{"id":91,"date":"2022-04-12T02:46:13","date_gmt":"2022-04-12T02:46:13","guid":{"rendered":"http:\/\/tcm.gov.to\/?page_id=91"},"modified":"2022-04-29T01:40:17","modified_gmt":"2022-04-29T01:40:17","slug":"cryptography","status":"publish","type":"page","link":"https:\/\/tcm.gov.to\/?page_id=91","title":{"rendered":"Cryptography"},"content":{"rendered":"<div id=\"themify_builder_content-91\" data-postid=\"91\" class=\"themify_builder_content themify_builder_content-91 themify_builder\">\n    \t<!-- module_row -->\n\t<div   class=\"themify_builder_row module_row clearfix module_row_0 themify_builder_91_row module_row_91-0 tb_7uz7318\">\n\t    \t    <div class=\"row_inner col_align_top\" >\n\t\t\t<div  class=\"module_column tb-column col-full first tb_91_column module_column_0 module_column_91-0-0 tb_m9mt319\">\n\t    \t    \t        <div class=\"tb-column-inner\">\n\t\t    \t<div  class=\"themify_builder_sub_row module_subrow clearfix sub_row_0-0-0 tb_etkj27\">\n\t    \t    <div class=\"subrow_inner col_align_top\" >\n\t\t\t<div style=\"width:19%;\" class=\"sub_column module_column col3-1 first sub_column_post_91 sub_column_0-0-0-0 tb_smso28\"> \n\t    \t    \t        <div class=\"tb-column-inner\">\n\t\t    <!-- module text -->\n<div  class=\"module module-text tb_k640996    \">\n            <div  class=\"tb_text_wrap\">\n    <h4 class=\"u-text u-text-body-color u-text-1\">5.\u00a0Cryptography<\/h4>    <\/div>\n<\/div>\n<!-- \/module text -->\n\t        <\/div>\n\t    \t<\/div>\n\t\t<div style=\"width:24%;\" class=\"sub_column module_column col3-1 middle sub_column_post_91 sub_column_0-0-0-1 tb_lgxb28\"> \n\t    \t    \t        <div class=\"tb-column-inner\">\n\t\t    <!-- module text -->\n<div  class=\"module module-text tb_udlw123    \">\n            <div  class=\"tb_text_wrap\">\n    <h4 class=\"u-text u-text-body-color u-text-2\"><b>5.1 Cryptographic controls<\/b>\u00a0\u00a0<\/h4>    <\/div>\n<\/div>\n<!-- \/module text -->\n\t        <\/div>\n\t    \t<\/div>\n\t\t<div style=\"width:50.6%;\" class=\"sub_column module_column col3-1 last sub_column_post_91 sub_column_0-0-0-2 tb_3kxk29\"> \n\t    \t    \t        <div class=\"tb-column-inner\">\n\t\t    <!-- module text -->\n<div  class=\"module module-text tb_flog515    \">\n            <div  class=\"tb_text_wrap\">\n    <h4 class=\"u-text u-text-black u-text-3\"><b>5.1.1 Policy on the use of cryptographic controls<\/b>\u00a0 \u00a0\u00a0<\/h4>\n<p><em><span class=\"u-text-palette-1-base\">A policy on the use of cryptographic controls for protection of information should be developed and implemented.\u00a0\u00a0<\/span><\/em><\/p>\n<ul class=\"u-text u-text-4\">\n<li>Consider the following when developing a cryptographic policy:<br \/>a) the management approach towards the use of cryptographic controls across the organization, including the general principles under which business information should be protected;<br \/>b) based on a risk assessment, the required level of protection should be identified taking into account the type, strength and quality of the encryption algorithm required;<br \/>c) the use of encryption for protection of information transported by mobile or removable media devices or across communication lines;<br \/>d) the approach to key management, including methods to deal with the protection of cryptographic keys and the recovery of encrypted information in the case of lost, compromised or damaged keys;<br \/>e) roles and responsibilities, e.g. who is responsible for the implementation of the policy and the key management, including key generation.<\/li>\n<\/ul>\n<h4 class=\"u-text u-text-5\"><b>5.1.2 Key management<\/b>\u00a0\u00a0\u00a0<\/h4>\n<p><em><span class=\"u-text-palette-1-base\">A policy on the use, protection and lifetime of cryptographic keys should be developed and implemented through their whole lifecycle.<\/span><\/em><\/p>\n<ul class=\"u-text u-text-6\">\n<li>Develop a policy that includes requirements for managing cryptographic keys though their whole lifecycle including generating, storing, archiving, retrieving, distributing, retiring and destroying keys.\u00a0<\/li>\n<li>Select cryptographic algorithms, key lengths and usage practices according to best practice.\u00a0<\/li>\n<li>Protect all cryptographic keys against modification and loss. In addition, secret and private keys need protection against unauthorized use as well as disclosure.\u00a0<\/li>\n<li>Protect physically the equipment used to generate, store and archive keys.\u00a0<\/li>\n<li>Implement a key management system based on an agreed set of standards, procedures and secure methods for:\u00a0<br \/>a) generating keys for different cryptographic systems and different applications;<br \/>b) issuing and obtaining public key certificates;<br \/>c) distributing keys to intended entities, including how keys should be activated when received;<br \/>d) storing keys, including how authorized users obtain access to keys;<br \/>e) changing or updating keys including rules on when keys should be changed and how this will be done;<br \/>f) dealing with compromised keys;<br \/>g) revoking keys including how keys should be withdrawn or deactivated, e.g. when keys have been compromised or when a user leaves an organization (in which case keys should also be archived);<br \/>h) recovering keys that are lost or corrupted;<br \/>i) backing up or archiving keys;<br \/>j) destroying keys;<br \/>k) logging and auditing of key management related activities.