תוכן מסופק על ידי Cath Firmin. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Cath Firmin או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.
Player FM - אפליקציית פודקאסט התחל במצב לא מקוון עם האפליקציה Player FM !
The healing power of fitness goes far beyond physical benefits—for today’s guest, it’s a form of self-expression and a celebration of what the body can do. In this episode, host Nora McInerny sits down with fitness personality Ivylis Rivera, who shares her deeply personal journey of navigating life with Chronic Migraine while holding onto her passion for movement. Ivylis opens up about the struggle of staying active while facing the fear of triggering a headache or migraine attack and the resilience it takes to keep pushing forward—a resilience that carried her through the challenging journey of finding a Chronic Migraine treatment plan that worked for her. Join Nora and Ivylis as they explore the concept of “soft living,” a philosophy Ivylis embraces—staying active, listening to your body, and building trust in oneself. Click here for Product Information, including Boxed Warning and Medication Guide, or visit https://abbv.ie/prescribing_info See omnystudio.com/listener for privacy information.…
תוכן מסופק על ידי Cath Firmin. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Cath Firmin או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.
With the 2035 deadline for post-quantum cryptography rapidly approaching, organizations must act immediately to ensure a smooth transition. In this episode of Shielded: The Last Line of Cyber Defense, host Johannes Lintzen speaks with Dustin Moody, a mathematician at NIST, to discuss the practical steps organizations should take to prepare for this monumental shift in cryptography. They explore the critical timeline, common challenges, and how the post-quantum cryptography migration can be effectively managed. What You'll Learn:
How to build an effective PQC migration roadmap starting with a cryptographic inventory assessment.
Why the 2035 deadline is just the end of the journey, not the beginning, of quantum-safe implementation.
The essential role of crypto agility in maintaining long-term security resilience.
How to evaluate whether hybrid cryptography schemes are right for your organization.
Why "harvest now, decrypt later" attacks pose an immediate threat to sensitive data.
Practical steps organizations can take in the next 12 months to begin PQC migration.
How NIST’s standardization process is creating a toolbox of algorithms for different use cases.
Why collaboration between government agencies, industry, and vendors is crucial for a successful transition.
Dustin Moody is a mathematician leading the post-quantum cryptography standardization project at the National Institute of Standards and Technology (NIST). Since 2016, he has led one of the most consequential cryptographic initiatives of our time, selecting and standardizing algorithms that will secure digital systems against quantum threats. As the principal architect of NIST’s post-quantum cryptography standards, Moody has played a pivotal role in establishing the 2035 migration timeline and crafting crucial guidance for organizations transitioning to quantum-safe cryptography. His work bridges the gap between theoretical cryptography and practical implementation, helping organizations understand and prepare for the post-quantum era through crypto agility, risk assessment, and strategic planning. Moody’s expertise, combined with his collaborative approach, makes him a leading authority on securing digital infrastructure against emerging quantum threats.
The year 2035 might sound far away, but if you're a large organization, your migration timeline starts now. As Dustin Moody warns, this isn’t going to be a quick plug-and-play switch. The good news? NIST has laid out a clear roadmap. Here’s how to get started step by step.
Your Roadmap to Post-Quantum Readiness:
[03:55] Step 1: Appoint a PQC Taskforce and Map Your Migration - 2035 marks the end of your post-quantum transition, not the beginning. Large organizations may need a decade or more to migrate fully, meaning the planning must start immediately. Moody recommends building a dedicated internal team to lead the charge, assigning ownership, and developing a migration roadmap tailored to your systems and dependencies. The first foundational task is a cryptographic inventory, a deep dive into all the ways cryptography is used in your infrastructure. This includes both internally developed systems and supply chain components. Engaging with vendors, suppliers, and customers early ensures alignment and reduces friction later in the transition. Key Question: Have you built a dedicated team and started your roadmap, including a cryptographic inventory?
[13:22] Step 2: Design for Agility from Day One - Crypto agility isn’t a future nice-to-have; it’s a current necessity. Organizations need the ability to adapt cryptographic algorithms over time, responding to new threats and evolving standards without disrupting live systems. NIST’s formal definition of crypto agility includes the flexibility to update cryptographic components across software, hardware, protocols, and infrastructure—seamlessly. Implementing agility now ensures you’re not locked into today’s choices and gives you options to respond quickly if vulnerabilities are discovered down the road. Key Question: Are your systems built to evolve or will they need to be rebuilt the next time the landscape shifts?
[18:24] Step 3: Protect Long-Lived Data from Quantum Exposure - Quantum threats aren’t theoretical; they’re already impacting data security. According to Dustin, adversaries are actively collecting encrypted data today with the intent of decrypting it later, once quantum computing reaches maturity. This makes post-quantum readiness especially urgent for industries that manage data with long shelf lives—such as healthcare, finance, critical infrastructure, and national security systems. Even if your data is secure now, if it’s still sensitive a decade from now, it’s already vulnerable. While symmetric encryption like AES offers partial protection, the public-key encryption methods used to exchange keys are often the weakest link. Organizations must begin assessing where these vulnerabilities exist and how to mitigate them. Key Question: Are you still treating quantum threats as a future problem or are you protecting your data from being decrypted tomorrow?
