HTTP and Web server configuration and security.

I was able to create an HTTP and web services servers from the wizard. I
then created an api. I was able to test it with Postman and everything
checked out.

The next thing I'm unsure of is security.

I created a new user with *USER authority and no special authority I also
changed the initial menu to signoff.
I redeployed the web service speciying this user profile on User ID for
this service.
I retested with Postman and it still works.

I ended my vpn. The api now timed out in Postman.

So my question is, if the api is only ever called from behind the vpn is
there still a big hole I'm missing?
Is SSL required if behind a vpn?

Once again, your advice is very much appreciated.

Thanks, Rob