Key Management refers to the generation, distribution, storage, rotation, protection, and destruction of cryptographic keys.
Cryptographic systems (like encryption and digital signatures) rely heavily on keys, so if key management is weak, the whole system is weak.
| Task | Description |
|---|---|
| Key Generation | Creating strong, random keys securely |
| Key Distribution | Securely sending keys to others (e.g., using asymmetric encryption) |
| Key Storage | Storing keys safely (e.g., hardware security modules - HSMs) |
| Key Rotation | Replacing old keys periodically to reduce risk |
| Key Revocation | Disabling compromised or expired keys |
| Key Destruction | Securely erasing keys no longer in use |
Authentication is the process of verifying the identity of a user, system, or device.
| Type | Example |
|---|---|
| Knowledge-based | Passwords, PINs |
| Possession-based | Smart cards, tokens |
| Biometric (inherence) | Fingerprint, face scan |
| Multi-Factor (MFA) | Combination of two or more |
🔐 MFA Example: Password + OTP (One-Time Password) on phone
Access Control is the mechanism used to restrict access to resources (files, systems, data) based on identity and permissions.
It answers the question: “Now that we know who you are, what can you do?”
| Type | Description | Example |
|---|---|---|
| DAC (Discretionary Access Control) | Resource owner sets permissions | Windows file sharing |
| MAC (Mandatory Access Control) | System-enforced labels and policies | Military systems |
| RBAC (Role-Based Access Control) | Access based on roles assigned | Employees grouped as Admin, User, HR |
| ABAC (Attribute-Based Access Control) | Access based on attributes (e.g., job title, time of access) | Dynamic cloud permissions |
| Component | Description |
|---|---|
| Subjects | Users or processes requesting access |
| Objects | Resources like files, databases, or systems |
| Access Rights | Read, write, execute, delete, etc. |
| Concept | What It Does | Example Tools / Use Cases |
|---|---|---|
| Key Management | Handles cryptographic keys securely | PKI, AWS KMS, HSMs |
| Authentication | Verifies identity | Passwords, Biometrics, 2FA |
| Access Control | Defines and enforces permissions | RBAC, ACLs, IAM in cloud platforms |
Open this section to load past papers