A transit operations admin console uses HTTP Basic authentication over plain HTTP on an internal VLAN. How should the tester treat this?
Select an answer to reveal the explanation.
Short Explanation
"Internal only" is not a magic invisibility cloak. Basic auth over HTTP is just passwords on a postcard — anyone who can watch the wire can read them. Report it even when the console sits on a quiet VLAN.
Full Explanation
HTTP Basic authentication over plain HTTP exposes admin credentials in cleartext on the wire. Even on an internal VLAN, a transit operations admin console using Basic over HTTP remains a reportable credential-exposure risk: internal networks are sniffed, mis-homed, or pivoted through more often than wishful “internal equals safe” assumptions allow for civic operations.
Internal VLANs are not free of sniffing risk. Basic auth is absolutely a web authentication feature in scope for web testing. Browsers do not refuse Basic auth entirely.
Exam caveat: require TLS for any admin authentication and prefer stronger auth (SSO/MFA) for operational consoles. CPTS findings should not dismiss cleartext admin auth because the VLAN is “internal.”
Operational check: force HTTPS on the console, disable HTTP listeners, migrate off Basic where possible, add MFA for transit admins, and verify credentials no longer traverse cleartext paths. Inventory other transit ops consoles for cleartext auth at the same time—Basic-over-HTTP rarely exists on only one forgotten internal site. Cleartext Basic auth on ops consoles fails transit security baselines even when “only internal.” Cite the control owner in the civic remediation plan.