I am working a project which requires access to a service running on a remote server, over a single TCP port (>1024). This service runs on a machine located within an existing network, and the project I'm working on is located on a new (web) server, external to this network.
It was agreed up front that for this project to work the port must be opened up to the new server, however the IT team have now decided the security risk is too great to 'open up' their internal network.
They justified this to me by saying if the new server is compromised it could allow an attacker into the internal network. But would this not be mitigated by only allowing access on a single port, to a single machine in the network? This would be done through a firewall/NAT system outside of either server's control.
I understand that the internal service then becomes the attack vector but I would argue that it's designed to be public facing anyway, so at this point their justification falls down.
I am not a security expert by any means, so what could the problems be here that I am missing? (and they are not explaining)