I have a web server which supports only the company's Intranet, not the external Internet. There will be about 100 different users who will connect to a web application on this server and they all have their own login accounts. Currently, the web application doesn't support HTTPS because of some design flaws, which take time to fix. So I have two options: 1) Delay installation of the application until it does support HTTPS. 2) Just install the thing because there isn't a huge risk, since it runs on the internal network only. In time, it could be patched and moved to a secure server.
The data managed by the web application has a privacy element, since it's mostly customer information. (But no creditcard or bank account data.) It's still considered sensitive information, though. But not sensitive enough to defend at all costs. And although there would be one or two users with some technical knowledge about computer hacking, most users are not IS specialists but just generic users. (All users use a regular user account, not administrator accounts. Installing additional software by users is made [almost] impossible.)
So, is there a big risk when I install this application internally on a less secure connection?
Add-on: We don't support WLAN. Visitors can plug in to the Network but still won't have access to the Intranet environment. I'm not an expert on this topic, but as I understood, the machine needs to be part of our domain before it can access the Intranet environment. (This has been tested!) Since users can't install additional software, it would be difficult for them to install additional hacker tools. Every system also has a good virus-scanner active which is kept up-to-date. Plus, all outgoing Internet connections will have to pass an additional proxy server which does a few additional checks. The users know that their Internet behavior to outside sites is monitored. And although any computer might be hacked, the system isn't sensitive enough to go to panic mode and make sure everything is secure. Worst-case scenario would be that a hacker deletes all data, which means we have to restore a backup. Or he gets a list with snailmail addresses of customers, their jobs and some financial information but no references to bank accounts or other account information.
Add-on2: I'm asking this simply because the regular administrator is unavailable at this moment. (He had an accident due to the bad weather conditions in the Netherlands. It's not critical but it takes a while for him to recover.) The application is new and will have no data once installed. I was told that it could take up to 2 months before he recovered well enough to continue his work so the decision is mainly about installing it without his support so it can be used already or to wait until he returns, which would probably delay things for as long as he's away or until we've found and trained a qualified replacement.