2.4 Cryptography & Network Defense: TLS 1.3, Firewalls & Zero Trust

🎯 Essential Technical Takeaways

• Symmetric encryption (AES-256) is fast and used for bulk data; asymmetric encryption (RSA/ECC) solves key distribution and enables digital signatures.
• Digital signatures hash the document and encrypt the hash with the sender's private key, providing integrity, authenticity, and non-repudiation.
• Web Application Firewalls (WAF) inspect Layer 7 web traffic (SQLi/XSS); Next-Generation Firewalls (NGFW) filter network traffic at Layers 3–7.
• Zero Trust rejects perimeter-based implicit trust ('Never Trust, Always Verify'), requiring continuous per-session authentication and microsegmentation.

Cryptography protects data across its lifecycle: in transit, at rest, and in use. In modern systems, 'Hybrid Encryption' combines the speed of symmetric ciphers with the key-distribution power of asymmetric ciphers. Symmetric ciphers (e.g., AES-256) use a single shared key, making them computationally efficient and ideal for encrypting large databases at rest. Asymmetric ciphers (e.g., RSA, ECC) use public/private key pairs: data encrypted with the public key can only be decrypted by the corresponding private key. In TLS 1.3, asymmetric cryptography securely negotiates a temporary symmetric session key, which then encrypts the high-speed web traffic.

Digital signatures establish data integrity, sender authenticity, and non-repudiation. The sender hashes the document and encrypts the resulting digest with their private key. Any recipient with the sender's public key can verify that the document was signed by the authentic private key and has not been altered in transit. Digital signatures do not encrypt the underlying document; they authenticate it.

Network security enforces defense-in-depth across the OSI model. Next-Generation Firewalls (NGFW) inspect packet states, protocols, and ports across Layers 3 through 7, while Web Application Firewalls (WAF) sit in front of web applications to inspect Layer 7 HTTP payloads for malicious patterns like SQL injection. Under NIST SP 800-207, Zero Trust Architecture replaces perimeter-based trust with the tenet 'Never Trust, Always Verify,' requiring microsegmentation, explicit per-session authentication, and continuous device health verification.

⚠️ CPA Evolution Exam Traps & Control Pitfalls

• Attempting to encrypt large bulk databases using slow asymmetric RSA encryption.
• Assuming a digital signature encrypts the document for confidentiality (signatures provide authenticity and integrity, NOT confidentiality).
• Trusting internal network traffic simply because it originates from within the corporate office Wi-Fi.