Terminate the SSL connection at a reverse proxy in the DMZ whichestablishes trust in the connection using mutual SSL.

Enable WS-security for the web services made between Salesforce and the accounting system.

Whitelist the Salesforce IP range on the firewall to ensure only Salesforce- originated traffic can penetrate the network.

Utilize an Enterprise Service Bus to ensure Accounting system credentials are not stores within Salesforce.

Enable platform encryption in the Salesforce org to ensure network communication to the Accounting system is encrypted.