ISC2 CISSP Practice Question

The correct answer is to implement a key rotation policy based on industry standards and usage patterns. Key rotation is a fundamental control to mitigate risks in cryptographic systems, especially for keys that have been in use for extended periods. Long-term use of the same cryptographic keys increases the risk of compromise due to several factors:

1. Increased exposure time gives attackers more opportunities to obtain the key through various means
2. Computing power advances over time make older keys more vulnerable to brute force attacks
3. Compliance requirements often mandate periodic key rotation

While increasing key length would strengthen the cryptographic algorithm against brute force attacks, it doesn't address the fundamental issue of key age and exposure. Implementing quantum-resistant algorithms is forward-looking but doesn't address the immediate vulnerability of the existing long-term keys. Switching to hardware security modules improves key protection but doesn't solve the problem of keys being used for too long without rotation.