Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

DS5.8 - Cryptographic Key Management

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective DS5.8 - Cryptographic Key Management is contained within Process Popup Ensure Systems Security.

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
9 Members
0 Online
2499 Visits

 Recent Discussions

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!


Cryptographic Key Management

Determine that policies and procedures are in place to organise the generation, change, revocation, destruction, distribution, certification, storage, entry, use and archiving of cryptographic keys to ensure the protection of keys against modification and unauthorised disclosure.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Defined and documented key management
  • Keys handled in a secure manner
  • Secure communication
  Risk Drivers
  • Keys misused by unauthorised parties
  • Registration of non-verified users, thus compromising system security
  • Unauthorised access to cryptographic keys

View Control Practices  help

Hide Control Practices  help

  1. Ensure that there are appropriate procedures and practices in place for the generation, storage and renewal of the root key, including dual custody and observation by witnesses.
  2. Make sure that procedures are in place to determine when a root key renewal is required (e.g., the root key is compromised or expired).
  3. Create and maintain a written certification practice statement that describes the practices that have been implemented in the certification authority, registration authority and directory when using a public-key-based encryption system.
  4. Create cryptographic keys in a secure manner. When possible, enable only individuals not involved with the operational use of the keys to create the keys. Verify the credentials of key requestors (e.g., registration authority).
  5. Ensure that cryptographic keys are distributed in a secure manner (e.g., offline mechanisms) and stored securely, that is:
    • In an encrypted form regardless of the storage media used (e.g., write-once disk with encryption)
    • With adequate physical protection (e.g., sealed, dual custody vault) if stored on paper
  6. Create a process that identifies and revokes compromised keys. Notify all stakeholders as soon as possible of the compromised key.
  7. Verify the authenticity of the counterparty before establishing a trusted path.

Discussions: 0 total

Must be a Topic member to contribute

No Results Found

Documents & Publications: 97 total

Events & Online Learning: 9 total

14 May 2012
ISACA International Event
Chicago, IL, USA
29 Oct 2012
ISACA International Event
New York, NY, USA
10 Jun 2013
ISACA International Event
Berlin, Germany
Early bird deadline has been extended: save over US $350 when you register by 1 May. Learn from industry-leading IT experts at Insights 2013. This is a unique opportunity to discover revolutionary new ideas at the world’s premier business event.
16 Sep 2013
ISACA International Event
London, England
Stay on top of the trends and opportunities of the dynamic technology industry at EuroCACS/ISRM 2013 in Berlin—the leading European conference for IT audit, assurance, security and risk professionals. Save over US $200 when you register by 22 July!

Journal Articles: 273 total

Volume 3, 2013
by Dan Bogdanov, Ph.D., and Aivo Kalu, Ph.D., CISA
A cloud is a remote-access platform; thus, technical controls that remotely enforce a particular security policy are especially efficient.
Volume 2, 2013
by Ali Alaswad, ITIL, PMPG, PMP
The advent of the Payment Card Industry Data Security Standard (PCI DSS) resulted in many organizations mandating its use.
Volume 2, 2013
by Steven J. Ross, CISA, CISSP, MBCP
Organizations should never aspire to being standard in any endeavor.
Volume 1, 2013
by Steven J. Ross, CISA, CISSP, MBCP
Emerging cyberattacks against the US’s critical infrastructures are rapidly outstripping the ability of security and risk management professionals to maintain high availability and uptime assurances.
Volume 6, 2012
by Stewart Hayes, Malcolm Shore and Miles Jakeman, Ph.D.
The Internet has a well-earned reputation as a hostile environment, and the growth of organised cybercrime is evidence that there is not enough being done to manage the risk.
Volume 6, 2012
by Steven J. Ross, CISA, CISSP, MBCP
From a purely financial standpoint, what would a widespread cyberattack look like should it be broadly targeted on the economy of an entire nation?

Wikis: 2 total

Blog Posts: 39 total

A recent publication in a local newspaper, indicated that an employee was charged with fraud with regards to claims of insurance payments that were lodged with the company were paid out to people who were not entitled to receive such payments. What po...
Posted By : Paulina.PNI | 1 comments
Grupos de Estudio para Acreditaciones de JUNIO, SEPTIEMBRE Y DICIEMBRE 2013. Para los que esten interesados en la presentación del exámen de certificación CISA y CISM  o para cualquiera que desee comenzar a prepararse para estas o las próximas pruebas, pu...
Posted By : Alexander Osorio | 0 comments
(By: William Darío Ávila Díaz, PhD) Colombia is the first Latin American country to adopt cyberspace strategy to prevent and tackle crime and minimize the risk level of citizens from threats or incidents of cyber nature. This is why they were created th...
Posted By : William733 | 0 comments
(By: William Darío Ávila Díaz, PhD) Situation: [1]On September 21, 2011, the website of the House of Representatives of the Republic of Colombia, was attacked by the "Colectivo Nacional Anonymous", who kept for several hours off duty. The engineers of ...
Posted By : William733 | 0 comments
(By: William Darío Ávila Díaz, PhD) Criminal gangs (also called BACRIM)[1]: Emerging criminal gangs emerge, the process of mobilizing the "Self-defense Forces of Colombia" (AUC), or paramilitaries, which began in 2003. These are the new paramilitary BACR...
Posted By : William733 | 0 comments
(By: William Darío Ávila Díaz, PhD) During the National Forum on National Security and Defence held on August 30, 2011 in Barranquilla, Teatro José Consuegra Higgins, the head of the Joint Chiefs, General Luis Felipe Paredes, spoke about the advances in ...
Posted By : William733 | 0 comments