Auditing Cryptography: Assessing System Security

Steve Stanek 78.1 Assessing Risk ..................................................................... 1023 78.2 Encryption’s Number-One Problem: Keeping Keys Secret........................................................................... 1024 78.3 Encryption’s Number-One Rule........................................ 1024 78.4 Remember to Encrypt E-Mail ........................................... 1025 Does the Vendor Have Credibility in Security Circles? † Does the Product Use Well-Known Cryptographic Algorithms? † Does the Product Use SSL v3.0? † Does the Company Report and Post Bug Fixes for Security Weaknesses? † Does the Product Use an Accepted Random Number Generator to Create Keys? † Does the Product Allow for Easy Integration of Hardware Tokens to Store Keys? † Has the Product Received a Federal Information Processing Standards (FIPS) 140-1 Verification?