2

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website.

I am developing a PHP web application for an insurance company. the application contains all information about the customers but this app is only used by the admins and salesman of the company. The admin creates a user then that user can add customers or renew their insurance. the address will be something like example.com/manage/ and the login is only for the users that admin person has created. Of course I will be using validation, salt, encryption, etc. But do I need SSL certificate?

2

Yes, whenever traffic is transported across an untrusted network.

  • Using HTTPS encrypts the traffic. Otherwise, an attacker could read customer information or internal documents in the clear whenever they are transmitted. And if a password or other keys are ever transmitted as clear text, then an attacker could use those to get even better access.

  • SSL certficates can authenticate a server to a user which makes man in the middle-attacks more difficult. Otherwise, an attacker could set up a proxy between the user and the real server, and record all communications even when they're encrypted.

Consider the following attack scenarios:

  • A sales rep connects to your website while sitting in a coffee-shop. The Wi-Fi has been compromised, and all network traffic is recorded by a malicious hacker. If you do not verify the identity of the server and encrypt all traffic, the attacker can record and misuse confidential information or sensitive customer data, e.g. by selling the data to a competitor.

  • The physical internet connection of your office is compromised. Your website is hosted outside of the office. All requests to the server are intercepted and redirected to a proxy which records all information. The same chaos as above ensues.

This is not of an issue when the server is only accessible via an Intranet which is already sufficiently secured and encrypted (e.g. via a VPN). Note that in some jurisdictions there are strong privacy requirements when handling customer data. Should you be breached without having secured the data properly, you could face legal action there.

  • Thanks for the answer. Just a question because I am new to use ssl. does setting the ssl certificate to example.com will also protect example.com/form? – Amin Raeisi Feb 2 '14 at 13:47
  • If you're connecting to an internal website from a coffee shop, aren't you using some sort of VPN? – JeffO Feb 3 '14 at 2:22
  • @AminRaeisi Yes, certificates are issued on a per-domain basis. This means that https://example.com/foo will be protected by a certificate for example.com. However, you'd need another certificate or a wildcard certificate when protecting subdomains, e.g. *.example.com would protect https://www.example.com/foo as well. But that has limits as well – Stack Exchange actually does it wrong, so that the SSL certificates aren't actually valid for meta.programmers.stackexchange.com . – amon Feb 3 '14 at 8:20
  • @JeffO I addressed VPNs as a possible solution in my last paragraph: “This is not of an issue when [using] a VPN”. My answer is less about certificates in particular and more about the benefits of encryption and verified server identities in general. The coffe shop scenario can be “solved” by using any form of encryption, be it HTTPS or a VPN. Of course VPNs are easier to defend as they are a single point of entry into restricted internal resources. – amon Feb 3 '14 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.