The question is in the title.
Does an internal site need to have https
security?
For example we have an internal site that handles our client's license keys -- do we need for that to be secure since it is on our internal network?
(The website is secured with IIS and windows user validation)