Where Is Your Data Encrypted? A Guide to Firewalls, Fiber, Cloud and FIPS

01 / Follow the data

Start with the actual endpoints

Imagine an employee opening a cloud application over a secure website connection. The laptop establishes an encrypted session with the cloud service endpoint—the system that accepts and decrypts that session. The traffic can pass through the customer’s firewall and the Internet without those intermediate systems decrypting its contents. This assumes the connection is correctly configured and no inspection device terminates it. Transport Layer Security (TLS) is designed to protect application data between its communicating endpoints. ^[1]

Encrypted content is not the whole packet. Network operators may still see information needed to deliver traffic, such as Internet Protocol (IP) addresses, and may observe timing or traffic volume. The visibility of other details varies with the protocols and configuration. ^[1]

02 / Choosing protection

Different layers protect different spans

Networks package data in layers so that devices can carry it to its destination. This packaging is called encapsulation; it is not encryption by itself. The encryption method determines which content is protected and where that protection ends.

A virtual private network (VPN) can protect selected traffic across an IP network, but its protection ends at its configured peers. NIST describes IPsec as a network-layer security control and explains its deployment choices. ^[2] MACsec protects Ethernet frames between participating peers; if an intermediate device terminates MACsec, a new protected link is needed for the next segment. It does not automatically protect data beyond the peer devices. ^[3]

These approaches can coexist. For example, an application can use TLS while a site-to-site VPN also protects the traffic between two gateways. Whether both are needed depends on the risks and obligations being addressed.

03 / The connection

What a dedicated fiber path contributes

Separation limits how customer traffic shares the access infrastructure. Encryption adds protection to the information on that infrastructure. Both can form part of a layered design, together with physical access controls, equipment security and sound key management.

Dark Fiber

Stealth’s Dark Fiber gives customers dedicated fiber strands on which they can operate their own optical equipment. Customers can select from a wide range of security designs, including MACsec on compatible equipment, IPsec, or application encryption. The customer’s equipment, configuration and key management determine what is protected. A dedicated strand does not encrypt the information by itself.

Optical wavelength and Transparent LAN

Stealth’s Transparent LAN uses a dedicated optical wavelength to connect customer locations with a private Ethernet service. A wavelength is an optical channel; it is distinct from owning an entire fiber strand. Customers can use suitable encryption, including MACsec where the end equipment and service support the necessary Ethernet frames and key exchange. Confirm the handoffs, optical and frame requirements, maximum frame size and peer compatibility for the proposed service.

Dedicated Internet Access

With Stealth’s Dedicated Internet Access, each customer’s access uses dedicated fiber and a unique optical wavelength terminated on a Nokia router. The access is not a shared Layer 2 Ethernet segment with other customers. This describes the customer access design; Internet traffic is then routed onward across networks to its destination. The dedicated access path is a security and isolation feature, but it does not itself encrypt application traffic or make the public Internet a private end-to-end circuit. Explore Dedicated Internet or read about the Internet handoff.

For any service, verify the exact endpoints, handoff and design in the proposal. Physical separation reduces shared access exposure; it does not eliminate every physical, endpoint or operational risk.

04 / At the firewall

Does the firewall encrypt the traffic?

It depends on what the firewall is configured to do. If it forwards an already encrypted application session without decrypting it, the application endpoints perform that encryption. A firewall can still enforce traffic rules without seeing the protected content. Whether that design satisfies a particular requirement depends on its scope and evidence.

If the firewall terminates a VPN, it is a cryptographic endpoint for the protected tunnel. If it performs TLS inspection, it terminates the client’s session, examines permitted traffic, and establishes a separate protected session toward the destination. That creates a point where the inspected data is available in readable form. Inspection can help security monitoring, but it also changes the trust boundary and introduces certificate, privacy and operational considerations. NIST’s enterprise TLS guidance discusses visibility and inspection choices. ^[4]

The same firewall may also use encryption for its management interface or other services. Review those functions separately; the answer for application traffic does not automatically settle requirements for device administration.

05 / Compliance

What does FIPS mode actually tell you?

Federal Information Processing Standards (FIPS) are U.S. federal standards. FIPS 140-3 specifies security requirements for cryptographic modules: the hardware, software, firmware or combination that performs cryptographic functions. Some organizations need validated modules because of a contract, applicable policy or regulation; others may choose them as part of their security program. The requirement depends on the organization and use case. ^[5]

A product label, an approved algorithm or a vendor’s statement that a device is “FIPS capable” does not by itself establish that the deployed cryptographic module is validated and operating as required. NIST’s Cryptographic Module Validation Program (CMVP) lists certificates and security policies. Check the module, hardware or software version, certificate status, applicable services and any required configuration or approved operating mode. A module listed as being tested is not the same as a validated module. ^{[6] [7]}

Ask your security and compliance teams which traffic and functions are in scope. A firewall passing traffic already protected elsewhere is a different case from a firewall providing the encryption for a VPN or decrypting traffic for inspection. Specific contracts, organizational policies and other uses of the device can still impose additional requirements; there is no universal answer based only on whether a firewall is in the path.

Before changing a firewall’s mode, review the exact vendor instructions and plan a maintenance window, compatibility testing and recovery. Some platforms require a factory reset when enabling the mode; others have different procedures. ^[8]

06 / Put it into practice

Map, verify and maintain the protection

1. Identify the information and rules. What data is moving, which obligations apply, and which business systems and locations are in scope?
2. Draw the path. Include users, applications, firewalls, inspection proxies, service handoffs, cloud endpoints and any onward connection inside the destination environment.
3. Mark each encryption boundary. Record where each session or tunnel starts and ends, who can access plaintext, and whether a proxy or gateway creates another segment.
4. Check transport and equipment. Confirm the dedicated fiber or wavelength design, interface speeds, supported encryption features, frame size, capacity and failover behavior. Test representative traffic.
5. Verify requirements and evidence. Where FIPS validation is required, record the module’s certificate, status, approved services, version and security-policy conditions; confirm how the deployed configuration meets them.
6. Assign ownership. Document who manages keys, certificates, renewal, access, monitoring and incident response. Recheck after upgrades or topology changes.

Bring the network, security, application and compliance teams together before selecting equipment. A transport provider can describe the connection and handoffs; the systems that terminate encryption and the applicable policy determine the rest of the design.

Reference

Terms to know

Encryption endpoint

A device or service where a protected session begins or ends and data is encrypted or decrypted.

FIPS

Federal Information Processing Standards, U.S. federal standards that include requirements for cryptographic modules.

IPsec

Internet Protocol Security, a family of standards used to protect IP communications, often between VPN gateways.

Layer 2

The data-link layer, where Ethernet frames move across an Ethernet connection.

MACsec

Media Access Control Security, an Ethernet security standard that can protect frames between configured peers.

TLS

Transport Layer Security, a protocol used to protect communications between application endpoints, including many secure websites.

VPN

Virtual private network, a protected connection across another network; its coverage depends on where it begins and ends.