What are the benefits to HTTPS between two servers I control?

Question

The current setup we have is two servers that are held internally in my building. One of these is only accessible internally, the other is public facing. The internal server communicates with the external one (to move files between them), and no other server.

Our network security team have recommended we use HTTPS for this communication, rather than HTTP - "for security reasons". I am of course not going to question their choice, but it has left me wondering what the actual benefits of this situation are.

My current understanding is that HTTPS prevents man-in-the-middle attacks, and ensures you are communicating with the server you think you are.

In this case, we own both servers and they are connected directly (physically, the entire network between them is in our control). Also, if somebody did gain access to either server, they would be able to access the files we move between them directly - whether we were using HTTP or HTTPS. So it feels like using HTTPS is not adding any additional security here (which I'm sure means I am missing something important)

In this situation, what benefits does using HTTPS provide us?

Answer 1

It's actually hard to make sure that the link between any two of your servers is indeed correct and cannot be rerouted or spied upon. For instance:

• Common switches strives, as an optimization, to send packets only on the wires needed to reach the destination machine; however, in some circumstances (in particular if spammed with too many packets from random source MAC addresses) they tend to revet to "hub" mode, in which each incoming packet is broadcast on all wires. In order to maintain the idea that "your network is secure", you must be sure that nothing in your network is compromised.

• Machine-to-machine communications are usually initiated by names: server A talks to server B by first looking up B's IP address through the local DNS. A variety of DNS spoofing methods can be used to make A believe B's IP address to be another value, even an IP address in some other place of the world.

• While machines are (normally) in closed rooms, wire may run along exposed pathways (e.g. in suspended ceilings, going through less secure rooms) and cleartext data travelling on these wires may be spied upon.

It is possible to have a really secure internal network, but it requires a lot more effort than is usually thought. Enforcing systematic HTTPS between "internal" servers is easier; it is also useful for damage containment (when Bob from accounting inserts into his computer the nice USB drive he found in the parking, thereby surrendering control of his computer to an external hostile entity, generalized internal encryption may help with slowing down the attacker on his way to total compromise of your whole network).

Note that other technologies may also help; e.g. you could make a VPN tunnel (IPsec) between server A and B, and then use plain HTTP within that tunnel. The security model is slightly different (HTTPS security is between applications while a VPN tunnel is between operating systems) but it can work. In practice, HTTPS may be easier to configure.