Many security measures are intended to protect against hostile users who want to abuse the software or get access to content they don't have permission to access. Things like CSRF protection, SQLi protection, TLS and many other security features mainly protect against malicious users. But what if all the users can be trusted?
Suppose you have a fully internal web application that will only ever run on the intranet of the company and will never be accessible from the outside. assume that all the internal users can be trusted, there are no outside users and the data inside the application is of not much use to attackers. This means the threat model is very limited and there is not much sensitive data.
Considering these details, it seems like some of the measures, like TLS and XSS protection, wouldn't be as important. After all, there is very little risk of attackers intercepting traffic, and the users can be trusted to not enter XSS payloads. In this case, would it still make sense to implement security measures against traffic interception or malicious users?