Application and Data Protection · Topic 3 of 4
Encryption in Transit for Web, Database and Email
Protect data in transit with TLS between browser and web server, web server and database server, and in email delivery with STARTTLS, S/MIME and PGP.
- 5 min
- HTTPS is HTTP over TLS on port 443, and TLS has replaced SSL.
- Certificates authenticate the server, a symmetric session key encrypts the data.
- Use TLS 1.2 or 1.3 and disable older versions.
What it is
Data in transit crosses networks where it can be read or altered. Encryption in transit wraps the connection in a protected channel so eavesdroppers see only ciphertext, and tampering is detected. The main technology is TLS (Transport Layer Security), the successor of SSL.
How it works
Encryption of data in transit in general
Common secure protocols replace plain ones.
| Plain protocol | Secure replacement |
|---|---|
| HTTP (80) | HTTPS (443) |
| FTP (21) | SFTP over SSH (22) or FTPS |
| Telnet (23) | SSH (22) |
| LDAP (389) | LDAPS (636) |
| POP3 (110) | POP3S (995) |
| IMAP (143) | IMAPS (993) |
| SMTP (25) | SMTP with STARTTLS, or SMTPS (465) |
| Site to site or remote access traffic | IPsec or TLS VPN |
Use TLS 1.2 or 1.3. SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are deprecated. Prefer strong cipher suites with forward secrecy and disable weak ones.
Between browser and web server
When a browser connects to an HTTPS site:
- The browser asks for a secure connection and the server sends its certificate.
- The browser checks that the certificate chains to a trusted CA, matches the host name and has not expired or been revoked.
- The two sides agree on a cipher suite and exchange keys, so both derive a shared session key.
- Application data is encrypted with the fast symmetric session key.
Asymmetric cryptography authenticates the server and sets up the key. Symmetric cryptography protects the bulk data.
Defender tasks:
- Obtain certificates from a trusted CA and renew them before expiry. Automation is common.
- Redirect HTTP to HTTPS and enable HSTS, which tells browsers to use only HTTPS.
- Disable old TLS versions and weak ciphers.
- Mark cookies as Secure so they are never sent over plain HTTP.
- Protect the private key and monitor certificates for expiry.
- Test the configuration with an SSL/TLS scanner.
Between database server and web server
The path from the web or application tier to the database must also be protected, because it carries queries and sensitive results.
- Enable TLS on the database connection (supported by major databases such as MySQL, PostgreSQL and SQL Server) and require encrypted connections.
- Validate the database server certificate in the client.
- Use IPsec between the two hosts if the database cannot do TLS.
- Place the database in a private subnet that only the application server can reach. Common ports are 3306 (MySQL), 5432 (PostgreSQL), 1433 (SQL Server) and 1521 (Oracle).
- Use a dedicated least privilege account for the application, and never expose the database to the internet.
In email delivery
Email passes through several servers, and each hop can be protected.
| Method | Protects | Notes |
|---|---|---|
| STARTTLS | The connection between clients and servers or between mail servers | Upgrades a plain connection to TLS. Opportunistic, so it can be downgraded. |
| Implicit TLS (SMTPS 465, IMAPS 993, POP3S 995) | Client to server connections | TLS from the first byte |
| MTA-STS and DANE | Mail server to mail server | Force TLS between servers |
| S/MIME | The message itself, end to end | Uses X.509 certificates from a CA |
| PGP / OpenPGP | The message itself, end to end | Uses a web of trust |
Submission by clients normally uses TCP 587 with STARTTLS. Hop by hop TLS protects mail between servers but the message sits in plain form on each server. For real confidentiality, use end to end encryption such as S/MIME or PGP.
SPF, DKIM and DMARC authenticate the sender and detect forgery. They do not encrypt anything.
A worked example
An online shop serves its site over HTTPS with TLS 1.3 and HSTS. The web server connects to a database in a private subnet with TLS required, and the certificate is verified. Customer receipts are sent by a mail server that insists on TLS to the recipient's server, and invoices that contain bank details go as S/MIME encrypted messages.
How the exam asks about this
- "Which protocol secures communication between a browser and a web server?" → HTTPS, which is HTTP over TLS, on port 443.
- "Which setting tells browsers to use only HTTPS for a site?" → HTTP Strict Transport Security (HSTS).
- "Which method provides end to end encryption of an email message?" → S/MIME or PGP.
What to remember for the exam
- HTTPS is HTTP over TLS on port 443, and TLS has replaced SSL.
- Certificates authenticate the server, a symmetric session key encrypts the data.
- Use TLS 1.2 or 1.3 and disable older versions.
- Encrypt the web server to database path too, and keep the database private.
- STARTTLS is hop by hop. S/MIME and PGP are end to end. SPF, DKIM and DMARC do not encrypt.
STARTTLS is opportunistic. If the other side does not offer TLS, mail may be sent in clear text unless TLS is required by policy.
Common mistakes
Securing only the browser connection. The back end database link is also in transit and must be protected.
Calling SSL current. SSL is obsolete. Modern "SSL certificates" are used with TLS.
Confusing sender authentication with encryption. DKIM signs, SPF lists senders, DMARC sets policy. None hides content.
Check yourself
Which key protects the bulk data in a TLS session?
A symmetric session key derived during the handshake.
Why encrypt traffic between web server and database server?
Queries and results cross the network and could be read or altered by anyone with access to that segment.
What is the difference between STARTTLS and S/MIME?
STARTTLS protects a connection hop by hop, while S/MIME encrypts the message itself end to end.
Topic 3 of 4 in Application and Data Protection
Test yourself on Application and Data Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.