StudyXY
RegisterLog in
Information Technology /Security+ (SY0-701): Cryptographic Solutions Part 3

Security+ (SY0-701): Cryptographic Solutions Part 3

Information Technology30 CardsCreated about 2 months ago

This deck covers key concepts and definitions related to cryptographic solutions, including random number generators, cryptoprocessors, key management, and data encryption states.

PrintEmbedImportReport

Define 'pseudo RNG (PRNG) software'

Software that is still deterministic, but able to approximate a high level of disorder
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/30

Key Terms

Term
Definition
Define 'pseudo RNG (PRNG) software'
Software that is still deterministic, but able to approximate a high level of disorder
Define 'true random number generator (TRNG) hardware'
Generates random key values by sampling physical phenomena (noise/air movement) that has a high rate of entropy.
What is the drawback of storing a key pair or secret key on a host/file system running general purpose OS?
Could easily be compromised via user credential or physical theft of the device; Difficult to ensure that key access is fully audited.
What is best practice to securely monitor cryptographic keys?
Tamper evident; Immediately known when a private/secret key has been compromised.
Define a 'cryptoprocessor'
Dedicated hardware for key generation and storage and can decrypt and sign on behalf of applications.
What is the security benefit of a cryptoprocessor?
Creates smaller attack surface for key management because key material never leaves the cryptoprocessor.
Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Security+ (SY0-701): Cryptographic Solutions Part 3
TermDefinition
Define 'pseudo RNG (PRNG) software'
Software that is still deterministic, but able to approximate a high level of disorder
Define 'true random number generator (TRNG) hardware'
Generates random key values by sampling physical phenomena (noise/air movement) that has a high rate of entropy.
What is the drawback of storing a key pair or secret key on a host/file system running general purpose OS?
Could easily be compromised via user credential or physical theft of the device; Difficult to ensure that key access is fully audited.
What is best practice to securely monitor cryptographic keys?
Tamper evident; Immediately known when a private/secret key has been compromised.
Define a 'cryptoprocessor'
Dedicated hardware for key generation and storage and can decrypt and sign on behalf of applications.
What is the security benefit of a cryptoprocessor?
Creates smaller attack surface for key management because key material never leaves the cryptoprocessor.

What are the two main implementations of cryptoprocessor hardware?

  1. Trusted Platform Module (TPM)

  2. Hardware security module (HSM)

Define a 'Trusted Platform Module (TPM)'
Implemented as a module within the CPU on a computer or mobile device.
Define a 'Hardware security module (HSM)'
Implemented in a removable or dedicated form factor, including rack-mounted appliances, plug-in PCIe adapter cards, and USB-connected security keys; Can be provisioned as a virtual appliance.
How does a cryptoprocessor decrease attack surface?
Keys are not directly accessible via the file system.
How do cryptoprocessors interact with applications that need to access a key?
Via an application programming interface (API)
Define an 'Application programming interface (API)'
Mechanisms that enable two software components to communicate with each other using a set of definitions and protocols.
What is the mechanism implemented to mitigate vulnerabilities in cryptoprocessors?
A trusted execution environment (TEE) secure enclave
Define a 'trusted execution environment (TEE) secure enclave'
CPU extensions that protects data stored in system memory so that an untrusted process cannot read it.
What is a vulnerability with cryptoprocessors?
Decrypted data needs to be loaded into the computer's system memory (RAM) for applications to access it raising the potential for a malicious process to gain access to the data via some type of exploit.
How do secure enclaves (Trusted Execution Environments, TEEs) protect API's moving data from a cryptoprocessor to another application?
Only authorized processes can have access, regardless if it has system/root privilege.
What is the result of a misplaced/damaged cryptographic key?
Ciphertexts cannot be recovered unless a backup of the key has been made.
Why is it against best practice to make backups of private keys or secret keys?
Problematic as it becomes more likely that a copy will be compromised and more difficult to detect that a compromise has occurred.

What are controls to mitigate issues of making copies of a private key/secret key?

  1. Escrow

  2. M of N controls

Define 'Escrow' in key management

The storage of a backup key with a third party.

Define 'M of N controls' in key management
An operation cannot be performed by a single individual; A quorum (M) of available persons (N) must agree to authorize the operation.
How can risks of a compromised private key be reduced?
Splitting the key into parts, and each part being held by separate escrow providers.
Define a 'key recovery agent (KRA)'
An account authorized to access a key held in escrow.
What should be included in a key recovery policy to mitigate impersonation?
Require two or more KRAs to authorize an operation.
How does encryption fulfill the goal of confidentiality?
Threat actor will not be able to understand or change what has been stolen.

List the 3 states data can be described as?

  1. Data at rest

  2. Data in transit

  3. Data in use

Define 'Data at rest'
When the data is in some sort of persistent storage media.
Define 'Data in transit'
Data transmitted between two hosts, such as over a private network or the Internet.
Define 'Data in use'
Data present in volatile memory, such as system RAM or CPU registers and cache.
Define 'bulk encryption'
Encrypting megabytes or gigabytes of data.