ExamWizardzExamWizardz
Start free
Security

What is data in transit?

Data in transit is data moving across a network, protected by protocols such as TLS, IPsec and SSH that encrypt it and detect tampering on the way.

What is data in transit?

Data in transit, also called data in motion, is data traveling from one system to another: a browser talking to a web server, mail relayed between servers, a file uploaded to cloud storage, or a database replicating to another region. Along the route it passes through equipment the sender does not own, such as public Wi-Fi, carrier routers and cloud provider networks, and anyone positioned there can try to read, alter or replay it.

It is one of three data states. Data at rest is stored on media, and data in use is held in memory while an application processes it.

How data in transit is protected

A secure transport protocol should deliver confidentiality (a capture reveals nothing useful), integrity (altered packets fail their checks and are discarded) and authentication (the client can confirm it reached the genuine server). Most use a hybrid design, where an ephemeral Diffie-Hellman exchange creates session keys and a fast symmetric cipher such as AES-GCM or ChaCha20-Poly1305 encrypts the data.

  • TLS protects individual application connections such as HTTPS, LDAPS and IMAPS. Use TLS 1.3 where possible and nothing older than TLS 1.2; SSL and TLS 1.0 and 1.1 are deprecated.
  • IPsec works at the network layer and secures every IP packet exchanged by two hosts or two networks. ESP supplies the encryption, and tunnel mode is the usual choice for site-to-site VPNs.
  • SSH encrypts remote administration and file transfer (SFTP and SCP) on TCP port 22, replacing Telnet and FTP.
  • VPNs wrap traffic in an encrypted IPsec or TLS tunnel, which also protects older applications that cannot encrypt on their own.
  • Wi-Fi encryption such as WPA3 covers only the wireless link from the device to the access point. After that, only higher-layer encryption protects the traffic.

Mutual TLS and end-to-end encryption

In ordinary TLS only the server presents a certificate. In mutual TLS (mTLS) the client presents one as well, so each side proves who it is. mTLS is common between microservices, for API clients and for device authentication, where a shared password would be weak or hard to manage.

Protection can also be hop-by-hop or end-to-end. Hop-by-hop TLS secures each link, but any proxy, load balancer or mail server that terminates TLS sees plaintext before re-encrypting it. End-to-end encryption, used by secure messaging apps, keeps keys only on the endpoints, so not even the service provider can read the content. In both cases metadata, such as who communicated with whom and when, remains visible.

Example: the same transfer with and without encryption

An analyst runs a packet capture while a backup script logs in to an old FTP server. Following the TCP stream on port 21 shows the USER and PASS commands, with the service account's password readable in the capture. After the script is moved to SFTP, a new capture shows an SSH key exchange on port 22 and then nothing but encrypted payloads. Encryption did not prevent the capture; it made the capture worthless. The same reasoning applies to every cleartext protocol: Telnet, HTTP, POP3, IMAP, LDAP simple binds and SNMPv1 or v2c community strings all have a secure replacement.

Data in transit vs. data at rest vs. data in use

Each state needs its own control, and a control built for one state does nothing for the others. TLS protects a card number while it crosses the network, but once it is written to a database it is data at rest and needs storage encryption. When an application loads it to calculate a refund, it is data in use, protected by least privilege, endpoint protection and, for sensitive workloads, confidential computing. A scenario about traffic captured on the wire, between offices or over public Wi-Fi is about data in transit.

Data in transit on the CompTIA Security+ exam

Data states are part of SY0-801 objective 3.3 on data protection. Encryption in transit and secure protocols belong to objective 1.3 on cryptographic solutions, and VPNs and secure communication fall under objective 3.2 on security architecture. Scenario wording that points here: credentials captured from network traffic, a requirement to protect traffic between two sites, remote staff on hotel or airport Wi-Fi, or a cleartext protocol that must be replaced. Typical answers are TLS 1.2 or later, IPsec (ESP in tunnel mode) to join two offices, SSH or SFTP for administration and file transfer, and mTLS when both ends must authenticate. Distractors include full-disk encryption and TDE, which protect stored data, and WPA3, which secures only the wireless hop.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

data at rest

Data at rest is data in storage, such as disks, databases, backups and cloud buckets, protected mainly by encryption, access control and key management.

data in use

Data in use is data being processed in memory or by a CPU, usually in decrypted form, so encryption at rest and in transit no longer protect it.

IPsec

IPsec (Internet Protocol Security) is a protocol suite that authenticates and encrypts IP packets at the network layer; most site-to-site VPNs use it.

SSH

SSH (Secure Shell) is a secure network protocol that provides a way to access and manage remote computers and servers over an encrypted connection.

TLS

TLS (Transport Layer Security) encrypts and authenticates network traffic, such as HTTPS on port 443. It replaced SSL, which is insecure and deprecated.

VPN

A virtual private network (VPN) is a secure and encrypted connection that allows users to access a private network over a public internet connection, protecting data transmission and enabling remote access to resources.

← Back to the full CompTIA glossary