I guess, in a lot of ways, i'm not sure about " and not have to worry about individually securing different internal services."
This is essentially something you need to worry about anyway, for other attack reasons.
This is essentially something you need to worry about anyway, for other attack reasons.
It's for this reason that pentesters learn quickly that the "make an arbitrary HTTP query from the target's own server" bug is usually sev:critical; for instance, in virtually any Fortune 500 network, that pivot gets you (with a little effort and 50 lines of code) to a JMX console somewhere, and from there code execution.
There's no good reason not to do both (ensuring that your internal services are authenticated reasonably and don't expose functionality or information pre-auth, AND setting up a VPN). But the VPN is the most valuable step.
As tptacek mentions, breaching perimeter security from external is "game-over" in most cases.