Data in Transit

When data is moved, usually across networks, it is data in motion or data in transit. Moving data across networks is a basic requirement. However, it is vital to protect the data from unauthorized access and alterations. Data is also in transit when it is moving from temporary storage on an endpoint device to be presented on-screen to a user (or sent down a communications path to a process control device).

Modern cryptography can provide secure and confidential methods to transmit data and allows the verification of the integrity of the message so that any changes to the message itself can be detected.

Risks

The risks associated with data in motion are the same as those associated with data at rest. These include unauthorized disclosure, modification, and unavailability.

Malicious actors may intercept or monitor plaintext data transmitting across the network and gain unauthorized access that jeopardizes the confidentiality, integrity, and availability of the data.

To protect data in transit:

• Valuable data must be encrypted when transmitted across any network to protect against interception or eavesdropping by unauthorized users.
• Valuable data transmission should be encrypted even when transmission is within the same protected subnet.
• Email is not considered secure and must not be used to transmit sensitive data unless additional email encryption tools are used. By design, standard email is transmitted in cleartext, so all contents are viewable to anyone who can gain access. When attempting to secure data in transit, consider the following recommendations to design secure transmission of data:
• Web interfaces to sensitive devices must be transmitted using secure protocols, ideally using transport layer security (TLS) encryption. Secure socket layers (SSL) encryption in any form, including SSLv3, is considered breakable and has been deprecated.
• Non-web valuable data traffic should be encrypted via application-level encryption.
• Where an application database resides outside of the application server, all connections between the database and application should also be encrypted using Federal Information Processing Standards (FIPS)-compliant cryptographic algorithms.
• Where application-level encryption is not available for non-web sensitive data traffic, network-level encryption such as internet protocol security (IPSec) or secure shell protocol (SSH) tunneling should be implemented.
• Encryption should be applied when transmitting valuable data between devices in protected subnets with strong firewall controls.
• When two organizations are seen to communicate or are communicating more than usual, this may be a security risk.

• Sensitive data transmitted over email must be secured using cryptographically strong email encryption tools such as Pretty Good Privacy (PGP) or secure/ multipurpose internet mail extensions (S/MIME).
• Prior to sending the email, a user can encrypt sensitive data using compliant file encryption tools and attach to email for transmission.