I am trying to figure out the best and most secure way to do this, if it is possible to do it safe and secure.
Small company. We have a hosted web server from a third party that serves our client web app with bare minimum of data in the database on the server. Want to start offering more features through the portal which would require developing the app to access our more comprehensive data on our internal database. Company doesn't want to put the data on the third party server.
I am thinking one way to do this would be to open the 3rd party server on the database port and only permit traffic from the office IP to that port. On the internal server, open the port for the database only to traffic from the 3rd party server IP.
1) Would this be considered a reasonably safe configuration?
I am neither a network nor security guy, so just gathering information on best practices and getting input on the setup.
I know there can is IP spoofing where an attacker can make their IP look like anyone else's. They'd have to know what IP is exempted beforehand. However, an authentication key between the servers can be setup so even if the IP was spoofed, both ends of the connection would need the key.
2) Would this just be an SSH key?
To be perfectly frank, no on at the company is a real understanding regarding security. The don't want our sensitive data on a 3rd party server because they think it is just floating around for anyone in the aether to grab. Basically like googling 'Microsoft', or something, someone can just be like 'my_company data' and get our data. The other reason is practical. The data needs to be immediately available as we are constantly working with it. Having to upload and download from a remote server would be slow and get annoying really quick.
Also, I should add this does involve sensitive information that should not be made public. What it is if a client wants to calculate the 65th percentile for a given item, that request gets sent from the client web app running on the 3rd part server to the internal database where the raw data is to calculate the percentile. The result is sent back to the client web app and presented there. They shouldn't have access to the data directly because it is confidential.
That being said, I was reading about REST API's a little. Some of what I was reading was saying that REST API's may not be the best when sensitive information, or authentication, is required and that SOAP should be used.