Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Cryptography for Security Managers
Decisions, not mathematics
The security manager doesn’t need to design algorithms. They need to decide what must be encrypted, which standards are allowed, who controls the keys, and how the organisation will cope when an algorithm becomes unsafe. Those are governance decisions with long consequences. CISA covers the mechanics in detail.
What cryptography gives you
| Goal | Technique |
|---|---|
| Confidentiality | Encryption: symmetric (AES) for bulk data, asymmetric (RSA, ECC) for key exchange |
| Integrity | Hashing (SHA-2, SHA-3); message authentication codes |
| Authentication | Certificates, MACs, digital signatures |
| Non-repudiation | Digital signatures, with private keys under the owner’s sole control |
The cryptography program
A cryptography policy and standard set out:
- where encryption is required, driven by classification and risk: confidential data at rest and in transit, portable devices, backups
- approved algorithms and key lengths, and which are deprecated
- key management requirements
- certificate management: inventory, renewal, revocation
Key management
Most real cryptographic failures are key management failures. Keys belong in hardware security modules (HSMs) or key management services (KMS), separate from the data, with tightly controlled access, rotation and logging. Encryption keys may be escrowed for recovery; signing keys shouldn’t be, or non-repudiation is lost.
Example. A database is encrypted with strong AES, but the key sits in a configuration file on the same server. When the server is breached, the attacker has both. Moving the key to a cloud KMS, with access only for the application’s identity, makes stolen data useless.
Preparing for change
- Deprecated algorithms: find and retire DES, 3DES, RC4, MD5, SHA-1 and old TLS versions.
- Post-quantum cryptography: NIST standardised the first post-quantum algorithms in 2024. Data that must stay secret for many years is at risk from “harvest now, decrypt later”.
- Crypto inventory: know where cryptography is used, and with what.
- Crypto agility: design systems so algorithms can be swapped without rebuilding them.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most common weakness in encryption programs | Key management |
| Where encryption keys should be stored | An HSM or KMS, separate from the data |
| What decides where encryption is required | Data classification and risk |
| Control providing non-repudiation | Digital signatures |
| Preparing for post-quantum cryptography | A crypto inventory and crypto agility |
In short
- Cryptography provides confidentiality (encryption), integrity (hashing, MACs), authentication and non-repudiation (digital signatures).
- A cryptography policy and standard set where encryption is required, which algorithms and key lengths are approved, and how keys are managed.
- Key management is where most crypto fails: keys belong in HSMs or key management services, separate from the data, with controlled access and rotation.
- Encryption follows classification: required for confidential data at rest and in transit, and for portable devices.
- Certificates need an inventory and renewal process; expired certificates cause outages.
- Crypto agility, the ability to swap algorithms, prepares for deprecated algorithms and post-quantum migration.
Exam traps
- Encryption without good key management gives little protection.
- Keys stored with the encrypted data protect almost nothing if the system is breached.
- Encryption gives confidentiality; non-repudiation needs digital signatures.
- Escrowing signing keys undermines non-repudiation; escrow is for encryption keys.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What cryptography gives you
The cryptography program
Key management
ExampleA database is encrypted with strong AES, but the key sits in a configuration file on the same server. When the server is breached, the attacker has both. Moving the key to a cloud KMS, with access only for the application's identity, makes the stolen data useless.
1 / 9