Encryption and PKI

What It Is and Why It Matters

Encryption is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using algorithms and keys, so that only authorized parties can access the original data. Public Key Infrastructure (PKI) is the framework of policies, procedures, hardware, software, and standards that manages digital certificates and public/private key pairs to enable secure communication and authentication.

For the CISA exam, understanding encryption and PKI is essential because these technologies are fundamental to protecting data confidentiality, integrity, and authenticity. Auditors must evaluate whether encryption is properly implemented, whether key management practices are adequate, and whether PKI components are correctly configured and maintained.

Encryption protects data at rest (stored data), data in transit (data moving across networks), and data in use (data being processed). The choice of encryption algorithm, key length, and implementation method depends on the sensitivity of the data, performance requirements, and regulatory obligations.

Key Concepts and Terminology

Symmetric Encryption

Symmetric encryption uses a single shared key for both encryption and decryption. It is fast and efficient, making it suitable for encrypting large volumes of data. The primary challenge is key distribution: both parties must securely share the same key. Common symmetric algorithms include AES (Advanced Encryption Standard, the current standard), 3DES (Triple DES, legacy), and Blowfish.

Asymmetric Encryption

Asymmetric encryption uses a pair of mathematically related keys: a public key (which can be freely shared) and a private key (which must be kept secret). Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. Asymmetric encryption solves the key distribution problem but is computationally slower than symmetric encryption. Common algorithms include RSA, ECC (Elliptic Curve Cryptography), and Diffie-Hellman (for key exchange).

Hashing

Hashing is a one-way function that converts input data into a fixed-length output (hash value or digest). Hashing is used to verify data integrity: if the data changes, the hash value changes. Unlike encryption, hashing is not reversible; you cannot recover the original data from a hash. Common hash algorithms include SHA-256 (part of the SHA-2 family) and SHA-3. MD5 and SHA-1 are considered insecure and should not be used for security purposes.

Digital Signatures

A digital signature is created by hashing a message and then encrypting the hash with the sender's private key. The recipient can verify the signature by decrypting it with the sender's public key and comparing the resulting hash with a freshly computed hash of the received message. Digital signatures provide three assurances: authentication (confirming the sender's identity), integrity (confirming the message was not altered), and non-repudiation (the sender cannot deny having sent the message).

Public Key Infrastructure (PKI)

• Certificate Authority (CA): A trusted entity that issues, manages, and revokes digital certificates. The CA verifies the identity of certificate requestors before issuing certificates.
• Registration Authority (RA): Acts as an intermediary between the user and the CA, handling identity verification and certificate requests on behalf of the CA.
• Digital Certificate: An electronic document that binds a public key to an identity. The most common standard is X.509, which defines the format and contents of digital certificates.
• Certificate Revocation List (CRL): A list published by the CA containing serial numbers of certificates that have been revoked before their expiration date. An alternative is the Online Certificate Status Protocol (OCSP), which allows real-time certificate validity checking.

Key Management

Key management encompasses the generation, distribution, storage, rotation, recovery, and destruction of cryptographic keys. Poor key management can render even the strongest encryption ineffective. Keys must be stored securely (preferably in hardware security modules, or HSMs), rotated periodically, and destroyed when no longer needed.

How This Appears on the CISA Exam

Encryption and PKI questions on the CISA exam commonly test:

• The difference between symmetric and asymmetric encryption and appropriate use cases for each.
• How digital signatures provide authentication, integrity, and non-repudiation.
• The role of each PKI component (CA, RA, certificates, CRL/OCSP).
• Key management best practices, including the consequences of lost or compromised keys.
• The purpose of hashing and how it differs from encryption.

Study Tips

• Remember: symmetric encryption uses one key; asymmetric uses two (public and private).
• Know that digital signatures use the sender's private key to sign and the sender's public key to verify.
• Understand the PKI trust chain: root CA, intermediate CA, and end-entity certificates.
• Focus on key management as a common audit finding; many organizations have weak key management practices.
• Be able to distinguish between confidentiality (encryption), integrity (hashing), and authentication (digital signatures).

Related Subtopics

• TLS/SSL and secure communications
• VPN technologies and encryption
• Data encryption at rest and in transit
• Hardware security modules (HSMs)
• Tokenization as an alternative to encryption
• Quantum computing implications for cryptography