2.4 Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.
📘CompTIA CySA+ (CS0-003)
Overview
Cryptography is the practice of protecting information by transforming it into a secure format that only authorized parties can access. When cryptography fails, sensitive data (like passwords, credit card info, personal data) can be exposed to attackers. This is often referred to as cryptographic failures.
In an IT environment, cryptographic failures can occur in applications, databases, emails, VPNs, or cloud storage if encryption isn’t implemented properly or is misconfigured.
The CySA+ exam focuses on recognizing cryptographic weaknesses and recommending controls to mitigate them.
Why Cryptographic Failures Are Dangerous
- Data Breaches: Unencrypted or poorly encrypted data can be stolen by attackers.
- Data Integrity Issues: Without proper cryptography, data can be tampered with without detection.
- Unauthorized Access: Weak encryption or bad key management allows attackers to bypass authentication.
- Regulatory Violations: Many industries require encryption (e.g., HIPAA, GDPR). Failing cryptography can lead to compliance fines.
Common Cryptographic Failures
1. Weak or Broken Algorithms
- Using outdated encryption algorithms like MD5, SHA1, or DES.
- These algorithms are vulnerable to attacks and can be cracked easily.
- IT Example: A legacy system storing passwords with MD5 can allow attackers to quickly reverse them.
2. Improper Key Management
- Keys are the “lock and key” of encryption. If they’re poorly managed:
- Stored in plaintext files
- Hardcoded into applications
- Shared over insecure channels
- IT Example: A web application stores its encryption keys in a config file without protection. If an attacker gains access, all encrypted data can be decrypted.
3. Using Predictable Keys or IVs
- Keys or initialization vectors (IVs) that are predictable make encryption easier to break.
- IT Example: Using “123456” as a key for encrypting database backups is insecure.
4. No Encryption or Partial Encryption
- Sometimes sensitive data is stored or transmitted without encryption.
- IT Example: Emails with passwords or confidential reports sent over plain HTTP instead of HTTPS.
5. Misconfigured TLS/SSL
- TLS (Transport Layer Security) is used to protect data in transit.
- Weak configurations include:
- Allowing old TLS versions (like TLS 1.0)
- Using weak cipher suites
- IT Example: A web server accepts TLS 1.0 connections, leaving sessions vulnerable to attacks like POODLE or BEAST.
6. Lack of Integrity Verification
- Encryption without integrity checks (like HMAC or digital signatures) allows data to be modified without detection.
- IT Example: A file stored in the cloud is encrypted but has no signature. An attacker could modify it, and the system would not know.
Mitigation and Controls
1. Use Strong, Industry-Standard Algorithms
- AES (Advanced Encryption Standard) for data at rest
- RSA, ECC for key exchange
- SHA-256 or higher for hashing
- Tip for exam: Always recommend modern, approved algorithms.
2. Implement Proper Key Management
- Use secure storage for keys (HSMs – Hardware Security Modules, key vaults)
- Rotate keys regularly
- Limit key access to authorized personnel only
3. Encrypt Data in Transit
- Use TLS 1.2 or higher
- Ensure strong cipher suites are enforced
- Disable outdated protocols like SSLv3 or TLS 1.0
4. Encrypt Data at Rest
- Database encryption
- Disk encryption (like BitLocker or LUKS)
- File-level encryption for sensitive documents
5. Implement Integrity Checks
- Use HMAC, digital signatures, or checksums to detect tampering
- IT Example: A system verifies digital signatures for software updates to ensure they haven’t been altered.
6. Avoid Hardcoding Secrets
- Never store keys, passwords, or tokens in source code
- Use environment variables or secure secret management systems
7. Regular Security Testing
- Vulnerability scans and penetration tests to check for cryptographic weaknesses
- Review TLS configurations with tools like Qualys SSL Labs
Quick Exam Tips
- Cryptographic failures are also called “sensitive data exposure” in exam objectives.
- Know the difference between data at rest and data in transit.
- Know the difference between weak algorithms, bad key management, and misconfigured TLS/SSL.
- Always link mitigation to controls: e.g., strong algorithms, key management, encryption, integrity checks.
Summary Table – Cryptographic Failures
| Failure Type | Example | Mitigation Control |
|---|---|---|
| Weak Algorithm | MD5 passwords | Use AES, SHA-256, RSA |
| Poor Key Management | Keys in plaintext | HSM, Key Vault, rotate keys |
| No Encryption | HTTP transmission | Use HTTPS/TLS |
| Weak TLS Config | TLS 1.0, weak cipher | TLS 1.2+, strong cipher suites |
| No Integrity Check | File tampering undetected | HMAC, digital signatures |
| Hardcoded Secrets | Keys in code | Environment variables, secret management |
Bottom Line:
Cryptographic failures happen when sensitive data isn’t properly encrypted or protected. For CySA+ exam purposes, focus on identifying weak encryption, bad key management, misconfigured TLS, and lack of integrity checks, and always recommend controls that ensure strong encryption, proper key management, and secure protocols.
