- [Instructor] Cryptographic algorithms
and the keys used to secure information
protected by those algorithms
are among the most important components
of any security program.
Cyber security professionals must have a
strong understanding of the cryptographic lifecycle
to better select, maintain,
and eventually decommission the use of algorithms
as the security needs of the organization
and the threat environment change.
As cryptographic algorithms age, they often become insecure,
either because researchers discover flaws
in their implementation,
or because the key length used by the algorithm
becomes vulnerable to brute force attacks.
Therefore, it is important to have a life cycle approach
to cryptography that phases algorithms out
as they become insecure.
The National Institute of Standards and Technology, NIST,
offers a five stage cryptographic lifecycle
that organizations should apply
to any use of cryptography in the enterprise.
Phase one is initiation.
During this phase, the organization realizes
that it needs a new cryptographic system,
and gathers the requirements for that system.
This should include the specific confidentiality,
integrity, and availability objectives of the organization,
based upon the sensitivity of the information
that will be protected.
Here's an example that NIST provides
of what these objectives might look like.
In this example, they include requirements
to protect the integrity of keys,
ensure that authentication, authorization,
and non-repudiation are implemented,
provide 99.5% availability, and use digital signatures
to validate the identity of the signer of a message,
and the integrity of the information
contained in that message.
During phase two, the organization develops,
or more likely acquires, the cryptographic system.
The organization finds an appropriate combination
of software, hardware, algorithms, and keys
that meets their security objectives.
From there, the organization moves to phase three,
implementation and assessment,
where they configure the system for use,
and assess whether it properly meets
the organization's security objectives.
Once the cryptographic system is in use,
the organization transitions to phase four of the lifecycle,
operations and maintenance.
During this phase, the organization ensures the continued
secure operation of the crypto system.
Finally, when the system is no longer viable
for continued long-term use,
the organization transitions into phase five, sunset.
During this last phase,
the organization stops use of the system,
and destroys or archives sensitive material,
such as the keys used with the system.