My company wants to move an internal web app to the cloud. The app only accepts SSL/TLS connections and requires all users to authenticate using our Single Sign-On provider.
Today when a user wants to access this internal app remotely, they connect to our corporate VPN. So the current plan is to configure a site-to-site VPN connection between our office and the cloud provider.
My personal impression is that whitelisting our office's IP with our cloud provider would basically provide the same level of security. Everybody tells me that I am wrong but fails to give me a convincing argument.
My thinking is the following:
- Site-to-site VPN does not authenticate individual users or machines, it only guaranties that the traffic only flows between two networks (our office and our cloud provider). If the source of the traffic is restricted by its IP and the destination is authenticated by its valid SSL certificate, isn't it the same?
- The encryption provided by the VPN is redundant since we already use TLS.
- If anything, the VPN option is less secure since it could let in incoming connection from the cloud provider which we do not need nor want.
The main argument that I've heard is rebutting point #1 on the basis that IP whitelisting is not secure because of IP spoofing. My understanding is that IP spoofing is basically only used in DoS attack and that an attacker would not be able to complete a TLS handshake while faking it's IP (see this question for details).
Am I missing something here?