Fortunately, quantum computers are not performant enough yet to conduct such attacks. Estimates vary as to when this will be a reality, though most expect it between 2033 and 2037. Furthermore, regulators have begun outlining end-of-life timelines for existing algorithms, with Australia’s ASD planning to designate them as obsolete by 2030 and the NIST drafting its own retirement schedule for 2035. We expect such announcements to pick up during the coming months from other nations.

As such, regardless of the exact date of emergence of quantum computers capable of breaking current cryptographic algorithms, a transition will be obligatory from a regulation standpoint.

Migrating a complicated IT infrastructure is no trivial feat: in a 2022 memorandum, the Biden administration expected the migration of all U.S. Federal Agencies to cost more than $7 billion. Such a complex endeavor entails a plethora of aspects from assessing risks, to executing the technical migration, with many intermediary steps. Solutions exist to accompany or accelerate those stages.

Wavestone’s 2025 Post-Quantum Migration Migrations radar offers a first visual panorama of market leading cybersecurity solutions for this migration. This radar has been and will continue to be updated in the coming months. Any company that feels it should be part of the radar is encouraged to reach out.

The goal of the radar is not to inventory solutions that completed their PQC migration, but rather solutions that help and accelerate the PQC migration.

Categories 

• Inventory: Automatically inventory the type and locations of all cryptography in use 
• Migration Management: Provide the big picture view of the post quantum transition, often based on inventory outputs 
• PQC Compliant HSM / PKI /CLM: Provide quantum resistant core trust components necessary for most company services 
• Libraries / Embedded Services: Encrypt and sign data with polyvalent libraries or directly integrated cloud solutions 
• Edge Protection: Protect against quantum computing attack by providing an extra layer of security, be it at network or application level 
• Network Analysis: Detect network flows which use obsolete cryptography with probes 

Key Market Trends 

Size disparities

The market landscape for post-quantum security solutions exhibits significant disparities in the size and maturity of players. On one end of the spectrum, tech giants and established cybersecurity firms leverage extensive resources to develop and promote robust solutions. On the other end, niche start-ups and pure players are driving rapid advancements in specialized areas. We expect this diversity to foster:

1. Innovation: Diversity in the market landscape, with contributions from both tech giants and pure players which enhances the pace and quality of innovation.
2. Fragmentation: smaller players may struggle to achieve the scale required to implement their solutions broadly
3. Partnerships: we are already witnessing how Thales and IBM are leveraging innovation in specific areas of pure players with their own resources and expertise.

As the market matures, it will be exciting to follow how its landscape evolves.

Several open-source libraries… with Big Tech support

Already, several open-source libraries propose post-quantum cryptograph. The most high-profile libraries, such as OpenSSL, are not the most advanced on this, with their own implementations currently ongoing, while Open Quantum Safe’s liboq is already ready. Nevertheless, it is a promising sight for the cybersecurity ecosystem that a topic as crucial as post-quantum security has solutions deeply rooted in open-source principles.

Yet, Big Tech companies play a pivotal role in supporting open-source libraries for post-quantum cryptography, recognizing their potential to accelerate adoption and innovation. Initiatives like Open Quantum Safe’s liboq has supporters that include Microsoft, Amazon and IBM; Bouncy Castle’s PQC was developed with Keyfactor’s sizeable participation, and Tink, Google’s open-source library offer PQC as well. However, most of the implementation has not been fully formally verified, though the process is underway.

A lack of certification for HSMs…

Hardware Security Modules (HSMs) play a crucial role in the digital trust chain, but the market for these hardware solutions is not yet ready. Initially, providers resorted to software implementations for experimental purposes while waiting for the new standard to be published by NIST. However, hardware implementations have advanced since then, even though their certification is not expected until Q3 or Q4 2025.

Furthermore, although HSMs are designed to resist tampering and reduce the risks of key exposure, they will have to face challenges related to side-channel attacks due to the still limited maturity of current implementations of these new algorithms.

And a lack of hardware for IoT, embedded devices, and smart cards

The lack of hardware is particularly problematic for connected objects (IoT), embedded devices, and smart cards, which operate under severe constraints – limited power, reduced computing capacity, and restricted storage space – thus requiring efficient algorithms and specialized dedicated hardware for cryptographic operations. Unfortunately, the current absence of dedicated processors remains a major obstacle.

