保护防火墙背后的内部宁静服务

Question

We have a couple of very important internal restful services that are placed behind firewall. I Would like to know if having only firewall is going to protect our services or not ?

I would like to learn as much as possible so we can make the right decision protecting our data.

May be adding SSL and HMAC or OAuth are few options to consider however I am not expert in this field and any input is appreciated.

Answer 1

I'm no security expert either, but all of our internal APIs have specific access controls, are served only over SSL and require access tokens for authentication.

I wouldn't open up an internal database to everybody, so I'm not leaving an API wide open either.