We have a tire III data center to let users to access resources through private network MPLS. we applied security solution in each layer. But I am not quite sure to use internal SSL for applications or devices that can be accessed via http(web) within the private network perimeter(not to access via internet out side the network). if not How can I ensure communication between two hosts is secured or encrypted? how can I protect internal intruder(hacker) apart from applying polices in our private network?

  • So you have webservices W which are reachable from the internet and use SSL/TLS. Besides that, you have internal services I which are not reachable from the internet and do not use SSL/TLS to communicate with either W or other internal services. Your question is, if those internal services are at risk of being manipulated/"hacked"? Is that correct? – GxTruth Aug 9 at 10:47
  • sure . for those web services which are reachable from the internet we used SSL. but my question is as you said do I need ssl for those which can be accessed internally via web?. – Mesfin Aug 9 at 11:36
  • As a general rule -- yes. Internal services should be protected as well to mitigate a possible MITM within internal network. – Crypt32 Aug 9 at 14:06
  • Google thought they didn't need to encrypt the traffic on the dedicated leased lines between their datacenters. They got proved massively wrong by a major actor. – a CVn Aug 9 at 15:00
  • Should you encrypt your LAN? Probably. Do you need to use SSL? No, you could use IPSec – Neil McGuigan Aug 9 at 17:05

Generally yes, you want to encrypt/secure the connection of your internal machines. They are not reachable from the internet, but insider threats are real.

Assume one machine of yours has been taken over. An vulnerable webservice, for example. This machine is no longer trustworthy, but can still see and access your internal machines. Here is your insider threat without somebody physically breaking into your data centre or plugging their laptop in your server.

Which kind of security should be applied depends on your use case and what exactly you are trying to protect. To prevent MitM, TLS/SSL is generally a good point to start.

  • thank you guys for your possible answers and suggestions, – Mesfin Aug 14 at 12:33

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.