Data in transit

Key takeaways

• Data in motion, also known as data in transit, is data that is being transmitted from one location to another, either within the network or across external networks.
• Data at rest is data that is stored in a particular location, and not actively being used.
• Data in use is data that is actively being accessed or processed.
• Data in motion is vulnerable to interception, insider misuse, excessive access, and uncontrolled third-party sharing, making strong encryption and access controls essential.
• Encryption is fundamental to protecting data in transit, using protocols like TLS, HTTPS, SFTP, and IPSec helps prevent interception and tampering.
• To secure data as it moves across the organization, apply strict controls at critical exit points by monitoring file activity on endpoints, enforcing email data loss prevention (DLP) policies, limiting the use of USB and removable media to approved devices, and controlling uploads to cloud and SaaS platforms to prevent unauthorized data exfiltration.

What is data in motion?

Data in transit, or data in motion, refers to data that is transmitted within a network or across the internet. A few examples include files being shared with coworkers, emails sent with attachments, data uploaded to cloud applications, messages exchanged through collaboration tools, and information shared with third-party vendors or partners. Data in transit is the most vulnerable category of data, as it gets exposed to high security threats like eavesdropping attacks, ransomware attacks, and data theft.

The three states of data

Data can be classified into three categories depending on its state: data at rest, data in use, and data in transit. Data at rest comprises of all files and information that is stored or archived. Data in use involves all data currently in use by employees, vendors, and other stakeholders. Of all the three states, data in transit is the most vulnerable to data theft.

Data in transit vs. data at rest vs data in use

The main differences between these three states of data can be explored through the nature of data, its vulnerability to attacks, applicable security controls, and the consequences of data loss.

Threats to data in transit

Data moving across networks and organizational boundaries is continuously exposed to interception, manipulation, and exploitation. A few common threats include risks to data in transit:

• Interception and packet sniffing: Attackers capture raw data packets flowing through a network, exposing credentials, session tokens, and sensitive content in plaintext (particularly on unencrypted or poorly segmented networks).
• Manipulator-in-the-middle attacks: Adversaries secretly position themselves between two communicating channels to intercept, read, and alter data in real time, while the connection appears completely legitimate to both endpoints.
• DNS spoofing: By corrupting DNS cache entries, attackers silently redirect users from legitimate domains to fraudulent ones, capturing credentials and sensitive data without requiring any action from the victim.
• Session hijacking: Attackers capture valid session tokens through network interception or cross-site scripting to fully impersonate an authenticated user, gaining unauthorized access without ever needing their credentials.
• Cryptographic weaknesses and unencrypted protocols: Use of deprecated algorithms, poor key management, and unencrypted protocols such as HTTP and FTP leave data fully exposed in transit. Outdated protocol versions further compound this risk by introducing known, exploitable vulnerabilities.

Addressing these threats requires a robust approach to securing data as it moves, starting with encryption.

Encrypting data in transit

As discussed in the previous section, data in transit faces various threats as it moves between different locations with varying levels of enforced security policies. This makes encryption essential, as it ensures secure transmission and protects sensitive information from interception, tampering, and unauthorized access. A few protocols used to encrypt data in transit include:

• TLS: Encrypts data exchanged between applications, securing web, email, API, and other network communications.
• HTTPS: Uses TLS to encrypt communication between browsers and web servers, protecting online browsing and transactions.
• SFTP: Secures file transfers over a network by encrypting both commands and data using SSH.
  IPSec:Encrypts and authenticates IP packets, commonly used to secure VPN connections between networks and remote users.

While encryption plays a critical role in protecting data in transit, securing it involves more than just applying encryption. In the next section, we’ll explore a few more measures required to protect data in transit effectively.

How to protect data in transit

To secure data as it moves across the organization, implement granular controls at key egress points where sensitive information can exit the environment.

• Control endpoint file activity: Track file actions—including copy and move events—to detect unusual movement of sensitive files. Real-time monitoring enables early detection of abnormal activity and prevents unauthorized transfer to external destinations.
• Enforce DLP for email: Protect sensitive data transmitted through mail servers by scanning outbound messages for financial records, personal data, or intellectual property. Automatically quarantine suspicious attachments, block external delivery, or require managerial approval before sending data to external domains.
• Restrict USB and removable media access: Manage physical data movement by controlling endpoint ports and removable storage usage. Allowlist authorized, corporate-encrypted devices by serial number to ensure that any data copied to external media is logged, traceable, and limited to approved hardware.
• Regulate file uploads across cloud applications: Inspect and govern file uploads to websites, SaaS platforms, and online services. Enforce policies that prevent sensitive data from being uploaded to unauthorized or high-risk destinations, including personal cloud drives and shadow IT platforms. Block, quarantine, or generate alerts for suspicious upload activity.
• Secure data in motion in cloud environments: As data moves across cloud infrastructure, APIs, and third-party integrations, it travels beyond the organization's direct control. Enforce TLS 1.2 or higher across all transmission channels, govern data movement between cloud services, restrict transfers to unauthorized platforms, and maintain continuous visibility into cloud data flows to detect anomalous activity before it escalates.

Frequently Asked Questions (FAQ)