A side-channel attack is a method of breaking a system by measuring the physical byproducts of its operation, such as timing, power consumption, electromagnetic emissions, or even sound, instead of attacking the algorithm or its mathematics directly.
The idea is unsettling because the cryptography can be provably sound while the implementation still leaks. A timing attack measures how long a secret comparison takes and infers key bits from the difference. Power analysis reads the fluctuating current draw of a smart card to recover a key one bit at a time. Cache-timing behavior sits behind the well-known Spectre and Meltdown vulnerabilities disclosed in 2018.
The common mistake is assuming that choosing a strong, standardized cipher ends the discussion. The leak lives in how the code and hardware run, not in the specification. Constant-time coding, key blinding, noise injection, and physical shielding are the usual defenses, and each one adds cost or complexity, so teams weigh how exposed the device really is.
How does a side-channel attack show up on the CISSP?
It belongs to Domain 3, Security Architecture and Engineering, which carries 13% of the exam. Expect questions that separate a flaw in an algorithm from a flaw in its implementation, and that ask you to pick countermeasures for cryptographic hardware and modules.