With so much information running across networks and the internet.
How can we ensure sensitive data remains protected?
How can we make sure our employee information
is safe from being stolen from hackers?
Well, encryption seems to be the key with encryption.
We can identify and utilize different technologies
to ensure our information is actually protected,
thereby facilitating that confidential I aspect of the CI a triad
with encryption.
We are literally taking information that is readable in plain text
and we're misconfiguring it or changing it in such a way
that no one can actually read what we're processing.
That means that we're taking something that may
be human readable like a standard sentence such
as if I was good and changing it to something that's as Iaelo the number six,
you get the point
and we're really going through and making sure that
that information is not only unreadable but unchallenged,
meaning that the algorithm associated with it
is made in such a way that the attacker can
actually utilize a reverse of that algorithm to decrypt the information
with a key and the key generation,
we're making sure that the key is again something complex.
Now,
a lot of times people utilize something like a
password and expect that to be your key.
But in most cases, we're using a very long stretched out enumeration of that key.
In most cases, 100 and 28 bits,
meaning we're providing a lot of zeros and ones that an attacker
would have to grab that key in order to decrypt the algorithm
encryption is really made up of three different portions.
It's made up of the algorithm itself,
the key that you're utilizing to utilize within that algorithm.
And then the information that we are encrypting.
Once we've encrypted
the information or that plain text information, it then becomes cipher text
for the purposes of CYS A.
You don't need to know the basics or the foundational level of encryption.
It's assumed that you already know that
and you should study up on that aspect if you're not familiar with it.
However, for CYS A,
you really got to go into the information as part of the framework or how
we're utilizing the technology as a whole
and much less about the actual encryption standardization
with symmetric encryption,
we're utilizing one key for both encrypting and decrypting the information
that means that we're taking plaintext information
and we're transferring it into ciphertext information.
And then as it's going to the other end,
we're using the same key to unlock that information.
So if I have plaintext information and say
I'm using something like AES as my algorithm,
then the other side needs to also use AES as that algorithm and then
use the key that we've already generated to encrypt it to decrypt that information.
Now,
let's separate from something like
asymmetric encryption with asymmetric encryption.
We're using two keys, we're using a public private key pair,
meaning that the public key is then utilized to encrypt the information
and then a private key is used to unlock or decrypt that information.
Now,
there's a whole mathematical process that you would normally need to understand.
And I would definitely study up on that if you're not familiar with it.
But for the purposes of CYS A, again,
we're looking at it a more framework level of how that information
is safeguarded and why we might
utilize asymmetric encryption over symmetric encryption,
all of that is usually covered in secure
plus. And I would go back and research that if you are not familiar with it,
the basic principles that you need to understand for CYS A.
On the other hand, are the knowledge that we're using a public private key pair,
meaning that we're going to use the public key
to encrypt and the private key to decrypt.
And that we're utilizing that for an out of band transmission,
meaning that in order to get some
encryption, we need to first use asymmetric encryption.
If we're talking to somebody we haven't talked to before.
So we're using asymmetric encryption for that initial encryption algorithm.
And then we're going to transfer that symmetric key
via an asymmetric encryption algorithm so that we can
then drop down to a symmetric level in order
to be more efficient and faster with our encryption
with PKI
or public key encryption.
You need to understand how the realm of
Cryptography is utilized to communicate with servers and how
servers are then able to encrypt information back and
forth between one another using our certificate authority,
our registration authority and our validation
authority to go through that process.
Now,
we could create an entire video on PK I and go through in depth with it at an hour long
so that you really understand it.
But again,
this is foundational knowledge that you should already have from security plus.
And if you're just familiar with that, you'll be fine for CYS A.
What you really need to understand when it comes to PK
I is how that information is utilized from a server capacity.
Meaning I'm using PK I and my server is then granted
the authority to issue a certificate via the certificate authority.
And then I'm validating
that certificate using the measures associated with it.
All of this again is covered within the security plus.
So I would just get myself up to date with that if needed for CYS A.
We're really just going to understand that, hey,
the certificate authority is what issues my certificate
for my website and I need to have that
registration in order to communicate effectively and securely
across the internet via our server and my client
with SSL encryption or TLS.
We're talking about secure socket layer security
or inspection over a transport layer security for
CYSA.
Again,
you don't need to go that much in depth
with actual specifics when it comes to this process.
But what you do need to know is that we're using transport layer security,
usually 1.3
and that transport layer security is encrypting our information on HTTPS.
And that we're utilizing that information on websites and how those
communications from the client to the server are actually processed again,
SSL inspection and going through the process to ensure
our information is secure specifically on credit card websites.
So what kind of questions can you expect on CYS A?
Since I just told you that a lot of
that foundational information is expected to be known already.
And how would that come into play for your cys A exam?
Well, you need to know certain things like, hey, how is SSL being utilized
to secure information for password generation or
for how we're utilizing a credit card and
how we're going to secure that credit card information from my client to my server?
You need to understand how the server is going back and forth with TK I
and how that information is being utilized in such a way
that if I wanted to set up a secure server,
how that server would then get registration and how it would
be utilized in a framework model for an enterprise environment.
More than that you need to understand how an analyst would utilize
or view that information from an encryption point or malware intrusion.
There are basic concepts that you basically,
you need to understand when you're going through this.
But again, if you go to security plus for this, it's not a big topic within CYS A,
you just need to understand the foundations and then how
it would be implemented from a security analyst point of view
ie how would an attacker utilize or take advantage
of that information and how we would protect against
it in most cases,
that's just going to be following the
proper authorities to get that information covered into
the server and how we're utilizing it.
Sorry.
Uh In this episode, we cover symmetric and asymmetric encryption and we
found out how encryption is used both in the PK I or the public
key infrastructure and how SSL or TLS overlays HTTP information to make it HTTPS.
Uh This is a very short chapter and most of it is fundamental and,
and knowledge level.