[25:00] Step 4: Build Momentum with a 12-Month Action Plan - You don’t need to solve everything in a year, but you do need to start. The next 12 months should be focused on building momentum: resourcing your PQC strategy, launching your inventory, and plugging into real-world guidance from initiatives like NIST’s National Cybersecurity Center of Excellence. Use this time to learn from early adopters, experiment safely, and begin aligning teams around risk, infrastructure, and timelines. The transition may span a decade, but your first steps start today. Key Question: What progress will your organization be able to show by this time next year?
Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts.
✔ Get insider knowledge from leading cybersecurity experts.
✔ Learn practical steps to future-proof your organization.
✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.
תוכן מסופק על ידי Cath Firmin. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Cath Firmin או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.
With the 2035 deadline for post-quantum cryptography rapidly approaching, organizations must act immediately to ensure a smooth transition. In this episode of Shielded: The Last Line of Cyber Defense, host Johannes Lintzen speaks with Dustin Moody, a mathematician at NIST, to discuss the practical steps organizations should take to prepare for this monumental shift in cryptography. They explore the critical timeline, common challenges, and how the post-quantum cryptography migration can be effectively managed. What You'll Learn:
How to build an effective PQC migration roadmap starting with a cryptographic inventory assessment.
Why the 2035 deadline is just the end of the journey, not the beginning, of quantum-safe implementation.
The essential role of crypto agility in maintaining long-term security resilience.
How to evaluate whether hybrid cryptography schemes are right for your organization.
Why "harvest now, decrypt later" attacks pose an immediate threat to sensitive data.
Practical steps organizations can take in the next 12 months to begin PQC migration.
How NIST’s standardization process is creating a toolbox of algorithms for different use cases.
Why collaboration between government agencies, industry, and vendors is crucial for a successful transition.
Dustin Moody is a mathematician leading the post-quantum cryptography standardization project at the National Institute of Standards and Technology (NIST). Since 2016, he has led one of the most consequential cryptographic initiatives of our time, selecting and standardizing algorithms that will secure digital systems against quantum threats. As the principal architect of NIST’s post-quantum cryptography standards, Moody has played a pivotal role in establishing the 2035 migration timeline and crafting crucial guidance for organizations transitioning to quantum-safe cryptography. His work bridges the gap between theoretical cryptography and practical implementation, helping organizations understand and prepare for the post-quantum era through crypto agility, risk assessment, and strategic planning. Moody’s expertise, combined with his collaborative approach, makes him a leading authority on securing digital infrastructure against emerging quantum threats.
The year 2035 might sound far away, but if you're a large organization, your migration timeline starts now. As Dustin Moody warns, this isn’t going to be a quick plug-and-play switch. The good news? NIST has laid out a clear roadmap. Here’s how to get started step by step.
Your Roadmap to Post-Quantum Readiness:
[03:55] Step 1: Appoint a PQC Taskforce and Map Your Migration - 2035 marks the end of your post-quantum transition, not the beginning. Large organizations may need a decade or more to migrate fully, meaning the planning must start immediately. Moody recommends building a dedicated internal team to lead the charge, assigning ownership, and developing a migration roadmap tailored to your systems and dependencies. The first foundational task is a cryptographic inventory, a deep dive into all the ways cryptography is used in your infrastructure. This includes both internally developed systems and supply chain components. Engaging with vendors, suppliers, and customers early ensures alignment and reduces friction later in the transition. Key Question: Have you built a dedicated team and started your roadmap, including a cryptographic inventory?
[13:22] Step 2: Design for Agility from Day One - Crypto agility isn’t a future nice-to-have; it’s a current necessity. Organizations need the ability to adapt cryptographic algorithms over time, responding to new threats and evolving standards without disrupting live systems. NIST’s formal definition of crypto agility includes the flexibility to update cryptographic components across software, hardware, protocols, and infrastructure—seamlessly. Implementing agility now ensures you’re not locked into today’s choices and gives you options to respond quickly if vulnerabilities are discovered down the road. Key Question: Are your systems built to evolve or will they need to be rebuilt the next time the landscape shifts?
[18:24] Step 3: Protect Long-Lived Data from Quantum Exposure - Quantum threats aren’t theoretical; they’re already impacting data security. According to Dustin, adversaries are actively collecting encrypted data today with the intent of decrypting it later, once quantum computing reaches maturity. This makes post-quantum readiness especially urgent for industries that manage data with long shelf lives—such as healthcare, finance, critical infrastructure, and national security systems. Even if your data is secure now, if it’s still sensitive a decade from now, it’s already vulnerable. While symmetric encryption like AES offers partial protection, the public-key encryption methods used to exchange keys are often the weakest link. Organizations must begin assessing where these vulnerabilities exist and how to mitigate them. Key Question: Are you still treating quantum threats as a future problem or are you protecting your data from being decrypted tomorrow?
[25:00] Step 4: Build Momentum with a 12-Month Action Plan - You don’t need to solve everything in a year, but you do need to start. The next 12 months should be focused on building momentum: resourcing your PQC strategy, launching your inventory, and plugging into real-world guidance from initiatives like NIST’s National Cybersecurity Center of Excellence. Use this time to learn from early adopters, experiment safely, and begin aligning teams around risk, infrastructure, and timelines. The transition may span a decade, but your first steps start today. Key Question: What progress will your organization be able to show by this time next year?
Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts.
✔ Get insider knowledge from leading cybersecurity experts.
✔ Learn practical steps to future-proof your organization.
✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.
Quantum threats are no longer theoretical, and waiting could cost you. In this episode of Shielded: The Last Line of Cyber Defense , Johannes Lintzen is joined by Mamta Gupta, a quantum physicist turned cybersecurity strategist at Lattice Semiconductor. Together, they break down how crypto agility, hardware-based trust anchors, and PQC readiness are now essential for any organization managing long-lifecycle systems. You’ll come away with practical steps to assess, upgrade, and future-proof your cryptographic infrastructure. What You'll Learn: Why crypto agility is no longer optional and how to implement it in hardware and software How FPGAs provide a reprogrammable foundation for future-ready root-of-trust design What the “Harvest Now, Decrypt Later” threat means for long-term data protection How to assess PQC readiness in three strategic steps: visibility, trust anchor evaluation, and vendor analysis How to navigate diverging regulatory mandates from CNSA 2.0 (U.S.) and ENISA (EU) What it really takes to align internal stakeholders for a successful PQC transition Mamta Gupta is the Senior Director of Strategic Business Development for Security, Telecommunications, and Data Centers at Lattice Semiconductor. With a master’s degree in quantum physics, specializing in superfluidity, superconductivity, and critical phenomena, she brings a rare blend of theoretical insight and real-world engineering to the cybersecurity space. She has led key PQC strategy efforts at Lattice, helping develop quantum-resistant FPGA-based architectures and secure supply chain practices. A leading advocate for confronting the “Harvest Now, Decrypt Later” threat, Mamta is known for her pragmatic, cross-functional approach to building crypto-agile infrastructure. Your Roadmap to Post-Quantum Readiness: [00:06:05] Step 1: Understand the Real Threat: “Harvest Now, Decrypt Later” The quantum threat is already operational, not hypothetical. Adversaries are actively collecting encrypted data today with the goal of decrypting it once quantum computers reach maturity. This tactic, known as "Harvest Now, Decrypt Later," means data with a long shelf life, such as health records, financial data, and national infrastructure, is already at risk. Waiting for quantum computing to become mainstream before acting is a critical miscalculation. Organizations must treat post-quantum cryptography as a present-day risk mitigation priority, not a future optimization. Key Question: Are you taking immediate steps to protect long-lived data from eventual quantum decryption? [10:43] Step 2: Design for Crypto Agility Across Hardware and Software The pace of cryptographic change is rapid; regulatory mandates, algorithm approvals, and threat intelligence evolve constantly. At the same time, the life cycle of deployed hardware can stretch over a decade. This disconnect demands systems that are flexible by design. Crypto agility ensures that organizations can upgrade algorithms, rotate keys, and adapt trust models without re-architecting infrastructure or replacing physical components. Without agility, today’s protections could become tomorrow’s liabilities. Key Question: Is your infrastructure architected to support cryptographic evolution across its full lifecycle? [14:38] Step 3: Run a Three-Part PQC Readiness Assessment Before launching a migration, organizations need full visibility into their current cryptographic environment. This begins with a cryptographic inventory, reviewing all firmware, certificates, keys, and the algorithms used to protect them. Next, evaluate your trust anchors, components like secure boot mechanisms, TPMs, or silicon-based keys to identify weak points or dependencies on outdated cryptographic methods like RSA or ECC. Finally, conduct a vendor readiness check across your digital supply chain. Determine whether suppliers of silicon, firmware, or software are equipped to support PQC or if they introduce downstream risk. This structured assessment turns uncertainty into a prioritized roadmap for upgrading your infrastructure with confidence. Key Question: Have you completed a full assessment of your cryptographic assets, trust anchors, and vendor readiness? [17:21] Step 4: Build a Crypto-Agile Root of Trust Using FPGAs The root of trust is the foundational layer of system security, and its resilience is essential in a post-quantum world. Field Programmable Gate Arrays (FPGAs) offer a key advantage over ASICs: reprogrammability. With FPGAs, cryptographic algorithms can be updated after deployment, providing the agility needed to respond to evolving standards and threats. They also enable secure firmware validation, hybrid cryptography, and alignment with upcoming compliance deadlines without requiring hardware swaps. Deploying FPGAs as the root of trust creates a flexible security architecture that supports long-term cryptographic adaptability. Key Question: Does your hardware architecture support post-deployment cryptographic updates without physical replacement? [25:33] Step 5: Architect Hybrid Cryptography with Strategic Intent Transitioning to post-quantum cryptography doesn’t mean abandoning classical algorithms immediately. Hybrid cryptography, running both classical and quantum-safe algorithms in parallel, offers a way to maintain current protections while building future resilience. However, this approach adds complexity in key management, execution order, and performance optimization. Systems must be designed to support multiple key types and enforce clearly defined policies on trust precedence and key retirement. A well-architected hybrid model ensures security and agility without introducing operational friction. Key Question: Have you developed a hybrid cryptography strategy that balances performance, policy, and long-term resilience? [31:13] Step 6: Launch a Cross-Functional PQC Pilot A pilot is the fastest way to move from theory to execution. By testing PQC readiness in a contained environment, organizations can surface critical constraints, such as firmware signing limitations, key size restrictions, or vendor gaps. Pilots also help unify teams across engineering, compliance, and leadership, creating a shared understanding of what the PQC transition entails. Running a pilot allows for experimentation, measurement, and iteration before committing to large-scale deployment. It’s a low-risk, high-leverage way to build momentum and organizational buy-in. Key Question: What would it take to launch a practical PQC pilot inside your organization in the next 90 days? [36:56] Step 7: Build a 12-Month Action Plan Aligned to Regulatory Timelines PQC migration is not a weekend upgrade; it’s a multi-year journey that requires strategic pacing. CNSA 2.0 mandates post-quantum protections in all new systems by 2030, and enforcement has already started impacting procurement. ENISA, the EU cybersecurity agency, has also issued guidance with specific requirements for hybrid cryptography. Organizations must build an actionable 12-month plan that includes cryptographic audits, vendor engagement, proof-of-concept evaluations, and measurable internal milestones. Aligning to regulatory timelines now ensures you don’t lose compliance or customers later. Key Question: How are you structuring your next 12 months to show measurable PQC progress aligned with global regulations? Episode Resources: Mamta Gupta on LinkedIn Lattice Semiconductor Website Johannes Lintzen on LinkedIn PQShield Website Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
The time to modernize cryptographic infrastructure has arrived. In this episode, recorded live at RSA Conference 2025, host Johannes Lintzen moderates a conversation with four HSM industry leaders: Greg Wetmore (Entrust), John Ray (Thales), David Close (Futurex), and Kevin McKeogh (Utimaco). Together, they explore the evolution of Hardware Security Modules as the foundational building blocks for secure, post-quantum infrastructure. Learn how HSMs are enabling cryptographic agility, supporting new NIST and CNSA 2.0 algorithms, and offering in-field firmware and FPGA updates, without requiring a full rip-and-replace. The panel dives into compliance frameworks, performance trade-offs, hybrid environments, and supply chain integrity, offering a rare behind-the-scenes view into how top HSM vendors are solving quantum migration at scale. What You’ll Learn: Why HSMs are essential to post-quantum cryptographic trust How cryptographic agility is enabled through firmware, FPGA, and SDK updates Why CNSA 2.0 and FIPS 203/204/205 are now critical to compliance How to deploy PQC without replacing your entire infrastructure The real-world performance and interoperability implications of PQC How leading organizations are already securing TLS with hybrid algorithms Why PQC readiness requires standards-aligned APIs and driver updates What’s next for HSMs and how vendors are building for an agile crypto future Greg Wetmore is VP, Software Development at Entrust. He leads Entrust's cryptographic engineering, focusing on post-quantum crypto implementation and HSM innovation. David Close is Chief Solutions Architect at Futurex. He is an expert in hardware crypto infrastructure, compliance (FIPS, CNSA), and real-world PQC implementation. John Ray is Director of HSM Product Management at Thales. He oversees quantum readiness and crypto-agility strategy for Thales HSM product lines. Kevin McKeogh is Senior Director, Product Management at Ultimaco. He leads crypto innovation at Utimaco with a focus on hybrid deployments, SDK flexibility, and international standards alignment. Your Roadmap to Post-Quantum HSM Readiness: [00:52] Step 1: Accept That Crypto Agility Is Now Essential The next 20 years of cryptography will be far more dynamic than the past 30. Entrust explains how layering cryptography across FPGA, firmware, and trusted code environments allows you to adopt new algorithms fast, without compromising security or waiting on long certification cycles. Key Question: Is your organization building cryptographic agility into your hardware lifecycle? [04:42] Step 2: Plan for Firmware, Not Rip-and-Replace Post-quantum HSM adoption doesn’t mean starting from scratch. Vendors like Utimaco and Futurex reveal how firmware and SDK updates can retrofit existing infrastructure. Key Question: Can your current HSM be upgraded for PQC, or are you locked into legacy limitations? [08:40] Step 3: Align with CNSA 2.0 and FIPS Standards PQC readiness is no longer optional. With new standards like CNSA 2.0 and FIPS 203–205, organizations must ensure their HSMs meet certification requirements and cryptographic benchmarks. Key Question: Are your cryptographic modules validated for CNSA 2.0 and emerging FIPS requirements? [13:52] Step 4: Test Hybrid Environments Early TLS is already using PQC—many organizations just don’t realize it. Futurex reveals real-world deployments combining classical and quantum-safe algorithms in production environments. Key Question: Are you piloting hybrid PQC deployments in real use cases like TLS or email security? [20:25] Step 5: Upgrade Your API Ecosystem PQC implementation isn’t just about HSMs—it’s about the ecosystem. CNG, PKCS#11, and OpenSSL must all support new algorithms. Vendors describe how they’re updating drivers and working with partners to enable seamless transitions. Key Question: Have you validated that your entire crypto stack - APIs, libraries, and middleware - supports PQC? [28:48] Step 6: Build Interoperability into Your PQC Strategy HSM vendors emphasize cross-vendor cooperation and standards adherence. Migration success depends on interoperability and standards—not just product capabilities. Key Question: Is your PQC deployment plan designed to interoperate across tools, vendors, and geographies? Episode Resources: PQShield Website Entrust PQC Resources Futurex Solutions Hub Thales Post-Quantum Hub Utimaco Knowledge Base Johannes Lintzen on LinkedIn Greg Wetmore on LinkedIn David Close on LinkedIn John Ray on LinkedIn Kevin McKeogh on LinkedIn Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