Moreover, the decentralized nature of embedded devices will represent a considerable challenge to overcome, as upgrading legacy equipment will be complex and costly.

A strong market dynamism

Post-quantum security is very much an emerging topic. Yet, today’s market for solutions is extremely dynamic, Companies, governments, and institutions are mobilizing to address emerging risks, fueling a surge in innovative and specialized technological offerings. This momentum will be further accelerated by expected regulatory pressures, such as those from NIST, ASD, and ENISA, compelling organizations to adopt robust and compliant solutions.

An international and sovereign Market: digital sovereignty at stake

The quantum computing market is both global and deeply intertwined with questions of national sovereignty. Quantum computers are considered a strategic issue by the world’s leading nations, which invest hundreds of billions to ensure their sovereignty in that emergent field.

On the other hand, the market for post-quantum security is framed in a much more international prism. Companies in our radar span many nations, with the U.S. being nevertheless the uncontested leader. Moreover, international partnerships have also taken place such as Thales, which partners with IBM, CryptoNext and many more to combine their respective expertise and provide clients with advanced solutions.

A promising but incomplete market coverage

As we have covered, the market is extremely dynamic. The question remains whether the ecosystem’s needs for a post quantum transition are currently met. Currently, there is a lack of true hardware post-quantum solutions, as most of what exists is only a post-quantum layer. Nevertheless, our understanding of the market is very much that it is under development and should be more and more available this year already. Based on how we advise clients in planning and implementing their migration, the market solutions address or will address shortly most of our client’s needs.

Our evolving radar constitutes the first edition in this field. In that sense, we strongly encourage any absent company to contact us to remedy the situation. 

Cet article Radar 2025 of Post Quantum Migration Solutions est apparu en premier sur RiskInsight.

Drawing from its experience in the field of digital identity, Wavestone is publishing its first edition of the CIdO Radar in 2024. This radar follows the same methodology as the CISO Radar published by the firm for the past 10 years and offers an in-depth look at the underlying trends driving the digital identity ecosystem.

In this article, we invite you to explore some impactful and structuring topics for the IAM landscape, with two currently trending  subjects (passwordless and CLM) and moving towards the future topics they foreshadow in the emerging section of the radar (respectively predictive anti-fraud and post-quantum cryptography).

Passwordless, a major evolution not so simple to achieve

For decades, the password has been the central authentication factor for users (and often still is). Passwords have then been complemented into multi-factor authentication strategies to compensate for the inherent weaknesses of this authentication method (low complexity, reuse, phishing risks, etc.). New tools have thus been added to the user authentication process: OTP via SMS or email, push notifications, soft and hard tokens, etc. Despite the increased security level provided by the addition of these new authentication factors, the password remains both a weakness if discovered (it remains reusable on an account without MFA where it is enrolled) and a burden for the user’s experience, as they must remember it and securely store it.

All these reasons have led vendors to imagine secure authentication methods not relying on the use of a password. Eliminating the password allows companies to improve the user experience for their employees, enhance authentication security by reducing the attack surface, and benefit from a positive image in the market. The user finds themselves in an environment where they no longer need to remember a multitude of complex passwords and where they are no longer at risk of having their account stolen through phishing attacks. The use of FIDO2 (Fast Identity Online 2) technology is based on asymmetric cryptography which is currently the most widespread alternative to passwords. This technology is driven by the FIDO Alliance (Google, Microsoft, Amazon, Apple, etc.) and, relies on the use of physical security keys locally storing the private key associated with each service. Ultimately, this  allows a user to log into all their accounts without a password, their login, or email address (simply by using the physical key they possess and a second factor such as biometrics).

However, implementing passwordless authentication comes with significant organizational questions for a structure. How to manage account recovery if this account does not rely on a password? If an employee loses their security key, how can access to their account be restored without being able to use the associated private key? This major issue of “credentials recovery” is inseparable from any passwordless policy and assumes that an organization has anticipated each step of it,  such as: purchasing and distributing authentication media, managing their loss/theft/destruction, obsolete media rotation processes, account backup solutions, double enrolment for critical accounts and management of employee departures, etc.

