You're reading from CISA – Certified Information Systems Auditor Study Guide - Second Edition

Product typeBook

Published inJun 2023

PublisherPackt

ISBN-139781803248158

Edition2nd Edition

Concepts

Information Security

Author (1)

Hemang Doshi

Public Key Cryptography and Other Emerging Technologies

This chapter will concentrate on public key cryptography and other important aspects of information asset security and control. An IS auditor is required to have a thorough understanding of the elements of Public Key Infrastructure (PKI). They should also have the ability to evaluate the functioning of public key cryptography and other technologies.

The following topics will be covered in the chapter:

Public key cryptography
Elements of PKI
Cloud computing
Virtualization
Mobile computing
Internet of Things (IoT)

By the end of the chapter, you will understand and be able to evaluate various aspects of PKI and other technologies.

Public Key Cryptography

Public key cryptography primarily comprises two processes: encryption and decryption. Encryption is the process of converting data into unreadable code so it cannot be accessed or read by any unauthorized person. This unreadable data can again be converted into a readable form by the process of decryption. Different types of algorithms are available for encryption and decryption. This section will explain the various aspects of public key cryptography.

First, you need to understand the concept of symmetric and asymmetric encryption and the difference between the two.

Symmetric Encryption versus Asymmetric Encryption

Encryption can be of two types: symmetric encryption or asymmetric encryption. The following table will help you understand the differences between the two terms:

Elements of PKI

PKI is a set of rules and procedures for the creation, management, distribution, storage, and use of digital certificates and public key encryption.

PKI Terminology

Before moving on to discuss the elements of PKI, you should have a basic understanding of the following associated terms:

Digital certificate: A digital certificate is an electronic document used to prove the ownership of a public key. A digital certificate includes information about the key, the owner of the key, and the digital signature of the issuer of the digital certificate. It is also known as a public key certificate.
Certifying Authority (CA): A CA is an entity that issues digital certificates.
Registration Authority (RA): An RA is an entity that verifies user requests for digital signatures and recommends the CA issues them.
Certificate Revocation List (CRL): A CRL is a list of digital certificates that have been revoked and terminated by the CA before their expiry date...

Cloud Computing

Cloud computing is the practice of using remote servers hosted on the internet to store, manage, and process data instead of a local server or a personal computer. Cloud computing simply means the use of computing resources through networks, typically the internet.

With cloud computing, users can access computing resources via the internet from anywhere, for as long as they need, without worrying about the maintenance or management of actual resources.

The following are some characteristics of cloud computing:

It enables organizations to access data or applications from anywhere, anytime, and from almost any device.
It allows organizations to scale IT resources as per business requirements at the optimum cost.
It provides the capability to monitor, control, and report the usage of the resources.

Resources such as storage, processing power, memory, network bandwidth, and Virtual Machines (VMs) can be used through cloud computing.

Cloud...

Virtualization

Virtualization makes it possible to run multiple operating systems simultaneously on a single computer. It refers to the act of creating a virtual (rather than an actual) version of system-related hardware. With the use of virtualization, organizations can increase efficiency and reduce the cost of IT operations. Virtual resources such as the server, desktop, operating system, storage, and networks can be created with the help of virtualization tools.

Some important terms for virtualization are as follows:

Hypervisor: Software or hardware used to create virtual resources.

This is the most important element of virtualization as it aids in the creation of virtual resources.

Host: The original computer.
Guest: Virtual resources created by a hypervisor.

The following are some of the risks of virtualization:

The improper configuration of hypervisors may allow unauthorized access to guests.
Attackers may be able to gain unauthorized...

Mobile Computing

Mobile computing is the use of devices that do not require a physical connection to process, transfer, or store data.

Examples of mobile devices include smartphones, laptops, USB storage devices, digital cameras, and other similar technologies.

The following are some of the controls to reduce the risks related to mobile computing:

Mobile Device Management (MDM) solutions should be used.
Only data and applications that are absolutely necessary for processing should be stored on the device.
Data stored on mobile devices should be backed up regularly to the organization’s server.
All mobile computing devices should be registered for tracking and monitoring control.
Mobile devices that are stationed at a location should be physically locked.

All mobile devices should be installed with anti-malware software.

Strong encryption mechanisms should be used for data stored on mobile devices.

Access control should be enabled for...

Internet of Things (IoT)

IoT is a concept wherein devices have the ability to communicate and transfer data with each other without any human interference. IoT is an emerging concept and is being gradually adopted by organizations.

Although a specific risk of IoT depends on how it is used, an IS auditor should consider the following risks with respect to IoT:

The impact of IoT on the health and safety of human life
Regulatory compliance with respect to the use of IoT
The impact of IoT on user privacy
The impact of IoT on device vulnerabilities

Summary

In this chapter, you learned about relevant skills to conduct audits in accordance with IS audit standards and a risk-based IS audit strategy and to evaluate potential opportunities and threats associated with emerging technologies, regulations, and industry practices.

