Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Cyber Wiki Topic 11

Cryptography & Data Protection

Encryption, hashing, keys, certificates, signatures, data lifecycle, and cryptographic change.

Topic Directory

61 entries

All wiki topics
AI data security · Intermediate

AI Data Lifecycle Security

AI data lifecycle security protects information during collection, labeling, storage, use, sharing, retention, and deletion.

AI supply-chain security · Advanced

AI Model Artifact Signing

AI model artifact signing uses cryptographic identity and provenance to verify the origin and integrity of models, adapters, prompts, and supporting files.

Cryptography and trust concept · Intermediate

Advanced Encryption Standard (AES)

Advanced Encryption Standard (AES) is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Endpoint data-protection control · Intermediate

BitLocker Drive Encryption

BitLocker is a Windows full-volume encryption capability that protects data at rest by binding volume keys to trusted startup conditions, recovery methods, and optional user authentication.

Cryptography and trust concept · Intermediate

Certificate Chain Validation

Certificate Chain Validation is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Certificate Revocation Lists and OCSP

Certificate Revocation Lists and OCSP is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Certificate Signing Requests

Certificate Signing Requests is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cloud cryptographic practice · Advanced

Cloud Key-Use Governance

Cloud key-use governance defines who and what may use encryption keys, for which operations, under what conditions, with what logging, and through which approval and recovery processes.

NIST CSF Subcategory profile · Intermediate

Create, Protect, Maintain, and Test Backups (PR.DS-11) — NIST CSF 2.0 Subcategory

Apply PR.DS-11 to achieve this CSF 2.0 outcome: Backups of data are created, protected, maintained, and tested.

Engineering capability · Advanced

Cryptographic Agility

Cryptographic agility is the ability to inventory, evaluate, replace, and validate cryptographic mechanisms without emergency redesign of every dependent system.

Architecture practice · Advanced

Cryptographic Architecture

Cryptographic architecture defines where and why cryptography is used, how keys and trust anchors are managed, and how algorithms and implementations change over time.

Cryptography and trust concept · Intermediate

Cryptographic Hash Functions

Cryptographic Hash Functions is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptographic control practice · Advanced

Cryptographic Key Management

Cryptographic key management governs key generation, registration, distribution, storage, use, rotation, backup, recovery, revocation, archival, and destruction.

Data governance practice · Beginner

Data Classification

Data classification assigns meaningful categories to information so protection, access, retention, sharing, monitoring, and disposal can be aligned with risk.

Data protection practice · Intermediate

Data Labeling and Security Tags

Data labeling and security tags attach machine-usable and human-readable handling context to information so access, movement, retention, and monitoring controls can act consistently.

Data governance concept · Beginner

Data Lifecycle

The data lifecycle follows information through creation or collection, use, sharing, storage, archival, retention, and secure disposal.

Data protection · Intermediate

Data Masking and Tokenization

Data masking and tokenization replace or transform sensitive values so systems and users can work with lower-exposure representations.

Data assurance · Intermediate

Data Migration Integrity

Data migration integrity verifies that transferred files, databases, metadata, permissions, ownership, timestamps, and records remain complete, accurate, authorized, and recoverable across platforms.

NIST CSF Category profile · Intermediate

Data Security (PR.DS) — NIST CSF 2.0 Category

Use PR.DS to manage data at rest, in transit, and in use, plus protected and tested backups within the Protect Function.

Database protection · Advanced

Database Encryption and Key Management

Database encryption and key management protect database files, backups, fields, and network connections while governing the keys that enable access.

Database security · Advanced

Database Replication Security

Database replication security protects the identities, channels, privileges, integrity, and operational controls used to copy data between database nodes or services.

Privacy engineering · Advanced

Differential Privacy Deployment

Differential privacy deployment uses a quantified privacy-loss model, controlled query or release mechanisms, and implementation safeguards to limit what outputs reveal about individuals.

Cryptography and trust concept · Intermediate

Diffie-Hellman Key Exchange

Diffie-Hellman Key Exchange is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Digital Signatures

Digital Signatures is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptographic control · Intermediate

Digital Signatures and Non-Repudiation

Digital signatures use asymmetric cryptography to support message integrity, signer authentication, and evidence that an action came from a particular key holder.

Cryptography and trust concept · Intermediate

Elliptic Curve Cryptography

Elliptic Curve Cryptography is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

ATT&CK mitigation profile · Intermediate

Encrypt Sensitive Information (M1041)

Protect sensitive information from unauthorized disclosure by applying appropriate encryption in storage, transit, processing, and backup contexts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Technology overview · Beginner

Encryption, Hashing, and Digital Certificates

Encryption protects confidentiality, hashing produces fixed-length representations for integrity and comparison, and certificates bind public keys to identities or services.

Software authenticity control · Advanced

Firmware Signing

Firmware signing uses protected private keys and verified metadata to let a bootloader, device, installer, or update service determine that firmware was authorized by the product owner and has not been modified since signing.

Cryptographic concept · Advanced

Forward Secrecy and AEAD

Forward secrecy limits the value of later key compromise for past sessions, while authenticated encryption with associated data provides confidentiality and integrity within a defined protocol context.

