Defense in depth. Put it on something like ZeroTier, but still secure it with hard key 2FA as if it's on the open Internet. The key is always to make an attack

Defense in depth. Put it on something like ZeroTier, but still secure it with hard key 2FA as if it's on the open Internet. The key is always to make an attacker jump over more than one hurdle to get to anything. It's preferable if those hurdles are as isolated from one another as possible: different systems, different vendors, administrated by different people (multiple social engineering points), etc. BTW I personally dislike this trend of trusting a single third party 2FA provider for access control to every system. It's incredibly convenient but it gives me the wim-wams. I'm waiting for a story like "Okta announces compromise, tens of thousands of sites may be at risk..." Never trust just one thing no matter what that one thing is.