Build a cryptographic inventory of your own lab

applied · 75 min · Objective 3.3

Task

Apply objective 3.3: produce the artefact every published migration guidance asks for first, and discover the parts of your own estate whose cryptography you cannot determine.

Steps

  1. Create lab/crypto-inventory.csv with header component,purpose,algorithm,key_size,source_of_truth,confidentiality_years,agility.
  2. Enumerate from several angles: TLS configuration scanned from your own endpoints, certificates in your key store, algorithms named in your crypto standard, libraries from the dependency list, and cloud key-service key specifications.
  3. Set confidentiality_years per component from how long its data must stay secret, and mark every component above ten years.
  4. Set agility to config, code or unknown: could the algorithm be changed by configuration, only by changing code, or can you not tell.
  5. Write lab/crypto-priority.md ordering the estate by confidentiality-lifetime multiplied by exposure, and naming every component whose algorithm you could NOT determine -- that count is the most useful number in the file.

Verify

awk -F, 'NR>1 {n++} END {print n" component(s)"}' lab/crypto-inventory.csv
awk -F, 'NR>1 && $7=="unknown" {n++} END {print n+0" with unknown agility"}' lab/crypto-inventory.csv
awk -F, 'NR>1 && $3=="" {n++} END {print n+0" with undetermined algorithm"}' lab/crypto-inventory.csv
awk -F, 'NR>1 && $6+0>10 {n++} END {print n+0" above ten years"}' lab/crypto-inventory.csv
grep -Ec '[0-9]+' lab/crypto-priority.md

Ten or more components from at least three enumeration angles, with the unknown-agility and undetermined-algorithm counts stated explicitly. Those two counts are the honest measure of how ready the estate is, and both are usually higher than expected.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.