Transport Layer Security (TLS) is a cryptographic protocol that provides confidentiality, integrity, and authentication for data in transit across a network, most visibly protecting the HTTPS traffic behind the browser padlock.
TLS is the successor to the older SSL protocol, which is now considered broken and should not be used. During the handshake the client and server authenticate using digital certificates, agree on a cipher, and derive fresh session keys. TLS 1.3, published in 2018, dropped a long list of weak legacy algorithms and shortened the handshake, which improved both security and speed.
A frequent misunderstanding is treating the padlock as proof that a site is trustworthy. TLS secures the channel, not the intentions of whoever operates the other end, so a phishing site can serve valid TLS. In practice the real risks are configuration problems: expired certificates, weak cipher suites, or servers still allowing obsolete protocol versions.
How is TLS tested on the CISSP?
It falls under Domain 4, Communication and Network Security, worth 13% of the exam. You should recognize where TLS operates, how it differs from IPsec, and why authentication and key exchange matter for securing protocols across untrusted links.