Page History

...

This chapter provides a top level overview of cryptography and addresses topics from policy on the use of cryptography, key management, symmetric key cryptography to , public key cryptography, various encryption standards and also , as well as various cryptographic libraries. Two sections focus on the two key areas addressed in the ISO document: policy on the use of cryptography and key management.

Overview

In the context of information security, cryptography covers a broad range of topics for securing data. Encryption is the conversion of “cleartext” into “ciphertext”. The reverse process, “ciphertext” to “cleartext”, is referred to as decryption. Applied properly, cryptographic controls provide considerable protection for the confidentiality of data and, when coupled with other related methods, extend integrity and authenticity safeguards for data, both at rest and in transit.    

...

Cryptographic Controls

...

Panel
bgColor #FFFFCE
Objective: Describe considerations for an encryption policy ensuring the protection of information confidentiality, integrity, and authenticity (CIA).

...

Data States and Encryption Methods 

It is important for an organization to categorize information and conduct risk assessments to understand which data requires the most protection. Not all files need to be encrypted. Specific types of data require higher degrees of security like HIPAA, FERPA, and PCI data. Understanding which members of your organization use this sensitive data will maximize the efficiency and effectiveness of implementing an encryption policy. Some organizations require all mobile devices use encryption, while other organizations require only select members use encryption. Your organization must determine the scope and scale of the encryption policy to ensure meeting security requirements.

...

Standards

Top of page

...

Questions or comments? Contact us.

...