Hosting setup for a small application with security-sensitive data

Question

Not sure this is the right place to ask this but I'll give a shot.

I've been asked to implement a system about criminality data. The data is security sensitive, in that it contains information about crimes done by certain people in a violent context and delicate country.

Actually, the application will only have 4-5 users. Maybe a handful more later. Nevertheless they are distributed and thus there should be access over a network.

They currently run a Windows server. I am highly experienced in linux environments, my Windows server is quite dated.

What could be a good setup for such an application? If I installed it at their own premises, which seems to be their preferred approach, how would I go about providing access to the users? Is a VPN a good approach? Any relevant info about how to do this with Windows? Can I do it without having to host the app on the Internet? Other suggestions?

Not sure if a standard web application hosted on a server somewhere on the Internet could be sufficient.

I apologize if the question is too vague. I am happy to try to provide more information if I can. I am an experienced developer but not so much a system engineer.

Answer 1

By your own admission you're not a system administrator nor security administrator. So if the data is as sensitive as you describe, hire someone who is experienced in the role. At the very least in a consultative/advisory role even if they don't do the actual work.

Based on TomTom's comment, I thought I should add a note about the possible legal implications of a failed implementation that make doing it yourself not worth the risk to yourself and/or the company asking you to do it.