Quantum migration isn’t a future concern, it’s a present-tense priority. In this episode of Shielded: The Last Line of Cyber Defense , Johannes Lintzen and Dr. Garfield Jones take a deep dive into the practical challenges of post-quantum migration, focusing on how organizations can apply the APA framework (Awareness, Preparedness, Action) to make their cybersecurity future-proof. From procurement and inventory to legacy system challenges and vendor alignment, Dr. Jones shares a tactical roadmap to help organizations start moving today. What You'll Learn: How to apply the APA framework to drive post-quantum readiness Why cryptographic inventory is the first and most urgent step How to balance backward compatibility with secure innovation Procurement strategies for embedding PQC into your supply chain The dual challenge of securing encryption and authentication When to trust automation, and where human oversight is essential How compliance mandates can accelerate not hinder progress Why global collaboration and algorithm flexibility matter Where to access government resources and guidance Dr. Garfield Jones is the Associate Chief of Strategic Technology at CISA, part of the U.S. Department of Homeland Security. He is a leading figure in quantum security strategy and played a key role in shaping the APA framework (Awareness, Preparedness, Action). With expertise in AI, machine learning, and infrastructure protection, he is helping U.S. agencies and partners prepare for a cryptographic future shaped by quantum computing. Your Roadmap to Post-Quantum Readiness: [00:52] Step 1: Launch Migration Using the APA Framework Quantum migration starts with the APA model: Awareness, Preparedness, and Action. Awareness means identifying your cryptographic footprint across software, hardware, vendors, and internal systems. Preparedness requires budgeting for upgrades, creating internal migration roadmaps, and prioritizing systems based on risk. Action brings these plans to life with procurement updates, patching schedules, contract renegotiations, and system deployments. Migration is not a future problem, it is an urgent operational priority. Organizations that delay will face steeper costs, rushed transitions, and possible security gaps. Key Question: Has your organization operationalized the APA framework into an actionable migration plan? [04:52] Step 2: Assign a PQC Champion and Conduct Full Inventory Quantum migration needs a clear owner, not a committee. Assign a PQC champion empowered to lead across security, IT, procurement, and leadership. Their first mission is a cryptographic inventory. Catalog every place encryption, digital signatures, and cryptographic key management are used, including internal systems, APIs, certificates, and vendor platforms. Inventorying is not optional. Without a full map, risk prioritization, budgeting, and timeline development are impossible. Key Question: Have you appointed a PQC champion and started building a verified cryptographic inventory? [06:54] Step 3: Plan for a Hybrid Cryptographic Environment Post-quantum migration will not happen overnight. Many environments must support both classical and quantum-safe algorithms during a multi-year transition. Prioritize forward-facing, high-risk systems first, such as customer portals, external interfaces, and remote authentication systems. Assess which assets require full replacement versus those that can use middleware, protocol proxies, or hybrid solutions. Planning for coexistence ensures operational continuity while securing the most critical assets first. Key Question: Has your team mapped systems into categories for full replacement or phased hybrid upgrades? [09:24] Step 4: Update Procurement to Enforce PQC Standards Every new system you buy should already be on the path to post-quantum compliance. Update RFP templates, procurement policies, and vendor contracts to include requirements for PQC readiness, adoption of NIST-approved algorithms, and cryptographic agility. Ensure vendors demonstrate their quantum migration roadmap during evaluations. Procurement is not just a finance issue, it is your frontline for securing future resilience. Key Question: Have you updated procurement processes to require quantum-resilient solutions and vendor roadmaps? [11:24] Step 5: Combine Automation and Human Oversight in Cryptographic Inventory Automation can rapidly identify cryptographic assets, but it is not enough on its own. Combine automated cryptographic discovery with manual verification. Experts catch context-specific errors, validate system relevance, and prioritize risks effectively. A blended approach ensures your inventory is accurate, comprehensive, and ready to drive informed migration planning. Key Question: Are you combining automated discovery with expert manual validation in your cryptographic inventory? [13:52] Step 6: Use Compliance Mandates to Drive Urgency Compliance deadlines such as OMB 23-02 are more than bureaucratic hurdles. They are action triggers that can align leadership support, unlock budgets, and drive internal momentum. Treat compliance mandates as organizational deadlines for inventorying, planning, and upgrading systems. Organizations that start now will avoid costly last-minute scrambles. Key Question: Are you treating compliance frameworks as strategic accelerators for quantum migration? [19:08] Step 7: Upgrade Authentication Alongside Encryption Quantum threats target encryption and authentication systems equally. Digital signatures, certificates, identity management platforms, and transactional validation must all be post-quantum ready. Organizations should assess their PKI infrastructure now and plan parallel upgrade tracks for data protection and system trust. Key Question: Are authentication systems fully included in your post-quantum migration roadmap? [20:30] Step 8: Use AI to Accelerate, Not Replace Expertise AI and machine learning can improve cryptographic discovery, pattern detection, and asset categorization. However, AI tools should augment, not replace, expert decision-making. Experts are essential for validating asset contexts, prioritizing risks, and building migration schedules. Maintain human oversight for all strategic migration decisions. Key Question: Is your AI deployment structured to enhance, not replace, expert-driven migration work? [24:35] Step 9: Build Systems for International Cryptographic Flexibility Different countries may adopt different post-quantum standards. Your systems must be flexible enough to negotiate between varying algorithms and maintain secure interoperability across borders. Build that flexibility into your communications protocols and infrastructure planning today. Key Question: Are your systems architected for algorithm negotiation and cross-border post-quantum compatibility? [26:36] Step 10: Extend Migration Planning Across the Supply Chain Quantum readiness does not stop at your organizational boundaries. Vendors, contractors, and suppliers must also align with post-quantum standards. Engage partners early to assess their migration plans, share best practices, and synchronize timelines where possible. A secure organization surrounded by vulnerable suppliers remains exposed. Key Question: Are your suppliers and partners actively aligning to post-quantum standards with you? Episode Resources: Garfield Jones on LinkedIn CISA Website Johannes Lintzen on LinkedIn PQShield Website Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
