My company has a domain name that we use to serve our customers, say
company.com for the main website,
app.company.com for the web application and
api.company.com. These are all public domains that our customers connect to use our services.
Besides this we also have another set of tools that are used only internally by our employees (customer management software, ticket management, bi, etc). I've clustered everything inside a single subdomain
internal.company.com. This means that we have domains like
Even though we don't publicize these domains, since they all have a TLS certificate it's quite easy to find them only. As a matter of fact, search through the logs I can find lots of exploit crawlers trying to access
/wp-admin and so on. We always try to keep everything up-to-date, but leaving things out in the open (specially the BI tools, since they can download lots of data) scares me.
I'm thinking about buying a new domain just for these internal tools, something that is unrelated to the name of the company. I think this would at least make it harder for a targeted attack, since the attacker would have to know this domain name (thus having someone inside the organization providing this information to him).
I could force everyone to use a VPN to connect to a local network and then provide the service there, but I'm trying to avoid the hassle of having to help every non-technical employee how to use a VPN.
Am I being too paranoid? Does having a separate domain actually helps mitigate some of the threats or it would actually make any significant difference?
PS: The internal tools range from open source projects installed on our servers to services completely developed inside the company.