6

Building on Does using VPN improve security when connecting to a HTTP website?, I need to access servers at a client site. These are only accessible when using the site VPN. The services currently run via HTTP, so I have been asked to upgrade them to HTTPS.

If the services are only available via the VPN, is adding HTTPS unnecessary or sensible? How?

I have already reviewed the following and was unable to come to a conclusion.

Improve this question

2 Answers 2

Reset to default
7

Yes, there is security in adding a layer of TLS to VPN accessible services.

The VPN will allow access to the network. It will not secure communications to the services on that network. Credentials such as usernames and passwords would be sent in cleartext on the network for anyone who happens to be watching. Not just usernames and passwords, but any data sent to the services. TLS will ensure that all data for those services is secured.

Improve this answer
2

Fun idioms I don't know aside, attack vectors:

  • Attacker inside network being VPNed to pretends to be the HTTP service. Without the Authentication part of HTTPS the user wouldn't know better.
  • Eavesdropping on HTTP traffic is possible inside the network, though this may or may not be a concern since it's remained HTTP this long.
  • VPN leak may expose data in HTTP connection to the local network.
Improve this answer
3
  • I removed the Briticisms once I realised how uniquely British they were :D
    – James Geddes
    Commented Apr 25, 2022 at 16:03
  • Ah it's fine, sometimes I too like to wear belts on my radials or whatever it said. :D
    – foreverska
    Commented Apr 25, 2022 at 16:07
  • "Belt and braces" = providing double security, by using two means to the same end. "over egg the pudding" = go too far in embellishing, exaggerating, or doing something. I forget how peculiar us Brits are sometimes. youtu.be/FkF_XpA5P48
    – James Geddes
    Commented Apr 25, 2022 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .