Do you have a security Challenge?

Cyber Security Advisory

Cyber Governance, Risk & Compliance

CMMC Readiness & Uplift

Essential Eight Readiness and Uplift

OT Security & Risk Assessments

Security Architecture

Post-quantum cryptography

2030 is closer than your last major platform upgrade felt.

The Information Security Manual recommends that organisations stop using traditional asymmetric cryptography by the end of 2030. Moving means finding every system that depends on it, including the ones buried in vendor products, and replacing them in a sensible order. That job takes years, so the planning needs to begin well ahead of the deadline.

Book a 30-minute call

The risk

Three reasons this can't wait for a working quantum computer.

Stolen data keeps its value

Encrypted data copied today could be decrypted later. If your records need to stay secret for ten years or more, the exposure may already have started.

Stolen data keeps its value

Encrypted data copied today could be decrypted later. If your records need to stay secret for ten years or more, the exposure may already have started.

Trust has a long tail

Signatures on firmware, certificates and long-life devices are hard to replace in the field, especially in OT environments.

Trust has a long tail

Signatures on firmware, certificates and long-life devices are hard to replace in the field, especially in OT environments.

You don't control the whole stack

Much of your cryptography lives inside products you buy. Vendor roadmaps and contract renewals will decide part of your timeline.

You don't control the whole stack

Much of your cryptography lives inside products you buy. Vendor roadmaps and contract renewals will decide part of your timeline.

The method

From "where is it?" to a funded plan.

We start where ASD's LATICE framework starts: by locating what you have. NIST's FIPS 203, 204 and 205 are the published standards most vendors are building towards.

01 Find it

A cryptographic inventory across applications, infrastructure, identity, certificates, vendors and, where relevant, OT.

Inventory

01 Find it

A cryptographic inventory across applications, infrastructure, identity, certificates, vendors and, where relevant, OT.

Inventory

02 Rank it

Each dependency scored by how sensitive the data is, how long it must stay protected and how hard the system is to change.

Risk ranking

02 Rank it

Each dependency scored by how sensitive the data is, how long it must stay protected and how hard the system is to change.

Risk ranking

03 Plan it

A sequenced roadmap with costs, owners and vendor questions, tied into your existing refresh cycles wherever possible.

Roadmap

03 Plan it

A sequenced roadmap with costs, owners and vendor questions, tied into your existing refresh cycles wherever possible.

Roadmap

04 Prepare to switch

Design patterns for ASD-approved algorithms and for crypto-agility, so that the next change costs less than this one.

Design

04 Prepare to switch

Design patterns for ASD-approved algorithms and for crypto-agility, so that the next change costs less than this one.

Design

Who should start first

Earlier is cheaper for some more than others.

Long-lived data

Health records, financial data and government information that must stay confidential for a decade or more.

Long-lived data

Health records, financial data and government information that must stay confidential for a decade or more.

Long-life equipment

Critical infrastructure and OT operators whose devices will still be running well after 2030.

Long-life equipment

Critical infrastructure and OT operators whose devices will still be running well after 2030.

Software vendors

Businesses whose customers will soon ask for a roadmap.

Software vendors

Businesses whose customers will soon ask for a roadmap.

Upcoming replacements

Anyone replacing a major platform before 2030, because that is the cheapest time to change the cryptography.

Upcoming replacements

Anyone replacing a major platform before 2030, because that is the cheapest time to change the cryptography.

Find out how big the job is.

A first conversation is usually enough to work out where an inventory should start. You walk away from the full engagement with a cryptographic inventory, a risk ranking, a migration roadmap, a board paper and a set of questions for your vendors.

Book a 30-minute call