Exam questions Flashcards
Name an obsolete protocol used for secure data transfer over the web
SHTTP (Secure Hypertext Transfer Protocol). It differs from HTTPS as it secures individual messages, while HTTPS creates a secure connection for all transmitted data.
Name a deprecated TLS-based method for the secure transmission of email messages
SMTPS. SMTPS (implicit SSL) is not generally considered deprecated, but its use is increasingly replaced by SMTP+STARTTLS (explicit SSL) for improved security. While SMTPS continues to function on port 465, the primary reason for the shift is that SMTP+STARTTLS allows for a more flexible and secure encryption negotiation, especially when dealing with diverse network environments and older clients.
Define GPG and PGP
PGP stands for Pretty Good Privacy and GPG stands for GNU Privacy Guard. Both are encryption systems used to secure emails and files. PGP was originally a proprietary software, while GPG is an open-source implementation of the OpenPGP standard. They are essentially the same, differing mainly in their licensing and the availability of features.
Define EFS in MS Windows
EFS, or Encrypting File System, is a feature in MS Windows that encrypts files and folders, or an entire storage device, making them unreadable without the correct decryption key. It provides an additional layer of security, ensuring that only authorized users can access encrypted data. EFS encrypts files using a symmetric encryption algorithm and a public-private key pair, with the user’s password or account credentials being the key to accessing the encrypted file.
Define SED
A Self-Encrypting Drive (SED) is a storage device, like a hard disk or solid-state drive, that automatically encrypts and decrypts data within the device itself, without the need for external software or user intervention. This means that all data written to the drive is encrypted before being stored, and decrypted when read, ensuring data protection even if the drive is physically compromised.
Define Key Escrow
Key escrow allows encryption keys to be stored with a trusted third party so that data can be recovered if the original key is lost. A Recovery Agent (RA) is one possible way to implement key escrow, but not the only way—other methods and systems exist.
Different models exist for key escrow:
Institutional key escrow: where an organization controls access internally.
Government-mandated key escrow: where the government holds access.
Third-party escrow providers: who may or may not involve human RAs.
