6

We have a web server exposed to the internet, it uses SSL/https. Requests to this server are redirected through a firewall to a back end web server which only uses http. That server has access to the file storage server (the DMZ'd one with SSL doesn't) and it receives the requests, finds the document, copies the document to a cache folder in the DMZ, and the SSL'd server serves the copy.

What are the risks of not using https on the internal server as well, if any?

Improve this question
3
  • To clarify, is there a reason you aren't using SSL/TLS between the public facing and internal web server?
    – pm1391
    Jan 30, 2018 at 23:11
  • None other than 'that's just how it was configured'. I'm looking to see if that should be changed. Sounds like it should be.
    – ChrisYYC
    Jan 31, 2018 at 23:42
  • Is the entire LAN, complete with all the networked systems and all the software running on all those systems as secure as a single server's openssl process holding keys in memory?
    – forest
    Feb 1, 2018 at 3:40

2 Answers 2

Reset to default
5

By not using TLS you are giving up the integrity and confidentiality. Your connection can be monitored or altered and there is nothing there to guarentee the endpoint is who they say they are.

  • An internal attacker can man-in-the-middle your http connection reading and altering data.
  • An employee could be targeted via phishing and a DNS rebind attack could be used against them to access this resource to get documents. As they are already within your network the request would circumvent your firewall. This however requires the attacker to have knowledge of your network.

Unfortunately we live in a time where you must assume you are breached so plan your security controls around this.

Improve this answer
2
  • 1
    I'm even wondering what authentication mechanism does the public facing server present to the backend? Regardless, It's in the clear
    – pm1391
    Jan 31, 2018 at 1:09
  • So essentially if one has the opportunity to have multiple layers of defence, use them so that a breach from the outside is a partial breach rather than full access to everything once inside.
    – ChrisYYC
    Jan 31, 2018 at 23:41
1

HTTPS is used to protect the connection against sniffing, manipulation and against impersonating an endpoint. How much this protection is needed in your local network depends on how much you can trust your network. As always, there is no absolute security but one has to find a balance between the achievable security and the remaining risk considering the amount of resources (money, time, people) needed to increase the security.

For example if you have a local network where a not fully trusted person (or a compromised machine) could use ARP or DHCP spoofing to redirect the traffic, then use of HTTPS on the internal network could be used to protect the traffic anyway. But maybe a better investment would be to increase general security of the network in such cases. If instead all machines on the network are properly authenticated and IPSec is already used to protect communication on a lower layer than adding HTTPS on top of this is less needed. But it still can be used as a defense in depth measure, especially if the lower layer protection (IPSec) is managed by different departments or governed by different security requirements than the higher level protection (HTTPS).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .