We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a password that we would send with every request to protect unauthorized access to the webservice.
The webservice is able to make modification to the data in our databases so if an attacker could access it, he would be able to alter our important data. So, I thought it was important to protect it properly but when I talked to the network admin, he dismissed my concerns as paranoia and said that the webservice will be on http without any authentication. His argument is that the webservice is on our private network and behind a firewall so we don’t need any other protection.
I’m not sure what to think… Should I worry that we will have a webservice over http without any authentication?
Would using a password without TLS be enough since it's on a private network? The "issue" really seemed to be around wasting time to setup TLS for "nothing".