Cryptography and trust concept · Intermediate

Full-Disk Encryption

Full-Disk Encryption is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Hardware Security Modules

Hardware Security Modules is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Password protection · Intermediate

Hashing, Salting, and Peppering

Hashing transforms data into a fixed-length digest, while salts and peppers strengthen password storage by making precomputed and large-scale guessing attacks more difficult.

Cryptographic concept · Advanced

Homomorphic Encryption

Homomorphic encryption permits selected computations on encrypted data so a processor can produce an encrypted result without receiving the plaintext.

Cryptography and trust concept · Intermediate

Initialization Vectors and Nonces

Initialization Vectors and Nonces is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Key Derivation Functions

Key Derivation Functions is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Mobile transport-security concept · Advanced

Mobile Certificate Validation and Pinning

Mobile certificate validation verifies that a server certificate chains to a trusted authority, matches the intended service, is valid for the current time and policy, and has not been revoked or otherwise rejected; pinning adds a narrower application trust decision for selected keys or certificates.

Data governance practice · Intermediate

Nonproduction Data Governance

Nonproduction data governance controls what data may enter development, test, QA, staging, training, and demonstration environments and how it is transformed, accessed, retained, and removed.

Operational technology security · Advanced

OT Historian Security

OT historian security protects time-series process data, tags, events, interfaces, and analytics that support operations, engineering, quality, investigation, and business decisions.

Service management · Intermediate

PCI Cryptographic Key Control Evidence

PCI cryptographic key control evidence demonstrates that key generation, distribution, storage, access, rotation, replacement, revocation, destruction, and split knowledge or dual control operate as designed.

Service management · Intermediate

PCI Data Retention and Secure Purge

PCI data retention and secure purge limit payment account data to documented business or legal need and remove it reliably from production, logs, backups, archives, endpoints, exports, and provider systems when no longer required.

Service management · Intermediate

PCI PIN Security

PCI PIN security protects personal identification numbers and cryptographic keys used in payment transactions through controlled devices, encryption, key management, processing, and operational procedures.

Service management · Intermediate

PCI Point-to-Point Encryption

PCI point-to-point encryption protects account data from the point of interaction through decryption within a validated solution, using controlled devices, applications, keys, and operational responsibilities.

Service management · Intermediate

PCI Tokenization and Scope Reduction

PCI tokenization replaces account data with substitute values while preserving tightly controlled tokenization, detokenization, key, vault, and administrative components that remain security-critical.

Cryptographic architecture · Advanced

PKI Architecture

PKI architecture defines certificate authorities, registration, trust anchors, certificate profiles, validation, revocation, key protection, issuance workflows, and relying-party behavior.

Service management · Intermediate

Payment Data Flow Mapping

Payment data flow mapping records where account data is captured, transmitted, processed, stored, displayed, backed up, logged, tokenized, and destroyed across every payment channel.

Cryptographic migration practice · Advanced

Post-Quantum Cryptography Readiness

Post-quantum cryptography readiness inventories cryptographic dependencies, identifies long-lived confidentiality and signature needs, tests approved algorithms, plans interoperability, and sequences migration.

Service management · Intermediate

Primary Account Number Storage Protection

Primary account number storage protection reduces retained payment data and renders stored PAN unreadable through approved methods while controlling display, access, keys, backups, and recovery.

Privacy engineering · Intermediate

Privacy Data Classification

Privacy data classification groups personal data by sensitivity, identifiability, context, legal constraints, and potential impact so handling controls can be applied consistently.

NIST CSF Subcategory profile · Intermediate

Protect Data at Rest (PR.DS-01) — NIST CSF 2.0 Subcategory

Apply PR.DS-01 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-at-rest are protected.

NIST CSF Subcategory profile · Intermediate

Protect Data in Transit (PR.DS-02) — NIST CSF 2.0 Subcategory

Apply PR.DS-02 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-in-transit are protected.

NIST CSF Subcategory profile · Intermediate

Protect Data in Use (PR.DS-10) — NIST CSF 2.0 Subcategory

Apply PR.DS-10 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-in-use are protected.

Cryptography and trust concept · Intermediate

Public Key Infrastructure Operations

Public Key Infrastructure Operations is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

RSA Cryptography

RSA Cryptography is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Cryptography and trust concept · Intermediate

Root and Intermediate Certificate Authorities

Root and Intermediate Certificate Authorities is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.

Data lifecycle security · Intermediate

Secure Erase and Cryptographic Erasure

Secure erase and cryptographic erasure make stored information infeasible to recover by applying media-appropriate clearing, purging, destruction, or controlled destruction of encryption keys.

Mobile data-protection concept · Intermediate

Secure Mobile Data Storage

Secure mobile data storage keeps secrets and sensitive information out of inappropriate files, caches, backups, logs, screenshots, clipboards, notifications, and shared locations while using platform protection suited to the data and threat model.

Service management · Intermediate

Sensitive Authentication Data Handling

Sensitive authentication data handling prevents storage of prohibited authentication data after authorization and tightly controls any transient processing needed to complete a payment.

Cryptography foundation · Foundational

Symmetric and Asymmetric Encryption

Symmetric encryption uses the same secret key for encryption and decryption, while asymmetric encryption uses a mathematically related public and private key pair.

Content authenticity · Intermediate

Synthetic Content Provenance

Synthetic content provenance records information about the origin, edits, and production process of digital media so consumers and systems can assess authenticity claims.

Cryptography and trust concept · Intermediate

TLS Handshake

TLS Handshake is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.