How unencrypted website addresses and low PBKDF2 iteration counts undid LastPass's encrypted vaults, and why Security+ objective 1.3 is about matching the cryptographic solution to the requirement. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• Why objective 1.3 asks which cryptographic technique fits a requirement, not how to do the math
• The LastPass breach: encrypted passwords, unencrypted website addresses, and PBKDF2 iteration counts as low as one
• Why stolen ciphertext doesn't expire, and weak protection is only a matter of time
• How encryption turns plaintext into ciphertext with an algorithm and a key
• Why integrity, origin and non-repudiation point past encryption to hashing and digital signatures

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/lastpass-appropriate-cryptography-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=lastpass-appropriate-cryptography-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com