CyberLabs
RR CYBERLAB • Networking

HTTP vs HTTPS

Understand how web traffic differs at the protocol level and what security analysts can still investigate when TLS encrypts application content.

QUICK READ

HTTPS uses TLS to protect HTTP traffic in transit. Encryption reduces visibility into payload contents, but metadata such as destination, timing, connection behavior and endpoint process can still provide investigation context.

Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.

HTTP

HTTP commonly uses TCP and historically exposes application data in clear text when not protected by TLS.

HTTPS

HTTPS is HTTP carried over TLS. TLS provides confidentiality and integrity for the application data between the relevant endpoints.

What remains visible

  • Source and destination IPs.
  • Destination port and connection timing.
  • TLS-related metadata available to the sensor.
  • Certificate information where collected.
  • Endpoint process and user context.
  • DNS activity before the connection.

Investigation example

A browser connection to a known business application may be normal. The same destination reached repeatedly by an unexpected scripting process may require investigation even though the HTTPS payload is encrypted.

Common mistakes

  • Assuming HTTPS means the destination is trustworthy.
  • Assuming encryption means there is no useful telemetry.
  • Ignoring the endpoint process that initiated the connection.

Daily quiz hook

Why can an analyst still investigate an HTTPS connection even when the payload is encrypted?

Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.

← Back to RR CyberLabs GuidesContact RR CyberLabs

Analyst practice note

HTTPS protects application data in transit with TLS, but it does not make a destination trustworthy or hide every observable detail. Network defenders may still see endpoints, timing, byte counts, certificates, and some handshake metadata depending on sensor placement and protocol version.

Compare a fictional HTTP request with a TLS connection and list what is visible to each sensor. Avoid claiming that encryption makes activity invisible or that a certificate alone proves a site is safe.

Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.