Navigating the shift to post-quantum cryptography takes more than awareness; it requires a forward-looking strategy, crypto-agile architecture, and long-term planning across software and hardware. In this episode of Shielded: The Last Line of Cyber Defense , host Johannes Lintzen speaks with Hart Montgomery, Technical Director at LF Decentralized Trust and a leading voice in cryptographic modernization. Together, they explore practical solutions and emerging standards that will define how organizations prepare for a quantum-secure future. What You'll Learn: How to assess your quantum readiness through crypto-agility audits and dependency mapping How to build a business case using the “Harvest Now, Decrypt Later” threat model Why US, UK, and Australian regulations are accelerating timelines — and what that means for compliance Why centralized crypto services are key to consistent implementation and quantum-safe upgrades How to standardize cryptography across teams using policy-driven APIs Where to start: Low-risk, high-reward use cases that build migration momentum How the “Open Source Hamburger” explains your software supply chain risk Why hardware timelines are the biggest bottleneck and how to start addressing them now How SBOMs and CBOMs can help uncover legacy cryptography across your stack Hart Montgomery is the Technical Director at LF Decentralized Trust, specializing in post-quantum cryptography and secure blockchain architectures. With a PhD in lattice cryptography and a background as a blockchain researcher at Fujitsu, he brings deep expertise in both theoretical and applied security. Hart is involved with critical initiatives such as the Post-Quantum Cryptography Alliance and the Open Quantum Safe Project, helping secure the global open-source ecosystem through crypto agility and supply chain transparency. His unique blend of academic rigor and practical experience makes him a leading voice in post-quantum cryptography and secure software development. Quantum security isn’t a project; it’s a phased transformation. Here’s a step-by-step roadmap to guide your organization through the post-quantum transition, from quick wins to long-term strategy. Your Roadmap to Post-Quantum Readiness: [04:48] Step 1: Audit Your Crypto Footprint and Centralize Control The first step in quantum readiness is knowing what cryptographic assets you rely on and where they might be vulnerable. Hart highlights that over 90% of closed-source software contains open-source dependencies, many using outdated or insecure cryptographic algorithms like MD5 or single DES. To fix this, organizations must start by creating a Cryptographic Bill of Materials (CBOM) and Software Bill of Materials (SBOM) to expose hidden risks in the stack. From there, implement centralized cryptographic microservices to eliminate inconsistency and bring cryptographic controls under policy enforcement. Key Question: Can you confidently say where every cryptographic risk lives in your stack? [08:39] Step 2: Target Low-Cost, High-Impact Migrations First All cryptographic transitions are complex, but some are technically easier to implement with minimal performance impact. Start there. Hart points to TLS handshakes, ephemeral key exchanges, and messaging as ideal first steps, areas where larger PQ signatures and keys add little overhead. Organizations like Signal, Apple, and AWS have already migrated these areas, proving it's possible to build momentum while limiting operational risk. Start with what’s easy, then scale the lessons to more critical or complex systems. Key Question: What’s your TLS handshake worth in the quantum era? [14:48] Step 3: Use the “Open Source Hamburger” to Rethink Software Supply Chain Risk Modern software is built like a hamburger. You start with an open-source framework (the bottom bun), write a small layer of custom code (the meat), and stack on more open-source libraries (the top bun). According to Hart, that custom code might make up just 20% of your full application; the rest is open source that you didn’t write and might not fully understand. This model demands rigorous supply chain hygiene. Without a clear SBOM and CBOM, organizations risk inheriting vulnerabilities from long-abandoned GitHub repos or outdated crypto defaults buried in libraries. Treat every third-party dependency like a potential attack vector and standardize cryptographic practices across them. Key Question: Are you treating your software stack like your own or trusting a hamburger of unvetted, third-party code? [18:00] Step 4: Use the ‘Harvest Now, Decrypt Later’ Threat to Drive Business Buy-In Quantum attacks aren’t here yet, but the threat is real today. Encrypted data can be harvested now and decrypted later once quantum computers become viable. For any data that must remain secure for 5–10+ years—think health records, financial transactions, or national security—this is a clear and present risk. Hart emphasizes that while we can’t predict exactly when quantum computers will break RSA or ECC, we can estimate how long data needs to remain secure. That risk equation alone should drive immediate planning, especially when factoring in hardware timelines for things like secure elements and smart devices. Key Question: Will your encrypted data still be safe in 2035? [25:31] Step 5: Build Crypto Agility Into Your Architecture Quantum migration isn’t a one-time change; it’s an ongoing capability. Crypto agility means designing systems that can switch algorithms, protocols, or key sizes as threats evolve or standards change. Hart advocates a “black box” model: developers shouldn’t choose cryptographic algorithms themselves. Instead, they should call secure APIs governed by central teams. This kind of agility already exists in tech-forward companies like Google and AWS, where cryptographic updates happen at the service level, not deep in app logic. Adopting this model now prevents lock-in and future-proofs your