Allowing external people access to your Internal data (longish post)

Over the past 12 months, this question
has raised its head a few times, and I would love to get some opinions
from the community on what they see in the IT world or what they think
is a good practice.

Scenario:

More and more frequently, information
is being dealt with outside of email.  A good working (browser based)
example of this is Quicr or Sharepoint, where people are collaborating
and sharing data using default templates.  Pretty soon, this will
be escalated as Activity servers get deployed.  As this is occuring
more and more frequently, a byproduct of this is the desire to allow external
people to your organisation access to this data.  The question follows…
what way is the best way to accomplish this?

You have 2 specific problems.  The
first problem how does mr external get access to the data you want him
to get access to.  The second problem is how do you verify if the
person is who they say it is.  A sideline problem of this is how do
you do this without tying yourself up with massive management overheads.

First problem – allowing mr external
access to your data

There are a few possible solutions to
this….

Solution 1 – Allow them inside.

Grant the external person access to
your network via VPN, Keyfob or whatever method you use.  This has
license implications and management implications.  However, the data
is still on your LAN always.

Solution 2 – Place some of the data
outside the network

It would be possible to replicate some
of the sites that ou want people to collaborate on to a DMZ, and grant
access that way.  This has a lesser management implication, and if
the data is on your DMZ, it is still with you.  Mr external can then
access it through a browser as needed.

Solution 3 – Place all your data offsite
in a data centre.

This is the "way out" soloution
(at the moment).  Place all your data in a location that is available
to all users, be them internal or external, and use your security levels
to allow/restrict access.  This is quite Web 2.0ish, but data protection
could have a lot to say about that.  Do you trust the data centre?
 Do you trust your security that much?  

Second problem – trusting that Mr
external is Mr external

Going with solution 1 above means that
each external person has an external account created in your internal domain,
which is secure and you can manage the account.  Assuming  you
add a vpn account or keyfob/cert this is secure by today’s standards.

But lets say you don’t do that.

If you want to maintain external users
effectively, you need to maintain them in an external directory.  This
is where their details are kept, including authentication information.
 In addition, this is what your external data would be used for authorisation
off.  Lets assume LDAP.  The directory contains account information,
including their password.  Microsoft and IBM use something along those
lines, with their passport sites (IBM’s has come a long way), and external
people enter their name and password on a SSL based site.  But the
question remains, is a user name and password enough?.  Typical answer
is "it depends on the data" so lets assume that the data could
hold sensitive information.  The IBM one already does for Business
Partners.  Is giving a person a user name and password enough to keep
corporate sites happy?  Do you also issue SSL certificates to the
browser?  Do you also require PIN number authorisation on top of name/password?

I would like to know what other sites
are considering good enough these days, especially ones that fall into
the above categories.