Professor Messers Security+ 1.4 Videos

Public key infrastructure

a broad term but mainly refers to policies & procedures that create, distribute, revoke & store digital certificates

PKI

refers to a certificate associated with people or devices

symmetric encryption

encrypt & decrypt with the same; also known as secret key algorithm

asymmetric encryption

two or more mathematically related keys

key pair process

starts as a random large number then generates into 2 keys one public & one private; private key may be sent private gets a password & saved

asymmetric encryption process

bob sends a message in plaintext, mixes plaintext with alice public key, gets ciphertext, sends to alice, alice uses her private key on cipher text, reads the same as bob’s plaintext

key escrow

after everyone makes a key you can store it locally to always have access

transparent encryption

uses symmetric keys to encrypt everything

record level encryption

encrypts same data more so important ones; column level encrypting

virtual private network

Also known as VPN can encrypt & transport data from other networks

how to stop attackers from figuring out key?

use a long key with 128-bits; add more steps (hash your password, then hash that one, then hash that one… etc)

key exchange

to exchange a key you could do out of bond or in person/telephone; not over phone

are session keys temp?

yes

public key cryptography

combine your private key with someone elses public key for a symmetric key

trusted platform module (TPM)

a standardized bit of hardware that designs cryptographic functions for that computer

Hardware security module (HSM)

Used for large scale cryptography; can secure & store keys

key management system

allows us to manage all keys from one console

secure enclave

to keep data private; built into system & dedicated to keep your data private

obfuscation

to take something easy to something difficult to understand

steganography

Popular form obfuscation, hiding stuff within an image; greek word for “concealed writing”

covertext

the document you are using to hide information in

network based

hiding information within TCP packets

invisible watermarks

uses yellow dots from printer or printer; printer can read this

audio steganography

hiding within audio files or track

video hiding

hiding within video files

tokenization

taking sensitive data & replacing it with a new number or placeholder (common with credit card processing apple pay)

data masking

hiding parts of original data (last 4 numbers of ssn or credit card showing)

hash

used to represent data as a short string of text; its not encryption you cannot recreate; can be used for integrity & authentication; could store passwords & download documents from websites

SHA256 Hash

creates 256 bit & 64 hexadecimal characters

collision

If hashes are all different but have the same hashing value; (ensure all hashes are different)

salt

adding additional information to make it difficult for brute force; everyone gets a different one for their password

digital signature

proves message you recieved wasnt changed; authenatication

blockchain

a distributed ledger that all are able to see; keeps track of indivisual transactions

what can we use blockchains for?

payment processing

digital identification

supply chain monitoring

digital voting

whats the process of a blockchain?

a transaction request

transaction sent to everyone in network

added to transaction block to be proccessed

add hash

copy is sent to everyone who has a copy of this ledger

if hash or chain is altered it wont work & will be rejected

digital certificates

a public key certificate; binds public key to signature & adds trust

what is in a digital certificate?

X.509 the standard format; certificate details such as serial number, public key, name of cert holder, issuer… etc

root of trust

eveything associated with IT requires trust; a hardware or software component that is trusted by default; anchor for validating

certificate authorities

lets us know if the website we are connected to can be trusted; digitally signs certificates on the website; if their certificate is signed by a browser you trust it will approve

third party certificate authorities

Built into browser; can purchase website certificates so that they may be added to trusted websites; checks whether the signature belongs to the true owner of website

certificate signing request

create a key pair and sends the public key to the CA to be signed; CA validates & signs this request

private certificate authorites

you are your own CA; if you have your own internal webserver & only connect to people within your organization you can be your own CA

self signed certificates

internal certificates dont need to be signed by public CA; not required to get trusted device signatures since its your own; build your own CA & trust it

wildcare certificates

Also known as subject alternative name (SAN); the certificate we have could be saved & used for any device that shares that domain name

key revocation

also known as certificate revocation list (CRL); can be used when we want to revoke a certification & built into all CA’s; used to prevent against attackers or if websever isnt in use anymore

OCSP Stapling

Also known as online certificate status protocol; imbedding status of certificate withinSSL/TLS handshake