Cryptographic Controls (CISA Domain 5)

Cryptography is one of the few controls that can keep information secret, prove it hasn’t changed, show who sent it and stop the sender denying it. It only works when the whole control works, though. The algorithm is just one piece. Real assurance comes from who owns the keys, how the system is built, how it is watched and how incidents are handled. This course is written from the IS auditor’s point of view: start from the security property the business needs, choose the technique that delivers it, then confirm the full lifecycle and the evidence behind it. It is independently produced exam preparation and staff development material, not affiliated with or endorsed by ISACA, and it does not replace the official review manual. The programme follows five stages from need to evidence. It begins with the four properties cryptography can deliver (confidentiality, integrity, authenticity and nonrepudiation) and why availability has to come from elsewhere. It then works through the techniques: the anatomy of a cryptosystem and its management layer; symmetric encryption with AES in authenticated modes; asymmetric cryptography and which key is used for what; why symmetric keys don’t scale; hybrid encryption, the digital envelope and TLS with forward secrecy; hash functions, approved and retired algorithms, HMACs and digital signatures; and a full sign-then-encrypt flow. Trust at scale is covered through PKI components, certificate validation, the certificate lifecycle and shrinking public TLS lifetimes. Key management runs from creation to verified destruction, with HSMs, dual control and split knowledge, alongside protection for data at rest, data in transit and stored passwords. The recurring question is simple: which property is needed, and can the organisation prove the control delivers it? The final modules cover what goes wrong and how to audit it: typical failures with algorithms, keys, nonces, certificates, randomness and coverage; the cryptographic incident response plan; crypto-agility and the move to NIST’s post-quantum standards; four-tier governance; a five-step audit approach; worked audit tests for governance, inventory, key custody, modules, configuration, lifecycle and monitoring; and the strength of different kinds of evidence. A case study on signed purchase agreements and ten CISA-style practice questions build the habit of identifying the property before reading the options. Assessment is an online 20-question exam at a 70% pass mark, leading to a verifiable SKEDMIA certificate.