Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Do I need SSL for a site that can only be accessed on the local network?

All users log in with windows credentials using Windows Auth with PHP on IIS.

And if I don't: What security is needed to make sure there are no issues.

And if I do: Why?

share|improve this question
2  
That all depends on what the site is, what needs protecting, who your users are, and what your network architecture is. Please edit and add more detail. – GdD Oct 31 '12 at 13:53
@GdD I updated the OP. – Neal Oct 31 '12 at 13:54
Do you have an insider threat? Are you confident that the assurance of your security perimeter matches the risk tolerance of your management? "Security is a very contextual topic" (from the FAQ) - "need" can only be evaluated in the context of your goals. – Mark C. Wallace Oct 31 '12 at 15:09
You also need to take into account any the data this application will house and what regulations such as HIPAA, SOX, GLBA, PCI, etc state are the requirements for said data. Of course this is all dependent upon your businesses industry. – k1DBLITZ Nov 2 '12 at 19:15

2 Answers

up vote 4 down vote

Short Answer: If you can use it, use it !

It is a good practice to have SSL even on Local sites. There is no such thing as 'ONLY' local network. I'm assuming you use the word 'only' to indicate that only people inside your network can access it. This is a result of the fact that people don't consider insider threats.

But lets say you just have static pages, containing pages of information. In that case SSL is not worth it.

But when you are dealing with web apps, with sensitive information, it is imperative to use SSL, even inside your own network.

EDIT: Definitely USE it. (based on your edit). Same reason as above. Inside attackers can sniff the traffic and possibly spoof another user.

share|improve this answer
Why definitely based on my edit? Can you explain more? – Neal Oct 31 '12 at 13:55
edited my post with the reason – asudhak Oct 31 '12 at 13:56
up vote 1 down vote

If your internal network is separated from the outside and all people who can physically access the cables are trustworthy (and you trust them), then you can get away with not doing SSL.

If you have WiFi, then the above condition is not true. If one of the trustworthy people occasionally plugs a device of his own, then the above condition is not true. If you have PLC, then the above condition is not true. If the office is cleaned at night by a cleaning lady (or cleaning gentleman), then the above condition is not true. If a postman or delivery person occasionally enters the premises without being monitored at all times, then the above condition is not true.

Therefore, you need SSL.

share|improve this answer
I'd add to the first conditional: "...and all people who can physically access the cables have the same level of access to the application as its administrator...". – Iszi Oct 31 '12 at 14:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.