CISSP 7.7 - Applied Cryptography (Part 1 of 2)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series turns cryptographic theory into practice for Domain 3, applying it to the devices that walk out the door and the email that must stay private, provable, or both — the everyday problems you get handed on the job.

Frequently Asked Questions

How do you protect data sitting on portable devices?

Laptops, phones, and tablets carry sensitive data that can walk out the door in seconds, and the defense is encryption at rest, which modern operating systems bake right in. You will see full-disk and file-level encryption built into the major desktop platforms, alongside open-source options that work across systems. When evaluating tools, compare how they protect keys held in memory, whether they encrypt the whole disk or just a volume, and whether they tie into hardware.

What does a Trusted Platform Module add to that protection?

A Trusted Platform Module is a dedicated chip on the device’s motherboard that stores and manages the keys used for full-disk encryption, and it only releases those keys to the operating system after the user successfully authenticates. That closes a nasty attack: someone cannot simply pull the drive out of your laptop, drop it into another machine, and read it, because the keys stayed locked in the original device’s chip.

How do you decide what security an email actually needs?

Match the protection to the requirement with a simple decision tree. If the message must stay private, encrypt it; if it must not be altered, hash it; if the recipient needs to confirm who sent it and that the sender cannot deny it, apply a digital signature; and when you need the full set, both encrypt and sign the message. The sender owns the responsibility for putting the right mechanisms in place, using the lightest combination that meets the actual need.

How does Pretty Good Privacy build trust between users?

Pretty Good Privacy, or PGP, is a long-standing secure email system that uses a web of trust instead of relying solely on a top-down authority. You become trusted by one or more existing users, then you extend trust to others based on their judgment, and trust radiates outward through the network of people vouching for one another. PGP comes in a commercial edition and an open-source variant, and both support modern encryption, hashing, and signature standards.

What makes S/MIME different?

S/MIME has become a de facto standard for encrypted email, and it takes the authority-based path rather than the web of trust, relying on X.509 certificates to exchange keys. Anyone can verify a signed message using the sender’s certificate, but to encrypt your own mail or sign it yourself, you need your own certificate. It enjoys broad support in major desktop mail clients, though mainstream web-based mail typically needs a browser extension to handle it.

Reference: This article is based on concepts discussed in CISSP 7.7 - Applied Cryptography (Part 1 of 2).