I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also want my clients to be able to upload new documents that will get put into the same file store.
I have created a front end DMZ for my website, a back end DMZ for my website DB, and I have my internal network where my files are stored. Each layer is separated by firewalls.
How should I securely deliver the files to the FE website?
- Should I create a web service on the FE web server that can access the internal network for the files?
- Should I create a web service on a server in the BE DMZ that can access the internal network for the files?
- Should I create a web service on the internal network that can grab and deliver the files, and enable the FE website to talk to that web service on a set port?
Any other way I should be doing it?
I am looking for the most secure method, as the client data is very sensitive to my business