Edit: To clarify, this question is all about whether we should insist on implementing TLS for internal communications over public cloud tenants as a man-in-the-middle risk reduction control, given the complexity and sophistication required to apply MiTM techniques on an SDN-based network as opposed to on-premises networks, and given the threat model excludes state-sponsored, organized crime, advanced adversaries. The implementation does not come for free as it has an operational cost, noticeable performance footprint, and other factors.


The question is about assessing the actual feasibility of exploiting Man-in-the-middle attacks over a public could customer's internal network, while assessing the benefits and caveats of implementing TLS over internal communications as a risk reduction control.

It is well known that implementing TLS everywhere is considered to be a security best practice. However, when it boils down to the ROI, the TLS overhead (even the slightest) versus the actual guarantees provided for an SDN (Software-defined network) based internal network, it raises doubts.


You are a security consultant for a B2C company whose infrastructure is hosted on one of the public cloud providers. You provide TLS from the external clients but offload it right after it reaches the load balancer at the entrance of your K8s cluster or VMs. The question on the table is whether to implement TLS past the load balancer, so it would be end-to-end encryption. The threat model does not include state-sponsored adversaries or advanced crime groups.

Implementing TLS for the components beyond the load balancer for the sake of best practices does not hold ground, the performance hit is around %2-3 and so it increases the operational costs (expanded machine resources, certificate management, etc).

The Question

And with that background the question is as follows:

Given the network stack is based on the SDN of the cloud provider which requires significant effort to be able to eavesdrop in the first place and to execute part of the MiTM techniques (e.g., ARP spoofing) over the SDN controller, is it really necessary to implement TLS for a threat model that does not include the top tier threat actors? are the benefits out weights the costs?

  • I think this is a duplicate. If you feel different or if you feel that the previous question did not address all your concerns please make more clear how your question differs and which of your points are not addressed yet by the other question - then ask for reopen. Apr 10 at 8:03
  • @SteffenUllrich I think the linked question is irrelevant as I ask about practical security considerations for implementing TLS for internal communication due to the common industry threat scenarios (and not state-level, malicious cloud vendor), while the linked question asks around implementation variants of TLS for such cases. I'll edit the question to shed more light on the topic. Sorry for the misunderstanding. Apr 10 at 9:53

1 Answer 1


Even internal systems should have secure protocols for communications. I have conducted penetration tests where the perimeter was decent, but when I breached the perimeter I had all the credentials I needed by sniffing traffic. I could send mail as them, login to databases, access other web portals, etc. Security should be done by layers to prevent a total compromise of assets.

  • It is well known that encryption in-transit for internal communication and defense in depth are security best practices. However, this is not a "black or white" situation and I mentioned the concerns/doubts in the question. From your experience, did you manage to sniff traffic over SDN networks with ease? Are the statistics worth the implementation & maintenance costs, or is it still more theoretical than practical for the threat actors I mentioned? Apr 13 at 6:30
  • implementation and maintenance costs are minimal... why so concerned about them?
    – pcalkins
    Apr 13 at 22:25
  • @pcalkins I'm not referring to the costs of establishing and maintaining PKI for this purpose, but the computational costs (approx. 1.5% CPU per benchmark) where the number of servers is enormous, this additional CPU cost is significant. Apr 15 at 16:01
  • Security and cost or convenience have always been an inverse relationship. The ease in which the credentials are exposed can vary, but in my experience usually all it takes is a single command on the system to start dumping passwords for all services. There have been many examples of companies having a hard exterior and a weak interior. Security and cost do not go together, however security should always be top concern.
    – e-Euler
    Apr 26 at 20:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .