I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to authenticate Windows domain users using basic and NTLM auth over insecure HTTP connections.
He recently talked to a department head about the problem, explained the primary threat model (MITM credential stealing via any compromised device, even printers), and got push-back: "If someone we don't trust is in our network, we have a much bigger problem."
Also, the department head thinks very highly of his employees and would bristle at the suggestion that employees themselves ought to be part of the threat model.
What approach would you suggest taking when discussing the issue with this executive?
(Using a throwaway account to avoid any inferred connection to the above company.)