Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources from the Web and Mobile Apps exposed to the internet. While concern is not clearly formulated there is an unease due to the fact that Azure will be responsible for securing access into our network and not our respective IT Risk and Networking teams.
Is there a good set of articles to explain the VPN and ExpressRoute security? Are there good use cases to demonstrate that even if security of the Web or Mobile application is compromised then our on premise resources are still protected by Azure VPN? We need to present network architecture that demonstrates the security of Azure VPN networks and addresses the concerns our risk, security, and governance teams might have.