Part 1: General - Computer Security Resource Center - National ...

March, 2007
access to information encrypted by a strong algorithm may not be practical without the correct
decryption key. The continuity of an organization’s operations can depend heavily on
contingency planning for key management systems that includes a redundancy of critical logical
processes and elements, including key management and cryptographic keys.
9.3.3.1 General Principles
Planning for recovery from system failures is an essential management function. Interruptions of
critical infrastructure services should be anticipated, and planning for maintaining the continuity
of operations in support of an organization’s primary mission requirements should be
accomplished. With respect to key management, the following situations are typical of those for
which planning is necessary:
1. Lost key cards or tokens,
2. Forgotten passwords that control access to keys,
3. Failure of key input devices (e.g., readers),
4. Loss or corruption of the memory media on which keys and/or certificates are stored,
5. Compromise of keys,
6. Corruption of Certificate Revocation Lists (CRL) or Compromised Key Lists (CKLs),
7. Hardware failure of key or certificate generation, registration, and/or distribution
systems, subsystems, or components,
8. Power loss requiring re-initialization of key or certificate generation, registration, and/or
distribution systems, subsystems, or components,
9. Corruption of the memory media necessary for key or certificate generation, registration,
and/or distribution systems, subsystems, or components,
10. Corruption or loss of key or certificate distribution records and/or audit logs,
11. Loss or corruption of association of keying material to the holders/users of the keying
material, and
12. Unavailability of older software or hardware that is needed to access keying material or
process protected information.
While recovery discussions most commonly focus on the recovery of encrypted data and the
restoration of encrypted communications capabilities, planning should also address 1) the
restoration of access (without creating temporary loss of access protections) where cryptography
is used in access control mechanisms, 2) the restoration of critical processes (without creating
temporary loss of privilege restrictions) where cryptography is used in authorization
mechanisms, and 3) the maintenance/restoration of integrity protection in digital signature and
message authentication applications.
Contingency planning should include 1) providing a means and assigning responsibilities for
rapidly recognizing and reporting critical failures; 2) the assignment of responsibilities and the
placement of resources for bypassing or replacing failed systems, subsystems, and components;
and 3) the establishment of detailed bypass and/or recovery procedures.
116