infrastructure. Key Question: Are your systems flexible enough to rotate cryptography with minimal code rewrites and business disruption? [22:00] Step 6: Address Hardware Dependencies Before It’s Too Late IoT devices, embedded systems, smart meters—these components can't be updated overnight. They’re often deployed for a decade or more and may rely on cryptographic hardware that’s not post-quantum ready. For many organizations, this is the longest lead time in the entire migration process. As Hart warns, there’s often no choice but to replace or phase out outdated systems, and that requires years of planning, budgeting, and supply chain coordination. Secure hardware lifecycles must become part of your PQC strategy now, not later. Key Question: Have you identified cryptographic hardware in your infrastructure that must be upgraded and started planning its replacement? Episode Resources: Hart Montgomery on LinkedIn The Linux Foundation Website Johannes Lintzen on LinkedIn PQShield Website Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
With the 2035 deadline for post-quantum cryptography rapidly approaching, organizations must act immediately to ensure a smooth transition. In this episode of Shielded: The Last Line of Cyber Defense , host Johannes Lintzen speaks with Dustin Moody, a mathematician at NIST, to discuss the practical steps organizations should take to prepare for this monumental shift in cryptography. They explore the critical timeline, common challenges, and how the post-quantum cryptography migration can be effectively managed. What You'll Learn: How to build an effective PQC migration roadmap starting with a cryptographic inventory assessment. Why the 2035 deadline is just the end of the journey, not the beginning, of quantum-safe implementation. The essential role of crypto agility in maintaining long-term security resilience. How to evaluate whether hybrid cryptography schemes are right for your organization. Why "harvest now, decrypt later" attacks pose an immediate threat to sensitive data. Practical steps organizations can take in the next 12 months to begin PQC migration. How NIST’s standardization process is creating a toolbox of algorithms for different use cases. Why collaboration between government agencies, industry, and vendors is crucial for a successful transition. Dustin Moody is a mathematician leading the post-quantum cryptography standardization project at the National Institute of Standards and Technology (NIST). Since 2016, he has led one of the most consequential cryptographic initiatives of our time, selecting and standardizing algorithms that will secure digital systems against quantum threats. As the principal architect of NIST’s post-quantum cryptography standards, Moody has played a pivotal role in establishing the 2035 migration timeline and crafting crucial guidance for organizations transitioning to quantum-safe cryptography. His work bridges the gap between theoretical cryptography and practical implementation, helping organizations understand and prepare for the post-quantum era through crypto agility, risk assessment, and strategic planning. Moody’s expertise, combined with his collaborative approach, makes him a leading authority on securing digital infrastructure against emerging quantum threats. The year 2035 might sound far away, but if you're a large organization, your migration timeline starts now. As Dustin Moody warns, this isn’t going to be a quick plug-and-play switch. The good news? NIST has laid out a clear roadmap. Here’s how to get started step by step. Your Roadmap to Post-Quantum Readiness: [03:55] Step 1: Appoint a PQC Taskforce and Map Your Migration - 2035 marks the end of your post-quantum transition, not the beginning. Large organizations may need a decade or more to migrate fully, meaning the planning must start immediately. Moody recommends building a dedicated internal team to lead the charge, assigning ownership, and developing a migration roadmap tailored to your systems and dependencies. The first foundational task is a cryptographic inventory, a deep dive into all the ways cryptography is used in your infrastructure. This includes both internally developed systems and supply chain components. Engaging with vendors, suppliers, and customers early ensures alignment and reduces friction later in the transition. Key Question: Have you built a dedicated team and started your roadmap, including a cryptographic inventory? [13:22] Step 2: Design for Agility from Day One - Crypto agility isn’t a future nice-to-have; it’s a current necessity. Organizations need the ability to adapt cryptographic algorithms over time, responding to new threats and evolving standards without disrupting live systems. NIST’s formal definition of crypto agility includes the flexibility to update cryptographic components across software, hardware, protocols, and infrastructure—seamlessly. Implementing agility now ensures you’re not locked into today’s choices and gives you options to respond quickly if vulnerabilities are discovered down the road. Key Question: Are your systems built to evolve or will they need to be rebuilt the next time the landscape shifts? [18:24] Step 3: Protect Long-Lived Data from Quantum Exposure - Quantum threats aren’t theoretical; they’re already impacting data security. According to Dustin, adversaries are actively collecting encrypted data today with the intent of decrypting it later, once quantum computing reaches maturity. This makes post-quantum readiness especially urgent for industries that manage data with long shelf lives—such as healthcare, finance, critical infrastructure, and national security systems. Even if your data is secure now, if it’s still sensitive a decade from now, it’s already vulnerable. While symmetric encryption like AES offers partial protection, the public-key encryption methods used to exchange keys are often the weakest link. Organizations must begin assessing where these vulnerabilities exist and how to mitigate them. Key Question: Are you still treating quantum threats as a future problem or are you protecting your data from being decrypted tomorrow? [25:00] Step 4: Build Momentum with a 12-Month Action Plan - You don’t need to solve everything in a year, but you do need to start. The next 12 months should be focused on building momentum: resourcing your PQC strategy, launching your inventory, and plugging into real-world guidance from initiatives like NIST’s National Cybersecurity Center of Excellence. Use this time to learn from early adopters, experiment safely, and begin aligning teams around risk, infrastructure, and timelines. The transition may span a decade, but your first steps start today. Key Question: What progress will your organization be able to show by this time next year? Episode Resources: Dustin Moody on LinkedIn NIST Website Johannes Lintzen on LinkedIn PQShield Website Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
