So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client.
Essentially, my program functions as a basic HTTPS listener service. It listens for messages from an existing system, acknowledges receipt and then it does some stuff. This would all happen over a LAN. However, I don't know their network topology and who/what has access to this network. To be safe, let's assume nefarious devices could access the LAN.
The existing system can send messages both externally and internally and it also requires basic access authentication. Per the documentation:
Transmission Security will use SSL (TLS) protocols for any service communicating externally... SSL TLS 1.2 or higher is required
Required Authentication to your service should be supplied using Basic Authentication... In the configuration of the service, a user can supply a single Username and Password. These credentials will be transmitted as a Basic Auth Header.
Since everything is internal, the documentation seems to indicate I do not need to use TLS. Would there be any security risk to not using TLS for intranetwork HTTPS? Would that open the door to man in the middle or a spoofing attack?
Further, what security "hygiene" would you recommend for this kind of setup? I.e. How often should the basic auth credentials be changed? Should the public/private keys be changed with any frequency?
Finally, I'm planning on using Python to develop this program. Are there any recommendations for reputably secure Python HTTPS packages for building out a simple server like this? Would a different language provide better, more secure choices?