Passwordless authentication is a trending topic and is being deployed in many organizations. For many, the next step involves establishing fraud detection capabilities before they occur (also called “predictive anti-fraud”).

Predictive anti-fraud, how to prevent fraud before it occurs?

Predictive Anti-Fraud corresponds to proactive monitoring of systems aimed at identifying and stopping fraud before it occurs, rather than relying solely on post analysis of malicious activities that have already happened. These surveillance capabilities are particularly relevant for securing online business activities involving money transfers (such as pooling funds, loyalty accounts, online payments, etc.) in sectors like retail or luxury for instance (as they are often less mature on this subject than banks). We are currently witnessing an increase in phishing attacks aimed at stealing customer account data to misuse their contents (loyalty card fraud, for example, is a real concern for players in the retail sector).

Access management solutions are increasingly capable of detecting fraud patterns and halting illicit activities before completion. All these capabilities rely on machine learning (involving a training phase for the tools) and involve three key stages:

• Detection: Systems can detect behaviours deviating from typical user/customer journeys and as well as sequences of suspicious actions. Detection relies on the customer context (browser used, network, cookies, etc.), the dynamic context (IP address, device used, user behaviour, typing speed, strength of authentication performed, etc.), and the business context (type of requested transaction, amounts, modifications of sensitive information, etc.).
• Analysis: Automatic analysis is conducted with the assignment of a confidence score to the current user profile.
• Response: Response rules are defined to best address alert triggers, with automatic responses for obvious or critical situations (e.g., additional authentication factor, session termination), or manual responses for cases requiring human decision-making.

The main challenge of predictive anti-fraud is the correct  calibration of machine learning tools and their adaptation to the specific business context. Placing too much emphasis on security could cause a disproportionate amount of  negative impact on the service: a high number of false positives affecting user experience and an increase in service complexity and slowdowns (captcha, step-up authentication, significant network consumption, longer processing times). The definition of relevant security and detection rules must be accompanied by a model based on machine learning, as specific as possible to the use case. Given the increasing complexity of attacks, the key to an effective predictive anti-fraud strategy lies in the solutions’ ability to detect and correlate weak signals. For example, some vendors are now capable of detecting fraud attempts during false customer service calls by correlating the users’ actions with whether they are on a phone call.

Certificate Lifecycle Management (CLM), a new market for an old issue

Many companies are currently facing an explosion in the number of electronic certificates within their IT systems. These certificates (and associated cryptographic keys) serve various purposes such as machine-to-machine authentication, user authentication, data signing and encryption, websites security, application micro-services, etc. This increase in the number of electronic certificates significantly increases the workload for the teams in charge of their management. The lifecycle of an electronic certificate includes several stages such as:

1. Requesting the certificate from a PKI (Public Key Infrastructure)
2. Receiving the certificate and associated keys
3. Deploying the certificate within its scope (either as a replacement for an expiring certificate or on a new scope)
4. Decommissioning and revoking the old certificate (if applicable)
5. Continuously monitoring the certificate and its future expiration date
6. Reproducing this process for each certificate before its expiration.

Manual management of tens (or even hundreds) of thousands of electronic certificates poses numerous challenges. This type of management is highly resource-intensive, relies on repetitive tasks, and is prone to human errors. It is not uncommon for certificates to slip through the cracks of teams and go unrenewed, or simply remain undeclared within the IT system (shadow IT). For all these reasons, an organization with a large fleet of electronic certificates should consider adopting a CLM solution.

CLM solutions offer many features to facilitate and ensure the reliability of certificate lifecycle management. Some of these features include:

• Certificate discovery tools, allowing a company to have a comprehensive view of its certificate fleet (even for undeclared certificates).
• The use of protocols automating all certificate-related actions (mentioned above).
• Numerous connectors enabling clients to seamlessly integrate these solutions within their IT systems.
• Governance and rights management modules for certificates.
• Alerting capabilities serving as a safety net for teams.

