Encryption in Transit: Protecting Data on the Move

WHY IT EXISTS Networks, especially the public internet, are not secure. Any data sent in plaintext can be read, copied, or modified by an intermediary. Encryption in transit was created to ensure the confidentiality and integrity of data as it moves from one point to another, preventing eavesdropping and tampering.

THE MENTAL MODEL Imagine sending a valuable package. Instead of just writing an address on it, you place it inside a locked safe, and only the recipient has the key. Encryption in transit does this for your data. Intercepting the data is like getting the safe—useless without the key to open it. It protects data while it's traveling over the internet or moving within a cloud provider's internal network.

HOW IT WORKS This process uses protocols like Transport Layer Security (TLS). When a client connects to a server, they perform a "handshake." During this handshake, they verify each other's identity using certificates (authentication), agree on an encryption algorithm, and securely exchange session keys. From that point on, all data sent between them is encrypted. This provides both confidentiality (no one can read it) and integrity (no one can alter it undetected).

WHEN TO USE IT Always use it when data is sent over any network. This is critical for user traffic from a browser to your web server (HTTPS), API calls from mobile or web apps, connections to a database, and even communication between your own microservices running inside a cloud environment. Any data in motion is a potential target.

WHEN NOT TO USE IT There is virtually no modern scenario where you should intentionally send sensitive data over a network without encryption. While there is a negligible performance overhead, the security risks of not using it are immense. The only exception might be for non-sensitive, public data on a completely isolated and trusted network, but this is a rare and risky edge case.

ONE CANONICAL EXAMPLE A user logging into a web application. When you enter your password and click submit, your browser establishes a secure TLS connection with the server. Your login credentials are encrypted before being sent. An attacker on the same Wi-Fi network sees only scrambled, meaningless data, not your password. This protects your data as it travels from your device to the cloud provider's server.