First of all, my question is related to Web Application security.
Often when I want to suggest customers to move to the cloud for certain applications, I am being told that our customers are reluctant to do so due to security considerations even though it would not be necessary to store data in cloud. By that I mean, data is stored only in their back end systems. These back end systems are hosted on their own servers within their network. The back end systems offer web services which can be SSL encrypted. The back end systems will not be exposed directly to the Internet, the traffic will be routed over additional network components like reverse proxies, firewalls and such. Additionally the data is routed over a third party cloud platform on which the web application is hosted. The cloud platform is provided by the same company (SAP.com) which provides the software for the back end systems. And that scenario is expected to be not secure.
However for these customers we have a remote access to their productive back end systems via customer's VPN (e.g. IPSec VPNs, Citrix).
After reading https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf I came to the conclusion that both VPN "encrypted" data and TLS encrypted data can be decrypted if the encryption is weak and attackers have sufficient budget to break the encryption. My understanding is that these 2 scenarios (VPN via data over several network components TLS-encrypted) basically offer the same security standards if properly done - What is the difference in security between a VPN- and a SSL-connection? helped me in that context. Is my understanding correct or do I miss some aspects?