How should remote apps talk to a SQL server?

Hi /r/sysadmin,

I recently inherited a 500 user company in a managerial role. We have some in-house created applications (mostly Microsoft SQL back-end, and VB & .NET+ or MS Access front-end). They tend to work fairly well, but I'm a bit puzzled from the infrastructure end.

Currently, the apps are programmed to talk directly to SQL (sql.company.com) on port 1433. In past (larger) companies I've worked at, opening 1433 to the outside world was generally a no-no according to our DBAs and devs. I go into our SQL logs and I can see people trying to hammer the sa account. This whole setup seems pretty... wrong. This is something I haven't really ever had to deal with before.

My question, how *should* this sort of thing be setup? Opening 1433 just seems so wrong (plus, I believe auth is clear text).

The apps work pretty well for the most part, but this whole setup makes me uncomfortable. Thoughts as to how this should normally be setup?