Chapter 24 — Cryptography and trust services: controls

Chapter 24 — Cryptography and trust services: controls

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 Selecting controls"]
  N2["24.2 Separation and dual control"]
  N3["24.3 Documenting for audit"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 Selecting controls"]
  N2["24.2 Separation and dual control"]
  N3["24.3 Documenting for audit"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 Selecting controls]
    |
    v
[24.2 Separation and dual control]
    |
    v
[24.3 Documenting for audit]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) select controls for key management; (2) apply separation of duties and dual control; (3) document controls for audit.

24.1 Selecting controls

Priya selects key-management controls for Tidewell based on SP 800-57: keys generated in the key service, never by individuals; access to keys limited by role; rotation on schedule; revocation procedures; and secure destruction when keys retire. For each control she lists its purpose, owner and evidence, such as logs or tickets. She prioritises controls for the highest-value keys, the internal authority and backup keys, rather than applying every control everywhere. She explains that spreading effort evenly would leave the most valuable keys no better protected than trivial ones.

24.2 Separation and dual control

Separation of duties means no single person can complete a sensitive action alone; dual control means two people must act together. Priya applies both: restoring backup keys requires two administrators; the person who approves certificate requests cannot also issue them; and audit logs are reviewed by someone outside the IT team. These controls protect against both mistakes and insiders, and they protect honest staff by making it clear they could not have acted alone. She documents each control in the access policy.

24.3 Documenting for audit

Priya writes a control register: control, risk addressed, owner, frequency and evidence location. When the consortium's auditors visit, they sample the register: they ask for evidence of last quarter's backup-key test and the approval records for three certificates. Two items are missing because evidence was kept in personal email. Priya moves evidence storage to a shared, access-controlled location. Documentation is what lets an organisation prove its controls operate, not just claim them. Grace adds a reminder to the quarterly checklist to confirm that evidence is stored correctly.

Worked example

Priya builds a control register with dual control for backup keys and separation for certificate approval, and fixes evidence kept in personal email after an audit sample.

Synthetic case. The controls and audit are invented; SP 800-57 is real.

Errors and limits

Controls without evidence fail audits. Dual control erodes if staff share credentials to save time.

Exercises

• EX070 — Priority keys. Which keys did Priya prioritise for controls? Rubric: 3 = the internal authority and backup keys;; 2 = one;; 1 = all equally;; 0 = none.
• EX071 — Dual control example. Give one dual control Priya applied. Rubric: 3 = restoring backup keys requires two administrators;; 2 = example;; 1 = vague;; 0 = none.
• EX072 — Audit gap. What audit gap was found and how was it fixed? Rubric: 3 = evidence in personal email; moved to shared access-controlled storage;; 2 = gap;; 1 = vague;; 0 = none.

Synthesis

Prioritised key-management controls with separation, dual control and documented evidence make trust services auditable.

Continue studying — chapter 24 of 40

← Chapter 23 (draft) · Course chapter index · Chapter 25 (draft) →