There is a common issue that, in the most part, the developers and system administrators do not take into account; it is the use of unprotected communications channels. There are protocols that send information in clear text and, if a malicious user intercepts the traffic in the network, which is relatively easy, you can see all the information, irrespective of whether it's sensitive or not. This issue is commonly discarded, because the web applications are public; but remember that some of them are internal, and also could be visited from a public network.