CYB_300_5-2_Milestone_Joshua_Minnick
docx
keyboard_arrow_up
School
Southern New Hampshire University *
*We aren’t endorsed by this school
Course
300
Subject
Information Systems
Date
Dec 6, 2023
Type
docx
Pages
3
Uploaded by CommodoreWombatMaster597
CYB 300 Milestone Three Worksheet
I.
Security Analysis Table
1
Security Analysis Table
Fundamental Security Design Principles
Describe how the FSDPs relate to PKI (2–3
sentences)
Describe how the FSDPs relate to the CIA
triad (2–3 sentences)
Isolation
PKI relates to Isolation through the
process of authentication. Authentication
utilizes unique keys for each user to verify
their identity. This achieves isolation by
isolating each user from systems or data
until their identity is verified.
Isolation through PKI relates to
Confidentiality and Availability.
Confidentiality because data is kept from
unauthorized users until authentication is
completed. Availability because data is
available for all authorized users.
Modularity
PKI relates to modularity because it is
completed in small individual steps by
creating keys, sending keys, verifying
identities using these keys, and then
allowing data access or transfer.
Modularity through PKI relates to
Availability. PKI working in a modular way
means accessibility is maintained even
when multiple users are requesting access
at the same time. Multiple users can be
granted access at the same time.
Minimization of Implementation
PKI relates to Minimization of
Implementation with a unique certificate
issued by a certificate authority.
Certificates are unique for each individual
user guaranteeing the user’s identity.
Minimization of Implementation through
PKI relates to Integrity. This FSDP
guarantees the integrity of information
because certificates can be traced back to
the unique user guaranteeing data can
only be changed by authorized users.
Layering
Layering relates to PKI through the ability
to issue, authenticate, and revoke
certificates as needed. Because
certificates can be authenticated during
each request for access and can be
revoked as needed, a layered security
profile is created.
Layering through PKI relates to Integrity.
The integrity of information is protected
by the ability to authenticate and revoke
certificates when needed. Because
certificates can be revoked when needed,
the integrity of the data encrypted is
guaranteed.
2
II.
Scenario-Based Short Response Questions
A.
Temporary Contractor
: The use of CAs as part of PKI provides a mechanism for key management and secure
communications. If you were asked to provide access to information systems to a temporary contractor, what areas of
a PKI and CIA triad would you be concerned with? Which of the FSDPs most applies here?
The area of PKI I would be most concerned with is having certificates that only authorize the contractor access to
information they have been specifically granted access to and the ability to revoke any certificates issued immediately
upon them leaving this role. The area of the CIA triad I would be most concerned with is confidentiality because a
temporary contractor by nature is going to be leaving for another role at some point and I would want to guarantee the
confidentiality of any information I have not specifically approved for them to access. The FSDPs I would be most
concerned with would be isolation and fail secure. I would want to ensure isolation because the nature of a temporary
contractor is their work will be short-term and therefore, I would not want them to have access to data outside of the
area they are working within. I would want a temporary contractor to be restricted from access to any data outside of the
data they can show an explicit need to access which is discussed within the FSDP of fail secure.
B.
Cryptography
: As part of PKI, a cryptographic system is established. Explain how cryptography is used and what forms
of implementation can be accomplished.
Cryptography is used to make data unreadable to anyone not authorized to view or share that data. This is done using
encryption and decryption keys which protect the data while in transit and can be implemented to protect data while at
rest. Cryptography is used to ensure the CIA triad is fully accomplished. Implementation of cryptography can be done with
many different methods. The most common implementations use symmetric or asymmetric encryption, both of which are
accomplished using mathematical algorithms to create keys that are then used to encrypt and decrypt data as needed.
3
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help