An organization's security policy states that software applications should not exchange sensitive data in cleartext. The security analyst is…

The security policy requires that sensitive data not be exchanged in cleartext. Base64 is an encoding scheme, not an encryption algorithm; it merely represents binary data in an ASCII format and is easily reversible, providing no confidentiality. The requirement is to replace this with a strong encryption method. AES (Advanced Encryption Standard) is the current, widely adopted symmetric encryption standard recommended by NIST and used globally for securing sensitive data. It is secure, efficient, and offers various key lengths (128, 192, 256-bit), making it the best and most appropriate choice among the options to protect credit card data.

A. 3DES: While a valid encryption algorithm, 3DES is an older standard that is significantly slower and considered less secure than AES due to its smaller block size.

C. RC4: This is an outdated stream cipher with well-documented vulnerabilities. Its use is deprecated in modern security protocols (e.g., TLS 1.3) and is not a secure choice.

D. SHA-3: This is a hashing algorithm. Hashing is a one-way function used for integrity checks and password storage, not for encrypting data that needs to be decrypted later.

---

1. National Institute of Standards and Technology (NIST). (2001). FIPS PUB 197: Advanced Encryption Standard (AES). This publication officially establishes AES as the standard for encrypting sensitive electronic data. Section 1

"Introduction

" states

"This standard specifies the Rijndael algorithm

a symmetric block cipher that can process data blocks of 128 bits

using cipher keys with lengths of 128

192

and 256 bits. [...] The AES algorithm is capable of protecting sensitive information for the U.S. Government."

Reference: Page 1

Section 1.

2. Katz

J.

& Lindell

Y. (2020). Introduction to Modern Cryptography (3rd ed.). CRC Press. This academic textbook

widely used in university cryptography courses

distinguishes between different cryptographic primitives. Chapter 3 discusses symmetric encryption

highlighting AES as the modern standard

while Chapter 5 explains that hash functions (like SHA-3) are one-way and used for integrity

not confidentiality. The text also notes the obsolescence of algorithms like DES/3DES in favor of AES.

Reference: Chapter 3

"Private-Key Encryption

" and Chapter 5

"Message Authentication Codes and Collision-Resistant Hash Functions."

3. Amazon Web Services (AWS). (2023). AWS Key Management Service Cryptographic Details Whitepaper. This official vendor documentation details the cryptographic standards used within AWS services. It explicitly states

"AWS KMS uses FIPS 140-2 validated hardware security modules (HSMs) to protect the confidentiality and integrity of your keys. Your keys are only ever used inside the HSMs. AWS KMS uses the Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM)

known as AES-GCM

with 256-bit keys." This demonstrates the industry's reliance on AES as the best practice for data protection.

Reference: Page 10

Section "AWS KMS Symmetric Key Encryption."