Data in Transit - Description of Risk and Recommendations

Description of risk and recommendations.

Data in Transit - The Risk

The risks associated with data in motion are the same as those associated with data at rest. These include:

• Unauthorized disclosure
• Modification
• Unavailability
• Malicious actors may intercept or monitor plaintext data transmitting across the network and gain unauthorized access that jeopardizes the confidentiality, integrity, and availability of the data

Data in Transit - Recommendations

Valuable data must be encrypted when transmitted across any network to protect against eavesdropping of network traffic by unauthorized users.

In cases where source and target endpoint devices are within the same protected subnet, valuable data transmission must still be encrypted as recommended below due to the potential for high negative impact of a valuable data breach. The types of transmission may include client-to-server and server-to-server communication, as well as any data transfer between core systems and third-party systems.

Email is not considered secure and must not be used to transmit sensitive data unless additional email encryption tools are used. When attempting to secure data in transit, consider the following recommendations to design secure transmission of data:

• Web interfaces to sensitive devices must
• Non-web valuable data traffic be transmitted using secure protocols, should be encrypted via applicationideally using TLS encryption. Note level encryption. that SSL in any of its versions, including
• Where an application database resides

SSLv3, is considered breakable and outside of the application server, has been deprecated. Now, TLS 1.2 all connections between the database is considered secure while 1.0 and 1.1 and application should also be encrypted are known to be vulnerable. It is worth using FIPS-compliant cryptographic regularly checking what the current algorithms.

secure encryption protocols are because it is a constantly evolving area.

• Where application-level encryption is not available for non-web sensitive
• Sensitive data transmitted over email data traffic, implement network-level must be secured using cryptographically

encryption such as IPSec strong email encryption tools such as or SSH tunneling.

PGP or S/MIME.

• Alternatively, prior to sending the email, a user should encrypt sensitive data using compliant file encryption tools and attach to an email for transmission.
• Encryption should be applied when transmitting valuable data between devices in protected subnets with strong firewall controls.