Cryptography

Cryptography in security work means choosing and operating well-understood mechanisms, not designing new ones. A practitioner decides where data needs protection, picks a scheme that suits the purpose, and then spends most of the effort on the less glamorous questions: where the keys are generated, who may use them, how they are rotated, and what breaks when one expires. The mathematics has been settled by specialists; the failures that reach incident reports tend to lie in how it was deployed.

The vocabulary is small and repays precision. Encryption keeps data confidential and can be undone by whoever holds the right key. Hashing cannot be undone; it produces a fixed-length fingerprint used to detect tampering and to store passwords, ideally with a salt and a deliberately slow function. Digital signatures combine the two ideas to prove who produced something and that nobody has altered it since.

Four decisions behind every deployment

• Symmetric or asymmetric. One shared secret is fast and suits bulk data; a public and private key pair solves the problem of agreeing a secret with a stranger. Real protocols use both, the second to set up the first.
• Algorithm and key length. Choose from current, widely reviewed options and log every place each one is used, so the choice can change when guidance moves.
• Who vouches for a key. Public key infrastructure binds a public key to a name through certificates issued by an authority both sides trust, and withdraws that trust through revocation.
• How keys live and die. Generation, storage in hardware where it matters, rotation, revocation and destruction: the lifecycle auditors examine and outages expose.

What the blueprints test, and the certificate nobody renewed

The CISSP treats cryptography inside Security Architecture and Engineering. Its outline asks candidates to select solutions across symmetric, asymmetric and elliptic-curve methods, with quantum approaches now named alongside them, to manage the cryptographic lifecycle and PKI, and to recognise how ciphers are attacked, from brute force and known plaintext to side channels and timing. Security+ places the subject in its opening domain, General Security Concepts, where a single objective runs from key length and key exchange through hardware security modules, salting and key stretching to certificate authorities, revocation lists and signing requests. Neither exam asks for proofs. The beginner's mistake is to stop thinking at the algorithm. A system can use strong encryption and still fail because the private key sits in a shared folder, because a certificate lapsed and took a service down with it, or because a developer wrapped a sound primitive in a homemade scheme. Most readers first meet all of this through TLS, the protocol behind the padlock in every browser.