Implementing SSL in Java Based Web Applications

Question

I have a java based web application developed in Amazon EC2. It is doing transactions of confidential information. I have a MySQL server installed all by my self in the same amazon instance. The web application access the database via localhost . In Security Groups , I have created a custom security where the port 8080 (the Tomcat ) can be accessed only via localhost .

Considering these, do I still need SSL to make sure the transactions are secured?

Answer 1

It depends. Are you comfortable with plain text inside the datacenter? Don't bother with SSL.

Are you worried about that traffic being sniffed locally (tcpdump) or from a malicious source ( for instance, if data was being rerouted from the switch between EC2 instances )? Use SSL.

There's a trend of large companies making sure to encrypt local traffic.