The “Zero Trust” philosophy, often requiring securing communications between services through mutual authentication using electronic certificates (with the increasingly frequent use of microservices architectures, the explosion of non-human accounts, etc.), tends to increase the number of electronic certificates within organizations. Utilizing dedicated certificate lifecycle management tools rather than manual tracking can reduce certificate-related incidents by 90% and decrease incident processing time by 50%, according to Gartner[2].

For more details on CLM solutions, you can read Wavestone’s article dedicated to this subject here.

The implementation of a CLM solution signifies a step forward in securing infrastructures, but more importantly, it can be leveraged towards crypto agility (the ability to quickly replace or update encryption algorithms or protocols to address evolving threats). Crypto agility is a theme that we should expect to encounter more and more frequently in the medium term, largely due to the development of quantum computers.

And what’s next? Technological challenges ahead, such as post-quantum cryptography

While organizations strive to adopt robust IAM strategies, considering current technological threats is no longer sufficient. The impending topic of quantum computing (even if it seems still a few years away from now) is set to disrupt all our encryption practices, necessitating early anticipation of measures to be implemented for the 2030 decade. The use of quantum computers and their famous qubits (which can simultaneously take on values of 0 or 1) already allows for much more efficient cryptographic calculations than traditional computers.

It is important to note that symmetric cryptography is not as much at risk from quantum threats, and increasing the size of encryption keys will allow this encryption mode to resist quite effectively. However, classic RSA and Elliptic Curve asymmetric cryptography is truly threatened: key exchange, authentication, and digital signature which rely on that classic asymmetric cryptography are already at risk for specific use cases. The Shor’s algorithm could enable a quantum computer to break RSA 2048-based encryption in a matter of hours.

Post-quantum cryptography is currently focusing on solutions to adapt encryption to the future capabilities of quantum computers. ‘Store Now, Decrypt Later’ which means that we can decrypt in 10 years what is captured now, even encrypted, or the capability to modify (in 10 years) the author or the content of a digital signature are risks that should already be considered today, especially with the time needed to handle the migration to post-quantum algorithm. In 2022,  NIST published a list of 4 such encryption algorithms, resistant to quantum computers: CRYSTALS-Kyber for general encryption, CRYSTALS-Dilithium, FALCON, and SPHINCS+ for electronic signature. These algorithm should be confirmed during 2024.

The main current recommendation to ensure the transition to post-quantum encryption is to perform hybrid encryption, i.e., to use both classical and post-quantum encryption algorithms to secure communications. While this issue is not yet at the heart of current IAM challenges, it is important to monitor its evolution, especially since some major vendors are already entering the market and introducing a new term: QCaaS (Quantum Computing as a Service).

Cet article 2024 CIdO Radar est apparu en premier sur RiskInsight.

What does “Jitsuin Archivist” look like?

The start-up Jitsuin has developed a tool called “Jitsuin Archivist” based on Distributed Ledger Technology (DLT). The purpose of this tool is to know “Who did what to a Thing and When”.

As of today, 5 types of users can interact with the tool: Archivist Administrator, System Administrator, Maintenance Operator, Auditor, Custom (currently in beta version).

Figure 1 – The 5 user roles of “Jitsuin Archivist”

On this tool the user has access to the “Security Twins” of the connected devices. Indeed, after logging in, the user accesses a dashboard through which he has a global view of all the connected devices linked to the tool. He can see relevant statistics related to his IoT deployment, such as the number of critical incidents, the activity of connected objects, etc.

The user can also access the “Manage Assets” page where he will find a map with the location of all the connected objects linked to the tool and a list of them (where he can also see in more detail the events linked to a particular connected device).

Figure 2 – The different views of the tool “Jitsuin Archivist”: 1. dashboard with a global view, 2. all the objects and their location, 3. detailed view of an object, 4. all the actions of the object useful during security audits

The PoC: A House with a digital lock

Wavestone used Jitsuin’s tool to first address the issue of identity and access management in buildings in at the dawn of digital transformation and the to illustrate the usefulness of “Security Twins”.

