Do I need SSL for a site that can only be accessed on the local network?
All users log in with windows credentials using Windows Auth with PHP on IIS.
And if I don't: What security is needed to make sure there are no issues.
And if I do: Why?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Short Answer: If you can use it, use it !
It is a good practice to have SSL even on Local sites. There is no such thing as 'ONLY' local network. I'm assuming you use the word 'only' to indicate that only people inside your network can access it. This is a result of the fact that people don't consider insider threats.
But lets say you just have static pages, containing pages of information. In that case SSL is not worth it.
But when you are dealing with web apps, with sensitive information, it is imperative to use SSL, even inside your own network.
EDIT: Definitely USE it. (based on your edit). Same reason as above. Inside attackers can sniff the traffic and possibly spoof another user.
If your internal network is separated from the outside and all people who can physically access the cables are trustworthy (and you trust them), then you can get away with not doing SSL.
If you have WiFi, then the above condition is not true. If one of the trustworthy people occasionally plugs a device of his own, then the above condition is not true. If you have PLC, then the above condition is not true. If the office is cleaned at night by a cleaning lady (or cleaning gentleman), then the above condition is not true. If a postman or delivery person occasionally enters the premises without being monitored at all times, then the above condition is not true.
Therefore, you need SSL.