Chương 3 / 520% của kỳ thi
Implementation: Cryptography, Identity, and Secure Protocols
This chapter explains the building blocks used to protect data and control access. You will learn symmetric and asymmetric cryptography, public key infrastructure, identity and access management, and secure protocols. These technologies enforce confidentiality, integrity, and authentication across systems.
Cryptography Fundamentals
Cryptography protects data in transit and at rest and underlies authentication and integrity. Choosing the right primitive depends on whether you need secrecy, integrity, or proof of origin.
Symmetric encryption
Uses one shared key for encrypt and decrypt, such as AES; fast but requires secure key distribution.
Asymmetric encryption
Uses a public and private key pair, solving key distribution; RSA and elliptic curve are common.
Hashing
Produces a fixed-length, irreversible digest to verify integrity; SHA-256 is widely used.
Salting
Adds a unique random value to each password before hashing to defeat rainbow tables.
Digital signatures
Encrypt a hash with the private key to provide integrity, authentication, and non-repudiation.
Public Key Infrastructure
PKI manages the certificates and keys that make asymmetric cryptography trustworthy at scale. It binds public keys to verified identities so parties can trust one another.
Certificate authority
Issues and signs certificates, vouching for the identity bound to a public key.
Registration authority
Verifies identity before the CA issues a certificate, offloading vetting from the CA.
Revocation
CRLs and OCSP let clients check whether a certificate has been revoked before trusting it.
Certificate chain
Trust flows from a trusted root through intermediates to the end-entity certificate.
Key management
Protect private keys with HSMs and secure storage; a compromised key undermines trust.
Identity and Access Management
IAM ensures the right people get the right access and nothing more. Strong authentication and well-chosen access models are central to preventing unauthorized use.
Authentication factors
Combine categories such as something you know, have, and are for multifactor authentication.
Multifactor authentication
Requires two or more independent factors, greatly reducing risk from a stolen password.
Access control models
RBAC assigns access by role, MAC uses labels and clearances, and DAC lets owners decide.
Single sign-on and federation
SAML and similar standards let users authenticate once across many applications.
Privileged access
Tightly control and monitor administrative accounts, which are prime targets.
Secure Protocols and Hardware
Secure protocols protect data as it moves, and trusted hardware protects keys and boot integrity. Replacing legacy plaintext protocols is a fundamental hardening step.
SSH
Encrypts remote administration, replacing plaintext Telnet and protecting credentials in transit.
HTTPS and TLS
Encrypt web traffic and authenticate servers; use modern TLS versions and strong ciphers.
SFTP and VPN
SFTP secures file transfer over SSH; VPNs build encrypted tunnels over untrusted networks.
TPM
An on-board chip stores keys and supports disk encryption and secure boot bound to the hardware.
HSM
A tamper-resistant device generates and stores keys and performs crypto operations securely.
Kiểm tra kiến thức của bạn
Câu hỏi luyện tập về Implementation: Cryptography, Identity, and Secure Protocols