To do this Wavestone used the lego house “SmartHouse” :

Figure 3 – The “SmartHouse”

Equipped with an RFID card reader, a Raspberry Pi microcontroller and a servomotor, the entrance door of the “SmartHouse” only opens to users who have an authorized access card. All actions related to opening, closing, granting of entry rights, etc. are recorded on “Jitsuin Archivist” (see figure 4).

Figure 4 – The functional diagram of the “SmartHouse”

In order to facilitate the interaction with the digital lock of the “SmartHouse”, a platform allowing the simulation of different operations made by different peopled involved in the life cycle of connected devices has been created using the Django web framework and Bootstrap. This platform allows, among other things, to:

• Send security patches to the connected lock (using Azure IoTHub)
• Assign access rights to the “SmartHouse”
• View the history of access rights requests made and those awaiting validation, etc.

This is what the platform looks like:

Figure 5 – SmartHouse’s management platform

The use of “Jitsuin Archivist” in this PoC is very interesting when regards to security audits of connected devices. Indeed, as “Jitsuin Archivist” is based on Distributed Ledger Technology (DLT), this system can be considered as “secure by design” since an auditor has a technical guarantee on the non-compromise of data (provided that the sending of this data is secure).

Here is the “Auditor View” on “Jitsuin Archivist” where it is possible to see all the information regarding the connected devices linked to the platform and to know who has done what to the connected device:

Figure 6 – The “Auditor View” of “Jitsuin Archivist”

The PoC scenario: WaveHouse rents “SmartHouses” in France …

Here is the general architecture of the PoC:

Figure 7 – The general architecture of the PoC

As one can see, the digital lock (represented by the RFID card reader, the Raspberry Pi microcontroller and the servomotor) interacts with Azure IoTHub as well to facilitate the management of its firmware updates.

The main use cases studied by Wavestone and Jitsuin

The main use cases studied by Wavestone and Jitsuin are explained in the video below:

Conclusion

Wavestone and Jitsuin were able to demonstrate – with the different use cases illustrated above in the video – how to improve the security of connected devices:

• First of all, all of the people involved in the life cycle of the digital lock of the “SmartHouse” had access to its “Security Twin”. Indeed, each of them had access to a decentralized and unchangeable register provided by “Jitsuin Archivist” with all the information regarding the security of the digital lock.
• Then, as mentioned above, this architecture is “secure by design” because as “Jitsuin Archivist” is based on Distributed Ledger Technology (DLT), one has a technical guarantee on the non-compromising of data.
• The “Security Twin” of the digital lock ensured physical security since it had the rights management information, allowing all the people involved to know who had access to the “SmartHouse”.
• Finally, since the “Security Twin” also had firmware information, the different people involved could easily know which connected devices had vulnerabilities and quickly plan the distribution of security patches.

The “Security Twins” would therefore ultimately improve the security of the connected devices, since it would be easy to know which objects are secure and which are not.

Cet article “Security Twins”: A new security & trust guarantee for connected devices (2/2) est apparu en premier sur RiskInsight.

Despite their usefulness, introducing connected devices unfortunately brings new risks for companies. Indeed, according to the Palo Alto Networks report² published in March 2020, 57% of the connected devices analyzed were vulnerable to medium or high severity attacks. This is not surprising. Securing connected devices is proving to be an arduous task that explains why Beecham Research³ finds 62% of Industrial IoT transformations fail to scale because of a lack of trust.

Therefore, with this article we will try to ask ourselves about the security and trust issues of connected devices and how companies can deal with them.

What are the security and trust issues of connected devices?

In order to mitigate the security risks on connected devices, NIST recommends in its report⁴ published in 2019 to focus on 6 main areas:

• Inventory: Maintain an accurate inventory of all connected devices and their most relevant characteristics throughout their lifecycle (see the article detailing the lifecycle of connected devices).

Figure 1 – Connected device lifecycle

• Vulnerabilities: Identify and eliminate known vulnerabilities in the software and firmware of connected devices to reduce the likelihood and ease of exploitation and compromise.
• Access: Prevent unauthorized and inappropriate physical and logical access, use and administration of connected devices by people, processes and other computing devices.
• Detect security incidents of connected devices: Monitor and analyze connected device activity for signs of incidents involving the security of the device.
• Detect data security incidents: Monitor and analyze the activity of the connected device for signs of data security incidents.
• Protect data: Prevent access and alteration of data that could expose sensitive information or allow manipulation or disruption of the operation of connected devices.

