Q:

Public access to IIS Web server inside company network, for one specific service

I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on the server. The first call is a login message and and successful login returns a session ID that is used to retrieve data.
How can the infrastructure in the company be setup to allow the app to always reach the server, yet at the same time be secure?
The Web service runs in an IIS and the security team doesn't seem to like the idea to make the Web service available to users outside the company network as is. The idea right now is to introduce a TMG in the middle between the app and the Web service, but more suggestions are very welcome.
I'm looking for a solution that emphasize simplicity and ease of access from the user perspective.

A:

I would personally use a VPN and make the service accessible from the local network (VPN connections would appear to be local).
When using a VPN connection everything is encrypted and you require credentials to use the VPN. These credentials could change on a weekly, monthly basis, etc, etc.
Very short answer but it is very black and white.

A:

My vote is TMG. 
This will allow the service to be exposed while still allowing inspection of the traffic before it reaches the internal server. 
Much like the VPN, it can be configured to require a client side certificate and/or a password for authentication as well as supporting a variety of encryption methods. This will prevent random scanners and script kiddies from poking at the service. 
Utilizing TMG also has the benefit of 3rd parties not being "on" your network like they would with a VPN connection.

