Encryption Fundamentals: Symmetric and Asymmetric
Learn encryption fundamentals including symmetric and asymmetric algorithms, use cases, and audit evaluation criteria for CISA exam preparation.
Why Encryption Matters
Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using mathematical algorithms and keys. For CISA candidates, understanding encryption is fundamental because it is a primary control for protecting data confidentiality and integrity. Auditors must evaluate whether encryption is appropriately applied to protect sensitive data at rest, in transit, and during processing.
Encryption supports compliance with regulations such as GDPR, HIPAA, and PCI DSS, which mandate protection of specific data types. Without proper encryption, organizations face increased risk of data breaches and regulatory penalties.
Symmetric Encryption
Symmetric encryption uses the same key for both encryption and decryption. This approach is fast and efficient, making it suitable for encrypting large volumes of data. Key characteristics include:
- Speed: Significantly faster than asymmetric encryption, suitable for bulk data encryption
- Key management challenge: The encryption key must be securely shared between sender and receiver
- Scalability limitation: The number of required keys grows rapidly as the number of communicating parties increases
Common Symmetric Algorithms
- AES (Advanced Encryption Standard): The current standard, supporting 128, 192, and 256-bit key lengths. Widely used for data-at-rest encryption, VPNs, and TLS
- 3DES (Triple DES): An older algorithm that applies DES three times. Being phased out in favor of AES
- ChaCha20: A modern stream cipher used in TLS and mobile applications where hardware AES acceleration is unavailable
Asymmetric Encryption
Asymmetric encryption uses a pair of mathematically related keys: a public key for encryption and a private key for decryption. This approach solves the key distribution problem inherent in symmetric encryption. Key characteristics include:
- Key pair relationship: Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa
- Digital signatures: The private key can create signatures that the public key can verify, providing authentication and non-repudiation
- Performance: Significantly slower than symmetric encryption, typically used for small data items or key exchange
Common Asymmetric Algorithms
- RSA: Widely used for digital signatures and key exchange. Key lengths of 2048 bits or greater are recommended
- Elliptic Curve Cryptography (ECC): Provides equivalent security to RSA with shorter key lengths, improving performance
- Diffie-Hellman: A key exchange protocol that allows two parties to establish a shared secret over an insecure channel
Hybrid Encryption
In practice, symmetric and asymmetric encryption are used together in hybrid approaches. For example, TLS/SSL uses asymmetric encryption to exchange a symmetric session key, which is then used for efficient bulk data encryption. This combines the key distribution advantages of asymmetric encryption with the performance of symmetric encryption.
Audit Considerations
IS auditors evaluating encryption should verify that encryption algorithms and key lengths meet current industry standards (avoiding deprecated algorithms), assess key management practices (generation, distribution, storage, rotation, and destruction), confirm that data classified as sensitive is encrypted both at rest and in transit, evaluate whether encryption is properly implemented (correct modes of operation, proper initialization vectors), and review certificate management practices for asymmetric encryption. Auditors should be aware that encryption is only as strong as its key management; poorly managed keys can render encryption ineffective.