However, current IoT platforms only partially meet these security requirements (see the article detailing the usefulness of IoT platforms).

Figure 2 – The usefulness of IoT platforms

Indeed, traditional IoT architectures rely on a centralized cloud platform, operated by a third-party company and where most often the rules for data collection and storage are opaque. This is not the best solution to ensure the security of connected devices since:

• The use of a centralized cloud platform introduces the risk of “single point of failure” on the IoT architecture (although today this risk is mitigated with the implementation of a redundant architecture and backups).
• It is entirely possible for an attacker to change the data stored in the cloud database. The decision making of the different stakeholders is therefore impacted.
• Collaboration between the different stakeholders of the IoT deployment (manufacturers, maintenance operators, …) becomes more difficult because access to the platform can be restricted to them.

The use of a decentralized management system for connected devices where all stakeholders would have the possibility to reliably consult or contribute information regarding connected devices (firmware version, maintenance operations, etc.) becomes essential to guarantee the security of those devices and the integrity of data they produce.

How do “Security Twins” help meet the security challenges of connected devices?

In order to support IoT platforms and improve the security of IoT deployments, the notion of  “Security Twin” should be introduced in IoT deployments.

The principle of a “Security Twin” is simple. It is a virtual representation of the connected device that contains all its security information, such as firmware version, vulnerabilities, etc. upon which all stakeholders involved in its upkeep can reach consensus (see figure 3).

Figure 3 – The “Security Twin” mechanism (from: Jitsuin)

A “Security Twin” gains effectiveness when more stakeholders of the deployment can interact with it and reach consensus that the information provided/recorded is correct.

Therefore, solutions based on Distributed Ledger Technology (DLT) represent a logical first step in the creation of Security Twins, as they would allow the security information of the connected device to be gathered in a decentralized and immutable registry that would be accessible by all authorized stakeholders in the IoT deployment. The best well known distributed registry solution is the Blockchain (see the article on Blockchain’s uses and limitations).

Taking up the points raised earlier in the NIST report, one could say that the use of a “Security Twin” would therefore improve:

• Device and access management: all stakeholders of the IoT deployment would have access to a decentralized and immutable register of all the connected devices with the corresponding security and trust information.
• Vulnerability management and the detection of device security incidents: the different stakeholders could share device security information and take the necessary actions (e.g. the manufacturer of a connected device could notify the other stakeholders of the availability of a new firmware update thanks to the “Security Twin”).
• Data protection and the detection of data related security incidents: The very foundation of a “Security Twin” is based on the use of a decentralized and immutable register to record data related to the security of connected devices. This makes it more difficult for attackers to change the data, which reduces the risk of a security incident.

The use of “Security Twins” therefore offers the possibility of strengthening the security, integrity, trust and resilience of connected devices.

The start-up Jitsuin has developed “Jitsuin Archivist” a tool based on Distributed Ledger Technology (DLT) to overcome the lack of collaborative tools to secure connected devices. The purpose of this tool is not to replace IoT platforms but to allow the creation of “Security Twins”.

Together, Wavestone and Jitsuin sought to demonstrate the benefits of using a decentralized architecture with “Security Twins”. The two companies have therefore collaborated on the construction of a PoC (Proof of Concept) to tackle identity and access management of buildings using connected devices, which will be introduced in a future article.

1 Gartner, 29th August 2019 : https://www.gartner.com/en/newsroom/press-releases/2019-08-29-gartner-says-5-8-billion-enterprise-and-automotive-io
2 Palo Alto Networks, 10th March 2020, “Unit 42 IoT threat report”: https://unit42.paloaltonetworks.com/iot-threat-report-2020/
3 Why IoT projects fail https://www.whyiotprojectsfail.com/?cs=br2
4 NIST – “Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks” : https://csrc.nist.gov/publications/detail/nistir/8228/final

Cet article “Security Twins”: A new security & trust guarantee for connected devices (1/2) est apparu en premier sur RiskInsight.