The following is a recap of some important topics covered in this chapter:

In asymmetric encryption, two keys are used—one for encryption and the other for decryption. Messages encrypted by one key can be decrypted by another key. These two keys are known as private keys and public keys. A private key is available only to the owner of the key and a public key is available in the public domain.
A certifying authority is an entity that issues digital certificates. It is responsible for the issuance and management of digital certificates.
IoT is a concept wherein devices have the ability to communicate and transfer data with each other without any human interference.
Mobile computing...

Chapter Review Questions

Before you proceed to Chapter 12, Security Event Management, it is recommended that you solve the practice questions from this chapter first. These chapter review questions have been carefully crafted to reinforce the knowledge you have gained throughout this chapter. By engaging with these questions, you will solidify your understanding of key topics, identify areas that require further study, and build your confidence before moving on to new concepts in the next chapter.

Note

A few of the questions may not be directly related to the topics in the chapter. They aim to test your general understanding of information systems concepts instead.

The following image shows an example of the practice questions interface.

Figure 11.1: CISA practice questions interface

To access the end-of-chapter questions from this chapter, follow these steps:

Open your web browser and go to https://packt.link/Ud7jH. You will see the following...

The rest of the chapter is locked

You have been reading a chapter from

CISA – Certified Information Systems Auditor Study Guide - Second Edition

Published in: Jun 2023Publisher: PacktISBN-13: 9781803248158

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at €14.99/month. Cancel anytime

Author (1)

Hemang Doshi

Hemang Doshi has more than 15 years of experience in the field of system audit, IT risk and compliance, internal audit, risk management, information security audit, third-party risk management, and operational risk management. He has authored several books for certification such as CISA, CRISC, CISM, DISA, and enterprise risk management.
Read more about Hemang Doshi

Personalised recommendations for you

Based on your interests and search pattern

Attacking and Exploiting Modern Web Applications

Attacking and Exploiting Modern Web Attacks will help you understand how to identify attack surfaces and detect vulnerabilities. This book takes a hands-on approach to implementation and associated methodologies and equips you with the knowledge and skills needed to effectively combat web attacks.

BookAug 2023338 pages

Automotive Cybersecurity Engineering Handbook

This Automotive Cybersecurity Engineering Handbook untangles the complexities of building secure automotive products and helps you to comply with cybersecurity standards. It provides practical tools, tips, and techniques coupled with real-world examples to enable you to create cyber-resilient automotive products with ease.

BookOct 2023392 pages

Official Google Cloud Certified Professional Cloud Security Engineer Exam Guide

This book will help you to design, develop, and operate security controls on Google Cloud as well as discover best practices for relevant security domains, including identity and access management, network, and data.

BookAug 2023496 pages

Cloud Penetration Testing for Red Teamers

The advent of cloud networks and the AWS, Azure, and GCP platforms has revolutionized how companies of all sizes in all industries do business online. This book will help you meet the emerging demand for pentesting as it guides you through the tools, techniques, and security measures used by pentesters and red teamers in the 2020s and beyond.

BookNov 2023298 pages

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide

ISACA Certified in Risk and Information Systems Control (CRISC®) Certification Guide is an enterprise IT risk management professional’s dream. With its in-depth approach and various self-assessment exercises, this book arms you with knowledge of every single aspect of the certification, and is a fantastic career companion after you’re certified.

BookSep 2023316 pages5

Burp Suite Cookbook

Burp Suite is an immensely powerful and popular tool for web application security testing. This book provides a collection of recipes that address vulnerabilities in web applications and APIs. It offers guidance on how to configure Burp Suite, make the most of its tools, and explore into its extensions.

BookOct 2023450 pages

Building and Automating Penetration Testing Labs in the Cloud

This hands-on guide will help you design and build a variety of penetration testing labs that mimic modern cloud environments running on AWS, Azure, and GCP. In addition to these, you will explore a number of practical strategies on how to manage the complexity, cost, and security risks involved when setting up vulnerable cloud lab environments.

BookOct 2023562 pages

Ethical Hacking Workshop

As cyber-attacks grow and APT groups advance their skillset, you need to be able to protect your enterprise against cyber-attacks. In order to limit your attack surface, you need to ensure that you leverage the same skills and tools that an adversary may use to hack your environment and discover the security gaps. This book will teach you how to think like a hacker, use state-of-the-art hacking tools, and protect yourself and your organizaiton.

BookOct 2023220 pages

Windows Forensics Analyst Field Guide

This book contains step-by-step processes to guide you in any investigation related to Windows OS. You’ll find out how to acquire evidence using multiple tools as well as examine and analyze the collected artifacts, while discovering multiple techniques used in real-world forensic incidents.

BookOct 2023318 pages

Implementing DevSecOps Practices

This book is a comprehensive, hands-on guide for individuals new to DevSecOps who want to implement DevSecOps practices successfully and efficiently. With its help, you’ll be able to shift security toward the left, enabling you to merge security into coding in no time.

BookDec 2023258 pages

Symmetric Encryption	Asymmetric Encryption
A single key is used to encrypt...