CISSP - Security Architecture and Engineering (13% of the exam) - Section 3.7

Understand methods of cryptanalytic attacks such as brute force, side-channel, ransomware, and implementation attacks.

Describe cryptanalytic attack categories including brute force, side-channel attacks, fault injection, and pass-the-hash techniques, and explain how ransomware exploits cryptographic mechanisms. Identify which implementation weakness or key management failure each attack exploits so that appropriate countermeasures can be selected.

brute forceside-channel attackransomwarefault injectionpass the hash

Practice question for this objective

Free sampleSecurity Architecture and Engineeringhard

A hardware security team is evaluating defences for an HSM that performs ECDSA signing. Which statement about fault injection attacks is TRUE?

AFault injection is a purely software attack that exploits exception handlers to leak the key through the operating system log.
BFault injection is a subtype of brute force where the attacker tries random keys until one decrypts the ciphertext.
CFault injection induces transient errors during a cryptographic computation so the faulty output can be analysed to recover key material. Correct
DFault injection is mitigated entirely by increasing the symmetric key length, because longer keys make glitches statistically harmless.

Identify fault injection as a physical implementation attack that recovers key material by comparing correct and deliberately corrupted cryptographic outputs. Fault injection deliberately disturbs a cryptographic device using voltage glitches, clock glitches, laser pulses, or electromagnetic pulses to corrupt an intermediate value during a signing or decryption. Techniques such as differential fault analysis on RSA-CRT or ECDSA can recover the private key from a single faulty signature, which is why countermeasures rely on redundant computation, output verification, and tamper sensors rather than larger keys.

Why A is wrong: Fault injection is fundamentally a physical attack on the device using voltage, clock, electromagnetic, or optical disturbance. Confusing it with software exception abuse loses the distinguishing feature of the attack class.

Why B is wrong: Brute force exhausts the key space by trial. Fault injection does not search keys; it perturbs a single signing or decryption operation so the faulty result mathematically reveals key bits.

Why C is correct: Differential fault analysis and similar techniques deliberately glitch clock, voltage, or laser pulses to corrupt an intermediate value, then compare faulty and correct outputs to extract bits of the private key.

Why D is wrong: Key length is irrelevant to fault attacks because the maths exploits the difference between faulty and correct outputs, not the size of the key space. Real countermeasures are redundant computation, sensors, and shielding.

See more CISSP practice questions, answers explained.

Exam traps in Security Architecture and Engineering

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

A side-channel attack exploits weaknesses in the mathematical structure of the cipher, while a traditional cryptanalytic attack targets the physical implementation.
Why it is wrong: This reverses the definitions. Mathematical weaknesses in the cipher are what classical cryptanalysis (linear, differential, algebraic) targets; side-channel work deliberately ignores the maths and attacks the implementation.
A brute-force attack against the user's password, where the adversary tries every possible password until the hash matches.
Why it is wrong: Brute force requires recovering the plaintext password by trial. The scenario explicitly states the password was never recovered, so the attack is not brute force.
Bell-LaPadula with the star property, because preventing writes to lower classifications stops contaminated data from leaking out of the release workstation into general manufacturing logs.
Why it is wrong: Bell-LaPadula's star property protects confidentiality by stopping write-downs of secrets, not integrity; it would not stop a low-integrity operator from corrupting a high-integrity master batch record.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.