10.3 Applied Cryptography and Attacks Flashcards
Encryption can be used to secure portable devices like laptops and cell phones. Most current operating systems use _______ to prevent unauthorized parties from viewing the data on the machine.
disk encryption
Encryption can be used to secure portable devices like laptops and cell phones. Most current operating systems use disk encryption to prevent unauthorized parties from viewing the data on the machine.
Microsoft Windows uses a symmetric disk encryption program called BitLocker.
Macs use a symmetric disk encryption program called FileVault.
True or False
Emails are natively encrypted. They are sent and received in plaintext.
False
Emails are NOT natively encrypted. They are sent and received in plaintext.
Programs like _____ and _____ can apply
public key cryptography to provide email
confidentiality and use digital signatures
to ensure authenticity and integrity.
Programs like S/MIME and PGP can apply public key cryptography to provide email confidentiality and use digital signatures
to ensure authenticity and integrity.
___________ is a protocol
designed to encrypt web traffic.
Secure Socket Layer (SSL) is a protocol
designed to encrypt web traffic.
○ HTTPS actually stands HTTP over SSL.
These certificates use public key cryptography to establish a secure connection between the browser and the server.
A _________ is a cybersecurity professional who captures and investigates digital evidence from computers, cell phones, and other devices containing digital data.
A forensic examiner is a cybersecurity professional who captures and investigates digital evidence from computers, cell phones, and other devices containing digital data.
True or False
Forensic examiners make a hash of
a device when it is initially collected
for investigation.
True
_________ is the cryptographic technique of placing hidden messages
within files, images, or videos.
Steganography is the cryptographic technique of placing hidden messages within files, images, or videos.
_________ are small data files that use public key
cryptography to secure connections between the browser and the web server.
SSL certificates are small data files that use public key cryptography to secure connections between the browser and the web server.
To get an SSL, an organization must first reach out to a ___________ , an organization responsible for issuing SSL certificates.
To get an SSL, an organization must first reach out to a certificate authority (CA), an organization responsible for issuing SSL certificates.
What information does a CA need to get a SSL certificate?
- Company documents
- A unique IP address
- A certificate signing request (CSR), a block of encrypted data that is created on the web server where the SSL certificate will eventually be installed.
When generating the CSR, a _______ and _______ pair are created.
When generating the CSR, a private and public key pair are created.
- Only the public key is sent to the CA.
- The private key remains hidden on the webserver.
SSL certificates validate authenticity using a _______.
SSL certificates validate authenticity using a chain of trust.
Browsers have a pre-established list of trusted CAs, called a _________.
Browsers have a pre-established list of trusted CAs, called a ________.
Root certificate authorities are a list of CAs trusted by your browser. They’re at the top of the trust chain and are typically not the organizations that issue SSL certificates.
Intermediate certificate authorities usually issue certificates and report up to a root certificate authority.
Explain the process of an SSL certificate
- When we access a secure website, the browser asks the web server for certificate details.
- The server responds with a copy of the SSL certificate and the public key.
- The browser validates the certificate by checking the expiration date and root CA.
- The browser uses the server’s public key to create, encrypt, and send a session key.
- The server decrypts the key, sends an acknowledgement, and starts an encrypted session.
- Secure web traffic begins. Server and browser encrypt/decrypt data with the session key.
What does SSL stand for?
Secure Socket Layer
