My company provides a service to another firm and connects via VPN several times a day. The service involves accessing an intranet web-based application and copying files from one server to another when necessary.
Currently, two users connect from their PC to the firm's Cisco firewall using the Cisco VPN client whenever they need to. The PCs are turned off out of office hours. The VPN password is stored on the PC with a dedicated tool encrypting with SHA-256.
Now, the firm says we must switch to a site-to-site VPN as they deem it simpler to control. We are concerned mainly because we fear that we become an integral part of their network and become partly responsible for its safety. We think that it's easier that a hacker gets into our firewall on saturday night and penetrates the firm's network, than that a hacker gets into our network during the day and gets to the right PC at the right time when the VPN is in use.
Assuming we have a decent firewall without known vulnerabilities (and both companies aren't high profile targets), are we overly concerned with this switch? Are there any other downsides of using site-to-site versus client-based?