I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on the server. The first call is a login message and and successful login returns a session ID that is used to retrieve data.
How can the infrastructure in the company be setup to allow the app to always reach the server, yet at the same time be secure?
The Web service runs in an IIS and the security team doesn't seem to like the idea to make the Web service available to users outside the company network as is. The idea right now is to introduce a TMG in the middle between the app and the Web service, but more suggestions are very welcome.
I'm looking for a solution that emphasize simplicity and ease of access from the user perspective.