Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -1 down vote favorite

If a completely isolated network is managed by 100% honest SysAdmins, is it necessary to secure sensitive resources with SSL when only a handful of unidentified low-privilege malicious users have access?

share|improve this question
2  
Your question is self contradictory: If the network is "completely isolated" there should be no unidentified or malicious users of any kind, at any time. – voretaq7♦ Jan 13 '12 at 4:26
Maybe I meant to ask "If an intranet behind an ideal firewall is managed by 100%..." – Shawn Eary Jan 13 '12 at 5:40
I always use SSL on pretty much everything where possible. With about 99% of software setting up SSL with a self-signed certificate is trivial, so I've just got into the habit of running it on everything, whether it needs it or not. Unless you're a huge company, the performance loss and server load from enabling SSL on your internal apps will be so small you wouldn't notice. – sam Jan 13 '12 at 8:59
@sam - Thanks Sam. I tend to agree with you; however, my potential customers may not always let me choose what technologies are used on the network. This thread was my way of seeing if I need to highly suggest SSL to clients when they don't see the need. – Shawn Eary Jan 14 '12 at 4:15

closed as not constructive by EEAA, MadHatter, Shane Madden, MDMarra, voretaq7♦ Jan 19 '12 at 17:10

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

3 Answers

up vote 0 down vote accepted

Well, that's up to your organization's security policy.

I'd recommend using SSL if the communication is sensitive at all; if you have potentially malicious users on the network, an ARP poisoning attack could compromise your unencrypted communications, allowing an attacker to intercept and/or modify the communication between other nodes.

share|improve this answer
Thank you for pointing out ARP Poisoning. Until now, I thought that a malicious user had to have access to a server or router in order to examine another user's packets. – Shawn Eary Jan 13 '12 at 5:30
If arp poisoning is possible then so are many other ways of subverting the security. And the defition of "a completely isolated network is managed by 100% honest SysAdmins" is therefore void. – symcbean Jan 13 '12 at 14:39
@symcbean Being managed by a certain set of people doesn't necessarily mean that they're the only ones on it, and "isolated" is indefinite without extra detail; it could be isolated from the internet, isolated from another network in the organization, or isolated from the world in a bunker 2 miles underground; we have no way of making assumptions about which it is. Anyway, aside from the CA certs note (by the way, "snake-oil" is just a debianism for a self-signed certificate) I made the same exact recommendation as you (and voretaq7), so I'm not sure why you felt the need to downvote. – Shane Madden Jan 13 '12 at 16:11
@symcbean - I'm not sure why you downvoted Shane Madden's response either. I think Mr. Madden has given me the most useful response thus far. I am only delaying marking his response as an answer because I want to see if any other useful suggestions or threat lists come in. I will admit that I was orignially vauge in defining "isolated", but I was trying to indicate that I was not interested in external threats with as few words as possible. – Shawn Eary Jan 14 '12 at 4:24
@Shawn Can you expand a bit on what level of access the potentially malicious users will have to the software and hardware? Do the users own and bring their hardware, so that you're dealing with untrusted nodes, or do you need to consider security for endpoint systems as well (say, a malicious user gaining privilege on a local system and installing a key logger)? – Shane Madden Jan 14 '12 at 15:55
show 4 more comments
up vote 3 down vote

is it necessary to secure sensitive resources with SSL when only a handful of unidentified low-privilege malicious users have access?
Yes.
You say you have malicious entities with access to the network, therefore you must treat sensitive information as if those users were actively trying to intercept it and do Bad Things™.
(The privilege level of a malicious entity is immaterial in this particular case: Remember that a user with zero privileges beyond the physical ability to read traffic from the wire and put their own traffic on to it can still hijack an unsecured connection given time & motivation.)

Also you say your sysadmins are 100% honest: How do you quantify that? How will you know if a new hire is a mole, or an existing employee becomes disgruntled?. All things you need to consider when you start thinking about security...

Honestly even if your network were truly isolated and there were no malicious users I would use SSL anyway: It's pretty much transparent to the application layer in most implementations, and the computational overhead of SSL is relatively low.
The extra insurance using encrypted/authenticated connections buys you in the event your network design has a hole that lets a malicious user sniff/inject traffic is almost always worth it.

share|improve this answer
"Remember that a user with zero privileges beyond the physical ability to read traffic from the wire..." - I didn't consider the possiblity of someone physically disconecting an ethernet cable and physically routing it through another device or using some sort of inductive monitoring device. – Shawn Eary Jan 13 '12 at 5:33
"Also you say your sysadmins are 100% honest" - I don't recall stating that I had any relationship to the network in question. – Shawn Eary Jan 13 '12 at 5:44
up vote 1 down vote

"a completely isolated network"....In all my working life I've only come across one such instance of such a network which was both completely isolated and likely to remain that way.

More and more devices are being connected to networks and internetworks - why would someone ever plug a centrifuge for extracting weapons grade heavy metals into a network? It happens.

...and deciding to wait until you do connect up is a very poor justification for not implementing adequate security - security should be holistic and integrated - implementing it as soon as possible (preferably at the same time as implementing the systems its designed to protect) means that the knowledge, skills and forums are close at hand.

The only compromise I'd suggest as acceptable would be using defering a switch from snake-oil to CA signed certificates.

share|improve this answer
symcbean - you are right that security implementation should be proactive instead of reactive, and I do agree with everyone that self signed SSL certificates are easy to generate; however, the only "serious" internal threat this thread has seemed to list so far is ARP Poisoning. The other options just don't seem to be likely avenues of internal attack, but I am not a security expert. That is why I solicited the opinion of wonderfully awesome and highly intelligent SF community. – Shawn Eary Jan 14 '12 at 4:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.