How DoD is using the Risk Management Framework to assess operational risk for decertified cryptographic algorithms

摘要

There are times where it makes sense to continue to use decertified algorithms to secureoperational data; however, those uses must be analyzed to minimize operational risk and, in thecurrent fiscal environment, system upgrades must be prioritized to systems and areas ofresponsibility (AORs) with the greatest operational risk.This article will illustrate the who, when, why,where, and what of risk assessments for decertified cryptographic key extension requests (KERs).