Encryption in transit (also called encryption in motion) protects data as it moves between systems, networks, and endpoints by establishing encrypted communication channels that prevent eavesdropping, tampering, and man-in-the-middle attacks. The primary protocols are TLS 1.3 for application-layer encryption and IPsec or WireGuard for network-layer encryption.
TLS 1.3, the current standard, establishes encrypted sessions through a streamlined handshake that completes in a single round trip. The client and server negotiate cipher suites (TLS 1.3 mandates forward-secret key exchange using ECDHE), authenticate the server via X.509 certificates, and derive session keys. All subsequent data is encrypted with AEAD ciphers (AES-256-GCM or ChaCha20-Poly1305). Mutual TLS (mTLS) adds client certificate authentication, commonly used for service-to-service communication in microservice architectures. For network-layer protection, IPsec tunnels encrypt all IP traffic between endpoints, while WireGuard provides a modern, performant alternative with a minimal attack surface. Best practices include disabling TLS 1.0 and 1.1, enforcing HSTS headers, implementing certificate transparency monitoring, and encrypting internal east-west traffic -- not just north-south perimeter traffic.
PCI DSS Requirement 4 mandates encryption of cardholder data during transmission over open networks. HIPAA requires encryption of ePHI in transit. NIST SP 800-52 provides detailed TLS implementation guidance for federal systems. Without transit encryption, network-level attackers -- including compromised WiFi, BGP hijacking, and rogue network devices -- can intercept sensitive data in plaintext. The shift to zero-trust architectures makes universal transit encryption mandatory, as internal networks are no longer considered trusted.
CDA addresses encryption in transit within the Data Protection and Sovereignty domain as a C-BUILD baseline requirement. Our missions audit current TLS configurations, remediate weak cipher suites, implement mTLS for service meshes, and establish certificate lifecycle management processes.