Vijay Krishnan

The Australian Cyber Security Centre (ACSC), via the Australian Signals Directorate (ASD), has published updated guidance titled “Planning for Post-Quantum Cryptography.” It’s encouraging to see more national security agencies raising awareness and urging organizations to start preparing now. They correctly note that deploying protections against a CRQC may take longer than expected and highlight the risk of "harvest now, decrypt later" - which are all the right reasons to start now, but without panicking. While the ACSC’s push to "start planning for PQC right away" is wise, their recommended timeline (seen in the diagram below) raises some concerns. The guidance mentions, for example, that enterprises should have begun implementing PQC by the end of 2028 and should have completed the transition across the organization by the end of 2030. In other words, the ASD envisions that once an enterprise kicks off its migration (by 2028), it can fully replace or upgrade its cryptography within about two years. For most large enterprises, however, a two-year window to entirely swap out entrenched cryptographic systems is overly optimistic. Migrating to PQC is a massive, multi-year undertaking for a typical large organization. Roadmaps and guidelines from other bodies - such as the Post-Quantum Cryptography Coalition (which includes MITRE, Microsoft, and IBM), Moody’s, U.S. officials, and other security agencies - have estimated much longer timelines that dwarf the ACSC’s suggestion. I just posted on my blog a detailed quantum readiness program plan showing in detail why it’s a 10-year effort (if not more): https://lnkd.in/gds9FTFD. To be fair, the ACSC guidance’s intent is likely to set a bold but clear goal to galvanize action, rather than a hard-and-fast rule. However, when a super-busy CISO sees the diagram below, the risk is that they will only read that they have until 2028 to start and that it can be done in two years, and then put it in the back of their minds. In summary, Australia’s ACSC deserves credit for elevating post-quantum cryptography on the national agenda and providing practical guidance to get started. Their message aligns with global expert opinion: don’t wait for the quantum threat to become imminent; begin your preparations now. At the same time, it’s important to approach the timeline with realism. (Also, why is the risk exposure for "harvest now, decrypt later" data starting only mid 2027 in the diagram?!?) The gudiance: https://lnkd.in/gWCpZasV #PQC #QuantumReadiness #QuantumSecurity #QuantumResilience #QuantumResistance

190

10 Comments

Hacker group ShinyHunters claims to have breached Vietnam’s Credit Information Center (CIC), stealing up to 3 billion records including 160 million personal records. If confirmed, this is a wake-up call: centralized national databases are prime targets, but often the least defended. I’ve been warning about these vulnerabilities for years. Data isn’t gold. It’s radioactive. Valuable when handled with precision, catastrophic when leaked.

412

12 Comments

Zscaler’s ThreatLabz report highlights some big ransomware trends: - 146% increase in ransomware attacks blocked by Zscaler’s cloud - 70% rise in public extortion cases - 238 TB of data stolen - 935% increase in Oil & Gas sector attacks Press release: https://bit.ly/44VOMUY

56

2 Comments

I hate to say I told you so… But as I predicted in previous posts, cyber threats are fuelling growth. SentinelOne just raised its annual revenue forecast on the back of rising global demand for AI-powered defence. Organisations are investing heavily in automation, AI-driven security tools and adaptive security capabilities. Boards are seeing the numbers - attacks are up, breaches are costly and vendors promising machine-speed protection are surging in value. For years, the strategy has been to build higher walls and patch faster. Now, it’s about autonomous systems that adapt in real time, reducing the gap between signal and remediation. Cybersecurity isn’t just about reacting anymore - it’s becoming predictive and adaptive. The organisations that thrive will be the ones that move just as quickly as the threats do.

33

8 Comments

Most businesses today run on infrastructure they do not fully understand. Cyberspace is not simply the delivery channel for your systems and data. It is the domain in which your operations live. It is dynamic, adversarial, and unevenly mapped. Because access is frictionless, many mistake ease of use for understanding. This misconception creates blind spots that prevent organisations from investing in the capability required to operate safely. This is why so many organisations struggle to get teams to take cybersecurity seriously - because they view it as an IT function, not as a domain that must be navigated with discipline, capability, and control. At the highest levels - inside the military, defence intelligence, and the military-industrial complex,this is already understood. They treat cyberspace as a domain of operations. Not a tool. Not a product. A battlespace. If you're leading a business or building a team, you need to adopt that same mindset. You are not just using technology, you are operating within a domain that exposes you to risks you are likely unprepared to navigate. The organisations that survive and lead in this domain will be those that train for it like any other operational environment: with structure, repetition, and the understanding that failure carries real consequences.

39

17 Comments

Recommended reading for practitioners holding cyber risk roles.. I was well known for driving tabletop exercises in many sectors to reduce risks but it really applies so well in #cybersecurity. Tabletop exercises (TTXs) give teams the practice they need to spot gaps, strengthen response, and build the reflexes to act fast when attacks strike. Read Fortinet Aamir Lakhani’s perspective via SC Media: https://ftnt.net/6043AMt39

26

1 Comment

Big news from ZenzizenSec People have been asking how they can stay up to date on the launch of the Vulnerability Management Maturity Model (VMMM v2) and the upcoming Continuous Threat Exposure Management Maturity Model (CTEMMM). I’m excited to share that: - VMMM v2 will officially launch this September  - A self-assessment tool for both VMMM v2 and CTEMMM will follow shortly after, so organizations can benchmark their programs and chart a roadmap forward. To get notified as soon as these are released, head over to www.zenzizensec.com and sign up. This is the next step in helping organizations move beyond patching to proactive risk reduction.

22

4 Comments