS and the application's authentication? Are the any questions I could ask the developer or ways I could test the application to check for vulnerabilities?
VPN Security Versus Plain Old TLS - Similar question that was useful, but not focused on assessing a supplied application