Return to Answer

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is already accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if the site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access the network - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record everything you do on that site. Since you're saying it's a big company, their intranet might be "rather public" and hence they should consider deploying HTTPS.

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is already accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if the site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access it - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record your interactions with that site. Since you're saying it's a big company, not everyone accessing it might be completely trusted and hence they should consider deploying HTTPS.

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access the network - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record everything you do on that site. Since you're saying it's a big company, they should consider deploying HTTPS.

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is already accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if the site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access the network - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record everything you do on that site. Since you're saying it's a big company, their intranet might be "rather public" and hence they should consider deploying HTTPS.

The main motivation for HTTPS is to prevent man-in-the-middle attacks. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access the network - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record everything you do on that site. Since you're saying it's a big company, they should consider deploying HTTPS.

The main motivation for HTTPS is to prevent an attacker from reading and manipulating your communication with a website. So the decision to deploy it on internal sites depends on whether there is a risk of someone tampering with your traffic inside the company network.

If the internal HR site just serves static content that is accessible to anyone in the company's intranet, then one could argue that HTTPS doesn't add any security because intercepting traffic to that page within the internal network would be pointless.

However, if site uses a login system and employees aren't trusted to not interfere with the internal network or guests are allowed to access the network - then the site should always be accessed over a secure connection.

it's a site we log into (using a password we're forced to keep to max 8 lower-case characters only), where we can view wage slips, personal address / contact details etc.

That is concerning. Not only is the artificial password length limit really low and the lowercase-only restriction questionable. If the site uses plain HTTP, a rogue co-worker (or malware on their machine) could intercept your connection to the page, sniff your password and record everything you do on that site. Since you're saying it's a big company, they should consider deploying HTTPS.