Vault Exchange Crypto Workbench
Opening brief — the Vault Exchange
What protects the information when access controls are not enough?
Ivy says: Last week at the Guard Post we asked one question: should this traffic be allowed? That question is about the door.
Ivy says: Here at the Vault Exchange we ask the next one: if someone gets the information anyway, can they understand it — and can we tell if it changed?
Ivy says: We will take one incident report through four stations. Same document every time; different problem each time. Nothing is timed and nothing is graded.
Mission brief
Situation
The Guard Post can control access, but a copied incident report may still be readable or altered after it leaves the protected system.
Your mission
Review the two security questions and identify what access control handles versus what cryptography handles.
Evidence to inspect
- “Should this traffic be allowed?” — this question is about the door and the path.
- “Can someone read it, detect a change, verify approval, or prove key possession?” — this question is about the data itself, or the cryptographic proof attached to it.
Decision to make
Why is access control alone not enough?
What we are looking for
Access control decides who should get in; cryptography protects or verifies the information once someone has it. They are complementary layers.
Mission complete when
You can state that distinction in one sentence and are ready to test the same report at four stations.
Read the brief, then continue when the room is ready.