<\/li>\n<li>In order to reduce the likelihood of improper use, define activation and deactivation dates for keys so that the keys can only be used for the period of time defined in the associated key management policy.<\/li>\n<\/ul>    <\/div>\n<\/div>\n<!-- \/module text -->\n\t        <\/div>\n\t    \t<\/div>\n\t\t    <\/div>\n\t<\/div><!-- \/themify_builder_sub_row -->\n\t\t        <\/div>\n\t    \t<\/div>\n\t\t    <\/div>\n\t    <!-- \/row_inner -->\n\t<\/div>\n\t<!-- \/module_row -->\n\t<\/div>\n\n\n","protected":false},"excerpt":{"rendered":"<p>5.\u00a0Cryptography 5.1 Cryptographic controls\u00a0\u00a0 5.1.1 Policy on the use of cryptographic controls\u00a0 \u00a0\u00a0 A policy on the use of cryptographic controls for protection of information should be developed and implemented.\u00a0\u00a0 Consider the following when developing a cryptographic policy:a) the management approach towards the use of cryptographic controls across the organization, including the general principles under [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-91","page","type-page","status-publish","hentry","has-post-title","has-post-date","has-post-category","has-post-tag","has-post-comment","has-post-author",""],"builder_content":"<h4>5.\u00a0Cryptography<\/h4>\n<h4><b>5.1 Cryptographic controls<\/b>\u00a0\u00a0<\/h4>\n<h4><b>5.1.1 Policy on the use of cryptographic controls<\/b>\u00a0 \u00a0\u00a0<\/h4> <p><em>A policy on the use of cryptographic controls for protection of information should be developed and implemented.\u00a0\u00a0<\/em><\/p> <ul> <li>Consider the following when developing a cryptographic policy:<br \/>a) the management approach towards the use of cryptographic controls across the organization, including the general principles under which business information should be protected;<br \/>b) based on a risk assessment, the required level of protection should be identified taking into account the type, strength and quality of the encryption algorithm required;<br \/>c) the use of encryption for protection of information transported by mobile or removable media devices or across communication lines;<br \/>d) the approach to key management, including methods to deal with the protection of cryptographic keys and the recovery of encrypted information in the case of lost, compromised or damaged keys;<br \/>e) roles and responsibilities, e.g. who is responsible for the implementation of the policy and the key management, including key generation.<\/li> <\/ul> <h4><b>5.1.2 Key management<\/b>\u00a0\u00a0\u00a0<\/h4> <p><em>A policy on the use, protection and lifetime of cryptographic keys should be developed and implemented through their whole lifecycle.<\/em><\/p> <ul> <li>Develop a policy that includes requirements for managing cryptographic keys though their whole lifecycle including generating, storing, archiving, retrieving, distributing, retiring and destroying keys.\u00a0<\/li> <li>Select cryptographic algorithms, key lengths and usage practices according to best practice.\u00a0<\/li> <li>Protect all cryptographic keys against modification and loss. In addition, secret and private keys need protection against unauthorized use as well as disclosure.\u00a0<\/li> <li>Protect physically the equipment used to generate, store and archive keys.\u00a0<\/li> <li>Implement a key management system based on an agreed set of standards, procedures and secure methods for:\u00a0<br \/>a) generating keys for different cryptographic systems and different applications;<br \/>b) issuing and obtaining public key certificates;<br \/>c) distributing keys to intended entities, including how keys should be activated when received;<br \/>d) storing keys, including how authorized users obtain access to keys;<br \/>e) changing or updating keys including rules on when keys should be changed and how this will be done;<br \/>f) dealing with compromised keys;<br \/>g) revoking keys including how keys should be withdrawn or deactivated, e.g. when keys have been compromised or when a user leaves an organization (in which case keys should also be archived);<br \/>h) recovering keys that are lost or corrupted;<br \/>i) backing up or archiving keys;<br \/>j) destroying keys;<br \/>k) logging and auditing of key management related activities.<\/li> <li>In order to reduce the likelihood of improper use, define activation and deactivation dates for keys so that the keys can only be used for the period of time defined in the associated key management policy.<\/li> <\/ul>","_links":{"self":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/91","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=91"}],"version-history":[{"count":5,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/91\/revisions"}],"predecessor-version":[{"id":262,"href":"https:\/\/tcm.gov.to\/index.php?rest_route=\/wp\/v2\/pages\/91\/revisions\/262"}],"wp:attachment":[{"href":"https:\/\/tcm.gov.to\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=91"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}