CAS-002 · Question #618
Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly…
The correct answer is D. The company should use the method recommended by other respected information security. Cryptographic security must rely on publicly vetted, standards-based algorithms rather than proprietary or secret methods, regardless of the designer's expertise or credentials.
Question
Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international standards. He has recommended that the company use his cryptographic method. Which of the following methodologies should be adopted?
Options
- AThe company should develop an in-house solution and keep the algorithm a secret.
- BThe company should use the CEO's encryption scheme.
- CThe company should use a mixture of both systems to meet minimum standards.
- DThe company should use the method recommended by other respected information security
How the community answered
(46 responses)- A17% (8)
- B4% (2)
- C7% (3)
- D72% (33)
Why each option
Cryptographic security must rely on publicly vetted, standards-based algorithms rather than proprietary or secret methods, regardless of the designer's expertise or credentials.
Keeping an in-house algorithm secret is 'security through obscurity,' a discredited practice because once the algorithm is reverse-engineered or leaked, all security is immediately compromised.
Using the CEO's unvetted encryption scheme introduces unacceptable risk because without rigorous public cryptanalysis there is no way to confirm the algorithm is free of exploitable weaknesses.
Mixing an unvetted proprietary algorithm with a standard weakens overall security because a hybrid cryptographic system is only as strong as its weakest component.
Kerckhoffs's principle states that a cryptosystem's security should depend only on the secrecy of the key, not the secrecy of the algorithm itself. Respected standards such as NIST-approved algorithms have undergone years of rigorous public cryptanalysis by the global security community, providing an assurance level no individual's unvetted scheme can match. Adopting a recognized standard protects the organization from hidden weaknesses that only extensive peer review can uncover.
Concept tested: Cryptographic standards versus proprietary algorithm security
Source: https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines
Topics
Community Discussion
No community discussion yet for this question.