TLS streams: what partial encryption means for SOC teams

TL;DR: TLS traffic can still expose ASCII strings, JSON, usernames, chat fragments and game-state data when applications only partially encrypt communications, which makes encrypted traffic collection useful for spotting what actually leaks inside supposedly protected sessions, according to Corelight research. Trust, but verify becomes the right operating principle for network defenders.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Cleartext is all fun and games”.

Key questions

Q: How should security teams test whether encrypted traffic is actually private?

A: Test the payload, not just the protocol label.

Q: Why do TLS sessions still leak useful information to defenders or attackers?

A: Because encryption can be incomplete at the application layer.

Q: What are the signs that an application is only partially encrypting traffic?

A: Look for readable ASCII strings, cleartext JSON, visible usernames, chat fragments and other session content inside flows that should be opaque.

Practitioner guidance

• Verify payload confidentiality in critical TLS flows Inspect both client-to-server and server-to-client directions for readable text, structured fields and session content that should not be visible.
• Use encrypted traffic analytics in the SOC Incorporate metadata and residual string detection into hunt workflows so analysts can flag sessions that claim encryption but still reveal content.
• Prioritise applications that leak identity-linked data Track services that expose usernames, chat fragments, rewards or user activity in transit and treat them as confidentiality exceptions.

Bottom line: Partial encryption can leave readable usernames, chat fragments and JSON content inside sessions that still appear protected.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →