Lesson 6.3: Capstone: a cryptography health check
The final mission of Passwords and Cryptography 101. Before a payment-card audit, the head of IT asks for a cryptography health check of the shop's server: verify a software update, make sure the certificate survives the holiday freeze and install the renewed one, bring TLS up to the audit's standard, encrypt the customer export before it leaves the server, verify a payment webhook, and report. Every step uses a lesson from this course, and you finish by sealing your report with a hash.
25 min
You will learn to
- Verify software integrity
- Check and replace a certificate
- Harden TLS settings and verify them
- Encrypt data with a protected key
- Verify a message's HMAC and report findings
Key terms
- PCI DSS
- The Payment Card Industry Data Security Standard: security rules for any organisation that stores, processes or transmits card data.
- Change freeze
- A period when no non-urgent changes are made, typically around peak business times.
- Key management
- Generating, storing, distributing, rotating and destroying keys under control.
← Security misconfiguration and exposed secrets · All lessons · White, black and grey hats: what makes hacking ethical →