An auditor asks whether the city can explain how brute-force, man-in-the-middle, and side-channel attacks threaten its deployed cryptography. What is the best demonstration of that understanding?
Select an answer to reveal the explanation.
Short Explanation
Auditors want you to name the monster and the fence. Brute force hammers keys, MITM sits in the middle of sessions, side channels peek at timing or power—and each needs different defenses. Hand-waving that “AES fixes everything” will not pass.
Full Explanation
Demonstrating cryptanalytic literacy means mapping attack classes to concrete municipal risks and matching controls. Brute-force threats target exhaustive key or credential search—mitigated by adequate key lengths, rate limiting, and monitoring. Man-in-the-middle threats intercept or alter sessions lacking strong authentication and integrity—mitigated by proper TLS, certificate validation, and secure channels. Side-channel threats leak secrets through timing, power, cache, or electromagnetic observation—mitigated by constant-time implementations, physical protections, and hardened devices where exposure exists. Showing that triad with deployment-specific examples proves understanding beyond naming popular ciphers.
Claiming any AES deployment is immune to all three classes is false: AES can still be undermined by short keys in wrapping layers, broken protocols, poor authentication, or leaky implementations. Dismissing cryptanalytic categories as academic while elevating only phishing ignores how network and crypto failures enable real breaches. Replacing cryptography with port obscurity abandons confidentiality and integrity controls entirely.
Exam caveat: CISSP expects awareness of cryptanalytic and related methods—not only algorithm selection. Attack-class mapping is the competency auditors look for.
Operational check: document for each major crypto use (VPN, TLS portals, HSMs, smart cards) which brute-force, MITM, and side-channel risks apply; list compensating controls; include findings in architecture reviews and penetration-test scopes; retest after library or hardware changes.