Cassandra security - private IPs with some VPN solution or public IPs and open ports?
If you care about your data, do not EVER put a database server on a public network. There is no preventing attacks on public ports. Databases are secured from most direct attacks by placing them behind firewalls, and using web servers and application servers (also protected by firewalls and load balancers) to reverse proxy user requests for information. No one should ever connect directly to a database or its server directly over the Internet. A database server or cluster, directly exposed on a public network, is begging to be hacked and its contents stolen.


https://www.vpnmentor.com/blog/how-to-secure-website-database/
https://www.esecurityplanet.com/network-security/6-database-security-best-practices.html
https://www.slideshare.net/DataStax/securing-cassandra-for-compliance