Encryption in Transit - Protecting Data on the Wire

About 2 min read

Encryption in Transit is a technique that encrypts data flowing over a network to prevent eavesdropping and tampering. TLS (Transport Layer Security) is the representative protocol, used to protect all kinds of network communication such as HTTPS communication, sending and receiving email, and VPN tunnels. As of 2025, the adoption rate of TLS 1.3 has exceeded 70% of major websites, and preparations for the migration to post-quantum cryptography are also underway.

Real-World Use Cases

"A penetration test flagged that communication between our microservices was being done in plaintext. We introduced a service mesh (Istio) to apply mTLS to all communication, automating authentication and encryption between services."

Encryption-in-Transit Flow

The Difference from Encryption at Rest

Whereas encryption at rest protects data stored on disks and databases, encryption in transit protects data while it moves from sender to receiver. The two are complementary, and either one alone is insufficient. For example, even if your database is encrypted, if communication with the application server is in plaintext, the data could be intercepted through a man-in-the-middle attack.introductory books on encryption in transit (Amazon) offer a systematic way to learn.

Major Protocols and Implementations

TLS 1.3 is the current standard, reducing the number of handshake round trips and balancing security with speed. SSH encrypts server-management communication, and IPsec provides network-layer encryption over VPN tunnels. In cloud environments, designs that also apply mTLS (mutual TLS authentication) to inter-service communication are recommended. On public Wi-Fi, encryption in transit is especially important, and combining it with a VPN can also protect unencrypted communication.

Operational Tips

Service outages caused by expired TLS certificates are a frequent incident. Use Let's Encrypt's auto-renewal or certificate-management tools to prevent expiration. In addition, old protocols such as TLS 1.0/1.1 have known vulnerabilities and need to be disabled. By combining a strong random password with encryption in transit, your credentials are also protected securely when transmitted.books on encryption technology (Amazon) are also a helpful reference.