ISC2 CISSP Practice Question

The correct answer is False. Enterprise device authentication does not rely exclusively on shared secret keys (symmetric cryptography). While some implementations may use shared secrets, most enterprise device authentication frameworks leverage asymmetric cryptography through digital certificates and public key infrastructure (PKI). In these implementations, each device possesses a unique private key that never needs to be shared, while authentication servers verify device identity using the corresponding public key. This approach offers several advantages including better scalability, more robust security, simplified key management, and support for non-repudiation. Common enterprise implementations include TLS client certificate authentication, 802.1X with EAP-TLS for network access control, and certificate-based mobile device management (MDM) solutions. Organizations generally prefer these certificate-based approaches because they avoid the risks associated with distributing and managing shared secrets across large device fleets.