Internal HTTPS recommended security practices

Question

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client.

Essentially, my program functions as a basic HTTPS listener service. It listens for messages from an existing system, acknowledges receipt and then it does some stuff. This would all happen over a LAN. However, I don't know their network topology and who/what has access to this network. To be safe, let's assume nefarious devices could access the LAN.

The existing system can send messages both externally and internally and it also requires basic access authentication. Per the documentation:

Transmission Security will use SSL (TLS) protocols for any service communicating externally... SSL TLS 1.2 or higher is required

Required Authentication to your service should be supplied using Basic Authentication... In the configuration of the service, a user can supply a single Username and Password. These credentials will be transmitted as a Basic Auth Header.

Since everything is internal, the documentation seems to indicate I do not need to use TLS. Would there be any security risk to not using TLS for intranetwork HTTPS? Would that open the door to man in the middle or a spoofing attack?

Further, what security "hygiene" would you recommend for this kind of setup? I.e. How often should the basic auth credentials be changed? Should the public/private keys be changed with any frequency?

Finally, I'm planning on using Python to develop this program. Are there any recommendations for reputably secure Python HTTPS packages for building out a simple server like this? Would a different language provide better, more secure choices?

Thank you!

Answer 1

Since everything is internal, the documentation seems to indicate I do not need to use SSL. Would there be any security risk to not using SSL for intranetwork HTTPS?

I would highly recommend to never assume anything and expect everything. I would suggest to contact the security officer or someone in charge for security. Security policies are often different between companies.

As far as is there is any security risk to not use TLS (Note: SSL is depricated), is the management of certificates in internal networks. In my experience, small to big networks have issues managing their certificates properly.

One concern is the availability, when a certificate expires a front-end machine can no longer communicate to a back-end machine for example.

Would that open the door to man in the middle or a spoofing attack?

By not using TLS internally it could be possible to perform a man in the middle attack and thus sniff specific traffic that is sent from your application to another. However, the company you work for could have accepted this risk and decided not to implement TLS on the internal network.

Further, what security "hygiene" would you recommend for this kind of setup? I.e. How often should the basic auth credentials be changed?

Personally, I would try to use TLS internally when sensitive (client) information is transmitted from one system to another.

Also, using basic authentication is something I (personally) would try to avoid because:

1. When using HTTP, the credentials can easily be sniffed. HTTPS would prevent this.
2. In each request sent to the web server, the credentials are sent. There is no session, thus no timeout etc.
3. There is no 'real' logout function other than closing the web browser.

Are there any recommendations for reputably secure Python HTTPS packages for building out a simple server like this?

Perhaps not regarding Python packages but I would recommend to use a reverse proxy and not directly expose your web application to the internal network.