Cryptography and Physical Security in Information Systems
This paper examines two foundational pillars of information security: cryptography and physical asset protection. The cryptography section covers the history and mechanics of encryption, key types, symmetric and asymmetric systems, public key infrastructure (PKI), digital signatures, hash functions, and common security protocols. The physical security section addresses threats to physical assets, secure facility design, access controls, lock types, fire detection and suppression, HVAC considerations, and uninterruptible power supply (UPS) systems. Drawing on Whitman and Mattord's Principles of Information Security, the paper provides a structured overview suitable for understanding how organizations protect both digital information and physical infrastructure.
- Introduction to Cryptography: History and core mechanics of cryptography
- Encryption Methods and Key Management: Symmetric, asymmetric, PKI, and digital signatures
- Security Protocols and Cryptographic Standards: Web and email security protocols and standards
- Physical Security Fundamentals: Threats, responsibilities, and access control types
- Secure Facilities, Access Controls, and Alarms: Locks, mantraps, alarms, and fire suppression
- Environmental and Infrastructure Controls: HVAC, UPS systems, and data interception risks
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Systematically defines technical terms before applying them, making complex cryptographic concepts accessible to readers new to the subject.
- Draws clear comparisons between related concepts (e.g., symmetric vs. asymmetric encryption, fail-safe vs. fail-secure locks) to help readers understand distinctions.
- Covers both logical (cryptographic) and physical dimensions of information security, demonstrating awareness of security as a multi-layered discipline.
Key academic technique demonstrated
The paper consistently cites a single authoritative textbook source (Whitman & Mattord, 2011) with precise page numbers throughout, demonstrating proper APA in-text citation practice for a textbook-based academic overview. This technique grounds every major claim in a verifiable reference rather than assertion.
Structure breakdown
The paper is divided into two broad topical sections — cryptography and physical security — each organized thematically rather than by argument. The cryptography section progresses from historical context through operational mechanics to protocols and standards. The physical security section moves from threat identification through facility design, fire safety, and environmental controls. A single references entry closes the paper. This structure reflects a survey or study-guide format appropriate for an introductory information security course.
Introduction to Cryptography
In order to maintain information secrecy, one would use cryptography — the practice of intentionally making information unintelligible. This method is mainly employed during the transmission of information and ensures that only the intended recipient is able to decipher it (Whitman & Mattord, 2011, p. 339). The process of deciphering encrypted text is referred to as cryptanalysis. Cryptology is the branch of mathematics covering both cryptography and cryptanalysis.
Cryptology has been in use since 1900 B.C., as evidenced by Egyptian hieroglyphs. A Mesopotamian cryptographic text discovered from 1500 B.C. surpassed that of the Egyptians. The Book of Jeremiah was written using an alphabet substitution method called ATBASH. Cryptography was also employed during the First World War to decipher radio communications, and prisoners have used cryptographic techniques to protect the privacy of their messages.
A key in cryptography is a parameter or piece of information that determines the functional output of a cryptographic cipher or algorithm. Without a key, no useful result can be obtained from the algorithm, and a key is essential for an encrypted message so that the receiver can decrypt it. The three basic cryptographic operations are substitution, transposition, and XOR (Whitman & Mattord, 2011, p. 342). Substitution involves replacing one value with another. Transposition rearranges values within a block to generate cipher text, and this can be performed at the bit or byte level. Exclusive OR (XOR) is a Boolean algebra function that compares two bits: if they are identical, the result is a binary zero; if they differ, the result is a binary one.
Hash functions are another encryption technique integrated into cryptology. A hash function is a mathematical algorithm that generates a summary of a message in order to confirm its identity and verify that no changes have been made to the content (Whitman & Mattord, 2011, p. 350). Hash functions do not create cipher text, but they confirm the identity and integrity of a message — a property that is essential for e-commerce transactions.
Encryption Methods and Key Management
The keys used for decryption and encryption are the distinguishing factors between asymmetric and symmetric encryption. Symmetric encryption systems use a single key for both encrypting and decrypting a message (Whitman & Mattord, 2011, p. 354). Asymmetric encryption makes use of two different but mathematically related keys: if one key is used to encrypt a message, only the other can decrypt it. To ensure that the recipient receives the secret key in a symmetric encryption system, the sender must transmit it through a separate band or channel, preventing the key from being intercepted along with the message.
Public key encryption, also called asymmetric encryption, works by having the sender encrypt a message using the receiver's non-secret public key. The receiver then uses their private key to decrypt the message. The main advantage is that the public key cannot be used to decrypt the sent message. The six components of Public Key Infrastructure (PKI) are: certificate authority, revocation, registration authority, certificate publishing methods, certificate management system, and PKI-aware applications.
A digital signature verifies the authenticity of a message. It is an encrypted message hash that the recipient can check to determine whether the message has been tampered with, by comparing the hash value to that of the decrypted certificate. Digital certificates bind public keys to entities (Whitman & Mattord, 2011, p. 365). Without certificates, it would be easy to forge a signature because the recipient would have no means of confirming the public key's legitimacy.
Holding a single conversation requires the two parties to use four keys in asymmetric encryption, while in symmetric encryption both parties must share the same secret key. A drawback of symmetric encryption is that if the key falls into the wrong hands, messages can be decrypted by unauthorized parties. Using the Diffie-Hellman key exchange, two parties can carry out efficient, secure communications. Steganography — the process of hiding information within other innocuous content — is used to protect confidentiality during transit when encryption is not possible. It is not itself a form of cryptography.
Physical Security Fundamentals
Physical security involves the implementation, design, and maintenance of countermeasures that protect physical resources. The primary threats to physical security include human error or failure, power irregularities, espionage, information extortion, vandalism, theft, forces of nature, technical failures, and software errors. Human error can manifest as the accidental spillage of liquids on computer equipment, or an employee copying confidential information and passing it to competitors. Espionage might manifest as a competitor gaining access to a facility, physically accessing equipment, or committing theft. Forces of nature include thunderstorms, earthquakes, tsunamis, and floods.
IT, security, and general management all play vital roles in physical security. The security department carries the most direct responsibility and is charged with establishing policies, implementing physical security measures, enforcing security procedures, and investigating security breaches. The IT department is responsible for network and computer security; since the majority of physical devices are network-based, this increases IT's responsibility for maintenance and deployment of these systems. Senior management is ultimately responsible for protecting the company's assets, with the IT and security departments providing support to achieve the company's goals.
Physical access controls are countermeasures aimed at protecting the physical resources of a company. Logical access controls are countermeasures aimed at protecting the company's critical information, which a potential attacker could steal without necessarily gaining physical access to equipment. Both types of controls are used in tandem to secure equipment and the data stored within devices.
References
Whitman, M., & Mattord, H. (2011). Principles of Information Security (4th ed.). Stamford, CT: Cengage Learning.
Create your account
Always verify citation format against your institution’s current style guide requirements.