1.4 General Security Operations

Public Key Infrastructure (PKI)

A framework used to create, manage, distribute, use, store, and revoke digital certificates and manage public key encryption with a purpose to facilitate the secure electronic transfer of information for a range of network activities such as ecommerce, internet banking, and confidential email.

Key Escrow

Where cryptographic keys are securely stored so that under certain conditions, a third party can access them, and this arrangement is used to facilitate data recovery, ensure compliance with law enforcement requests, or maintain business continuity

Full Disk Encryption (FDE)

A form of encryption where all data on a hard drive is automatically encrypted, including the OS and system files

Partition

A form of encryption that targets a specific partition of a hard drive instead of the entire disk and is useful when dealing with dual boot systems or when segregating data

File Level

A form of encryption that focuses on individual files, letting the user encrypt specific files rather than entire drives or partitions and is generally easier to set up and manage

Volume

A form of encryption that involves encrypting a set volume on a storage device, which could contain several folders an files, acting as a middle ground between partition encryption and full disk encryption

Record

A form of encryption that allows individual records within a database to be encrypted, providing more precise control over who can access what data

Database

A form of encryption that targets data at the database level, protecting sensitive information stored in a database from access by unauthorized individuals

Transport/Communication

Encrypting data in transit by using specific encryption protocols such as Transport Layer Security or Secured Socket Layer

Asymmetric

Also known as public key cryptography, it is a cryptographic system that uses pairs of keys: a public key which may be disseminated widely, and a private key, which is know only to the owner

Symmetric

A type of cryptographic algorithm that use the same key for both encryption and decryption, and the shared key is used to convert plaintext into ciphertext and vice versa

Key Exchange

The secure distribution of the secret keys required to operate either asymmetric or symmetric algorithms

Algorithms

The methods or procedures used to encrypt and decrypt data, and define how the processes are carried out. Examples: AES, RSA, and SHA

Key Length

The number of bits in a cryptographic key, determining how many possible combinations exist and how difficult it is to break via brute force

Trusted Platform Module

A specialized hardware component designed to secure hardware by integrating cryptographic keys into devices, safe guarding the system at the hardware level, can generate keys, and work in junction with disk encryption to keep these keys secure

Hardware Security Module

A physical plugin or cloud computing device that provides secure cryptographic processing, key generation, and storage, encryption, and decryption services

Key Management System

Used to store keys and certificates as well as manage them centrally, allowing organizations to effectively control and manage their secrets while enforcing policies

Secure Enclave

A highly secure space within a device where sensitive data can be stored and cryptographic operations can be performed, isolated from the main OS and processor, shielding it from software attacks and are tamper resistant

Obfuscation

The process of disguising confidential or sensitive data to protect it from unauthorized access

Steganography

The practice of concealing a message, image, or file within another message, image or file

Tokenization

The process of substituting sensitive data with non-sensitive equivalents, known as tokens, that have no extrinsic or exploitable meaning or value, with the primary purpose to safeguard sensitive data while maintaining its usability for certain processes or applications

Masking

The processes of partially redacting sensitive information by replacing some or all sensitive fields with blank characters

Hashing

The process of using a hash function to transform a value in a dataset to a corresponding hash value

Salting

A technique used to enhance the security of stored passwords or other sensitive data, by adding a unique random string of characters, known as salt, to each password before it is hashed

Digital Signature

A cryptographic mechanism that uses asymmetric encryption and hashing to provide authenticity, integrity, and nonrepudiation for digital documents or messages

Key Stretching

A technique used to enhance the security of passwords or other cryptographic keys by transforming a relatively weak key, like a password, into a stronger key that is more resilient by applying a cryptographic hash function to the original key along with additional data, such as salt, repeatedly for many iterations

Blockchain

A decentralized and distributed ledger technology known for its pivotal role in underpinning cryptocurrencies like bitcoin, and is a chain of blocks, where each block contains a list of transactions, and each transaction in the block is secured through cryptographic principles

Open Public Ledger

A decentralized and transparent record-keeping system that is accessible to anyone and provides a permanent record of all transactions or events that have occurred within a network

Certificate

Provides communicating parties with the assurance that they are communicating with the expected party by endorsing copies of an individuals public key, and users can ensure that the certificate was signed by a certificate authority

Certificate Authority

A trusted third party that verifies the identity of a website, user, or device, and issues a digital certificate to establish secure communications

Certificate Revocation List (CRL)

Contains the serial numbers of certifications that have been revoked

Online Certificate Status Protocol

Provides a means for real-time certificate verification; a client sends an OCSP request to the CA’s OCSP server, then the server respond with good, revoked, or unknown, and the browser will use this information to determine whether the certificate is valid

Self-Signed

Digital certificates that are signed by their creator rather than a third party CA and are often used in test environments as they are not inherently trusted by others

Third Party

A digital certificate signed by a third-party CA; the CA verifies the identity of the entity requesting the certificate, ensuring that the entity is who it claims to be, meaning these certificates are highly trusted

Root of Trust

The trust anchor in a PKI system, where the root certificate authority is inherently trusted, and from which the trustworthiness of all other certificates in the network is derived

Certificate Signing Request (CSR)

A request sent to a CA to apply for a digital identity certificate, including information that will be included in the certificate, such as the organization’s name, domain name, locality, country, and the public key

Wildcard

A certificate used in SSL/TLS encryption, typically for securing websites by allowing multiple subdomains of a single domain to be secured with a single certificate