6

Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run via HTTP, so I have been asked to upgrade them to HTTPS.

If the services are only available via the VPN, is adding HTTPS unnecessary or sensible? How?

I have already reviewed the following and was unable to come to a conclusion.

2 Answers 2

7

Yes, there is security in adding a layer of TLS to VPN accessible services.

The VPN will allow access to the network. It will not secure communications to the services on that network. Credentials such as usernames and passwords would be sent in cleartext on the network for anyone who happens to be watching. Not just usernames and passwords, but any data sent to the services. TLS will ensure that all data for those services is secured.

2

Fun idioms I don't know aside, attack vectors:

  • Attacker inside network being VPNed to pretends to be the HTTP service. Without the Authentication part of HTTPS the user wouldn't know better.
  • Eavesdropping on HTTP traffic is possible inside the network, though this may or may not be a concern since it's remained HTTP this long.
  • VPN leak may expose data in HTTP connection to the local network.
3
  • I removed the Briticisms once I realised how uniquely British they were :D Apr 25 at 16:03
  • Ah it's fine, sometimes I too like to wear belts on my radials or whatever it said. :D
    – foreverska
    Apr 25 at 16:07
  • "Belt and braces" = providing double security, by using two means to the same end. "over egg the pudding" = go too far in embellishing, exaggerating, or doing something. I forget how peculiar us Brits are sometimes. youtu.be/FkF_XpA5P48 Apr 25 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.