A transit operations admin console uses HTTP Basic authentication over plain HTTP on an internal VLAN. How should the tester treat this?
Select an answer to reveal the explanation.
Short Explanation
"Internal only" is not a magic invisibility cloak. Basic auth over HTTP is just passwords on a postcard — anyone who can watch the wire can read them. Report it even when the console sits on a quiet VLAN.
Full Explanation
HTTP Basic authentication base64-encodes credentials without encryption, so TLS is required to protect them in transit. Internal network placement reduces but does not eliminate interception, malware, or mis-segmentation risk. Testers should still document cleartext admin authentication and recommend HTTPS and stronger auth. Claims that Basic auth is non-web or impossible in browsers are incorrect.