SSD: Cryptography

Learning Outcomes After the scenario has been completed, you are expected to be able to: Explain the relative strengths of encryption algorithms and the types of attack possibilities Identify and justify the selection of appropriate encryption methods to secure stored sensitive data Explain good practices in relation to key management Minimise the risk to an asset or product through the use of off-the-shelf encryption software Explain the requirements for appropriate standards and practices

Global Company 70 Security Consultants 120,000 Employees

Regulatory Compliance Business Information Systems Information Technology Legal Information Security Fraud Marketing and Branding Telecommunication Engineering Accounts Finance Wholesale Digital (Internet) Retail in store Telephone Sales Company Hierarchy EdgeWise Telecoms

200 million customers Current Customers

Mobile Applications Mobile applications to support… £50,000,000 Drive the Brand into New Markets Sales of Products Customer Account Enquiry

Your Role Identifying Security Tasks Risk Identification Providing General Advice and Guidance Standards Adherence

Information Security Standards

Why am I doing this quiz? Quiz 1: The following quiz will test your knowledge of encryption and the related standards. Quiz 1 Introduction

Quiz 1 Quiz Click the Quiz button to edit this quiz

CEO Interview

Quiz 2: The following quiz will test your continued knowledge on encryption and standards. Why am I doing this quiz? Quiz 2 Introduction

Quiz 2 Quiz Click the Quiz button to edit this quiz

Sensitive Data CCV Passwords and codes (secrets) Bank account name Bank account sort code Bank account number Card number (PAN) Text messages sent by the customer

Task Your task is to write a 2,500 word paper, providing advice, guidance and alternative solutions for the developer to follow whilst creating their mobile applications. The identification of which information should be encrypted and why The identification of which information must not be stored An evaluation of the suitability of the chosen encryption algorithm for the task and where applicable, suggest an alternative An explanation of the attacks that could be leveraged against various cryptographic algorithms

Task Continued Your task is to write a paper, providing advice and guidance for the developer to follow while creating their mobile applications. (2500 words) Identify the tasks required for the secure implementation of cryptography, including: Key storage Key management (rotation, retirement). Suggest alternatives to the developer writing the encryption routine (can this be done by an off the shelf product – for example Oracle or MS SQLServer – if so how?).

Summary After the scenario has been completed, you are expected to be able to: Explained the relative strengths of encryption algorithms and the types of attack possibilities Identified and justified the selection of appropriate encryption methods to secure stored sensitive data Explained good practices in relation to key management Minimised the risk to an asset or product through the use of off-the-shelf encryption software Explained the requirements for appropriate standards and practices