jperezduerto.info
Security in depth · Unit 19 · Lesson 3 of 8
TLS protects between its endpoints
Review each protected connection and the separate handling of decrypted data.
Helpful before thisInitial access and credentials
After this lesson you can
- Identify the missing trust check in a two-connection service design.
One idea. One situation. One reasoned decision.
How it works
TLS can protect data in transit and authenticate endpoints according to the negotiated mode and validation performed. If a proxy terminates TLS, another connection may carry traffic onward. Document each connection and its trust assumptions. Encryption on one segment does not automatically cover every internal hop or decide what the application may log after decryption.
Read the supplied record
A fictional service owner requires authenticated TLS on both connections and no report contents in routine logs.
| Boundary | Supplied design record |
|---|---|
| Browser to proxy | TLS, with certificate and intended-name validation |
| Proxy to application | TLS encryption; server-identity validation disabled |
| Application logs | Full decrypted report content retained |
The proxy is a TLS endpoint: it receives plaintext after decryption and starts another connection. The first record cannot satisfy the second connection’s identity requirement. Encryption without the required peer validation is incomplete evidence of the protected relationship the owner requested.
The logs show a separate policy deviation even if both connections are later corrected. They are application-held copies, not traffic still protected by the browser connection. Propose two scoped reviews: restore the intended trust checks on the onward connection, and align logging with its approved purpose and retention. Record expected behavior and ownership for each. No interception or live traffic experiment is needed to reason from this packet.
The key distinction: Protection applies between the actual protocol endpoints.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which review finding follows from the supplied design?
Show the answer
Correct answer: The onward connection lacks the required server-identity validation, and logging needs a separate data-handling review. Encryption between the browser and proxy supplies neither the onward identity check nor protection for stored application logs.
Try it
- WriteDraw the two connections, mark each TLS endpoint, and write one missing identity check plus one separate question about stored logs.