Cryptographic Controls Study Deck

This kit provides a structured CISA exam-preparation study deck on cryptographic controls. It teaches that the algorithm is only one piece of the control: real assurance comes from who owns the keys, how the system is built, how it is monitored and how incidents are handled. It covers the full lifecycle: requirement, technique, trust, key handling, implementation, monitoring and audit evidence.

What is inside:

Choosing a mechanism: start with the required property, then pick the technique. The four properties are confidentiality, integrity, authenticity and nonrepudiation, and availability is treated separately. Anatomy of a cryptosystem: input, algorithm, key, result and protocol, with a management layer of policy, ownership, monitoring and retirement.

Symmetric and asymmetric cryptography: fast bulk protection versus public/private key pairs, a key-usage table, and the key-count formula n(n-1)/2 (4,950 keys for 100 people versus 100 key pairs). Hybrid encryption (digital envelope): how TLS combines certificate validation, key agreement and symmetric protection, plus forward secrecy. Hashes, HMAC and digital signatures: what each delivers and what it cannot do. A hash cannot prove origin, and HMAC cannot give nonrepudiation. Includes the end-to-end sign-then-encrypt flow. Side-by-side comparison: encryption, hash, HMAC, signature and certificate. PKI and certificates: root and issuing CAs, RA, repository, CRL/OCSP and HSM; the five-step validation checks; and the certificate lifecycle from request to revocation. Key management: create, distribute, store and use, rotate, back up and recover, revoke and destroy, with dual control and split knowledge. Data at rest, data in transit and password storage: device, database, field and application encryption; tokenisation; protection by network layer; and salted adaptive password hashing instead of reversible encryption or fast hashes. Use cases and typical failures: weak algorithms, hard-coded keys, nonce reuse, expired certificates, weak randomness and encryption coverage gaps. Cryptoagility and post-quantum readiness: inventory, assess, plan, pilot and migrate, with the harvest-now-decrypt-later threat. Governance and audit approach: four governance tiers, five audit focus areas (design adequacy, authorisation, implementation, operating effectiveness, response), and an audit test matrix covering governance, inventory, key custody, module assurance, configuration, lifecycle and monitoring. Case study: signed purchase agreements sent to an overseas supplier, with discussion questions. Practice questions: 10 CISA-style questions with a full answer key explaining why each answer is best.

Who it is for: CISA candidates, IS auditors, security and risk professionals, IT governance teams, and staff involved in cryptography, PKI or key management.

How to use it: use it as an exam-prep study guide, an audit checklist, a control-selection quick reference and a team training resource. It helps you identify the required property first, match the right technique, and prove with evidence that the controls work across the entire key and certificate lifecycle.