I've noticed that there is a third-party webservice we utilize programmatically at my job to transmit somewhat sensitive information and I was surprised to see that the endpoint was only using http, rather than https. Upon further investigation it appears that a whilelist is being employed by this webservice, meaning that theoretically only our server that actually utilizes this service should have access.
I'm wondering whether the use of a whitelist is sufficient as a protection against sniffing/MitM attacks? Being a security conscious member of our team, I'm obviously in support of using https anywhere that potentially sensitive data is transmitted, but I'm not sure if that would be overkill or unnecessary when combined with a controlled whitelist.
Obviously a malicious insider on the same network segment as our server may be able to observe this communication in the clear. But for the sake of argument I'd like to assume this situation is unlikely.