How secure is IIS8 + AD Certificate Mapping?

Question

Microsoft

Given: AD, PKI, IIS8 based on Win Server 2012r2, webdav, 1c
Task: host three sites based on IIS - http purely for publishing crl, https with webdav to provide access to the office file share, and https from 1c to connect via web customer. On https sites access through client certificates via AD Certificate Mapping, for http anonymous read access. Allocating a server with IIS in the DMZ is out of the question.
Question: is it permissible to publish this goodness outside, without wrapping it in a VPN? What reefs in ensuring safety of IIS can be?

Answer 1

"IIS security" is a joke topic for me :) Would you like to try it as a "big red button"? Yes, even share a file storage through it? Oh well. The folly of the brave is the wisdom of life...