Quantum risk is a business risk—and Signal Messenger isn’t waiting for quantum computers to arrive. In this episode of Shielded: The Last Line of Cyber Defense , Johannes Lintzen welcomes Rolfe Schmidt, Research Engineer at Signal Messenger, to explore how one of the world's most privacy-focused messaging platforms implemented post-quantum cryptography—even with a lean team. What You'll Learn: How Signal’s lean team structure shaped their pragmatic, step-by-step approach to PQC migration Why hybrid cryptography serves as both a transition strategy and long-term security measure The strategic decision-making process behind prioritizing Harvest Now, Decrypt Later protection How to integrate post-quantum updates into regular product development workflows The challenges and potential solutions for implementing quantum-safe zero-knowledge proofs in metadata protection How Signal’s bandwidth optimization enables post-quantum security without compromising user experience Why inventorying cryptographic assets and understanding their purpose is crucial before starting PQC migration The importance of collaboration with the research community when facing unsolved cryptographic challenges How Signal’s evolving ratcheting protocol demonstrates the need for flexibility in early-stage PQC standardization Rolfe Schmidt is a Research Engineer at Signal Messenger, where he spearheads the organization's post-quantum cryptography initiatives. As the cryptography engineering lead, he has been instrumental in implementing Signal's groundbreaking post-quantum secure messaging protocols, including the successful deployment of ML-KEM (formerly Kyber) for harvest-now-decrypt-later protection in 2023. Schmidt's expertise spans cryptographic protocol design, zero-knowledge proofs, and secure messaging systems, making him a key figure in Signal's transition to quantum-safe security. His work has directly impacted billions of users across platforms that implement the Signal protocol, including WhatsApp and Google Messages. Here’s your step-by-step guide to how Signal made post-quantum readiness real—no massive team or budget required. Your Roadmap to Post-Quantum Readiness: [03:25] Integrating PQC into Regular Development Workflows – Rolfe explains how Signal treats post-quantum cryptography (PQC) migration as an ongoing part of their product development lifecycle rather than a standalone initiative. By embedding PQC into regular workflows, they avoid treating quantum security as a distant or isolated challenge. Instead of waiting for a "perfect time" to act, Signal continuously assesses threats, evaluates trade-offs, and prioritizes based on resource availability and user risk. This pragmatic approach allows their small team to make incremental, meaningful progress toward quantum resilience while keeping up with day-to-day product demands. Key Question: Are we integrating PQC into our current workflows or waiting for a separate initiative to start? [04:55] Prioritizing Harvest Now, Decrypt Later Protection – In early 2023, Signal prioritized protection against Harvest Now, Decrypt Later (HNDL) attacks—where adversaries capture encrypted data now with the intent to decrypt it when quantum computers become available. Rolfe highlights how they made this decision before PQ standards were finalized, confident that MLKEM (formerly Kyber) had reached sufficient maturity. By developing a hybrid encryption protocol, they added quantum resistance while maintaining their existing security guarantees. The lesson? Organizations can act today, even before the standards landscape is fully settled, by choosing well-supported, low-risk hybrid approaches. Key Question: Are we waiting for perfect standards, or are we mitigating immediate HNDL risks now? [09:36] Taking a Modular Approach to PQC Migration – Signal breaks down PQC migration into modular, manageable steps rather than attempting an all-at-once overhaul. Rolfe shares how they evaluate each system and service individually, applying post-quantum upgrades where it makes the most sense—such as updating hardware enclaves or secure channels—without waiting for a full platform redesign. This modular approach allows for gradual implementation, reduces operational risk, and helps teams build PQC familiarity over time. Key Question: Are we breaking PQC migration into smaller, actionable pieces or stuck planning a single massive shift? [17:24] Planning for Authentication Migration: A Three-Bucket Approach – Signal approaches authentication migration by categorizing it into three distinct areas: general signatures, user identity proofs, and metadata protection. Rolfe shares how they have clear plans to add quantum-safe digital signatures as hybrid solutions and integrate these changes into their standard product updates. Their method shows that organizations can prepare for authentication migration incrementally, building familiarity with PQ signature libraries now to ensure a smooth transition later. Key Question: Do we have a phased plan for migrating authentication and digital signatures, or are we postponing decisions until the threat is imminent? [29:23] Practical First Steps for PQC Migration – Rolfe emphasizes the importance of starting with a comprehensive cryptographic inventory—identifying where public key cryptography is used, why it’s used, and the consequences of quantum compromise. This analysis naturally prioritizes migration tasks and highlights areas where existing PQ solutions can be applied immediately. For challenges without clear answers, engaging the research community can uncover new pathways. Rolfe’s advice: Don’t wait for a mandate—take inventory, prioritize, and start small. Key Question: Have we completed a cryptographic inventory and risk assessment, or are we still mapping our exposure? Episode Resources: Rolfe Schmidt on LinkedIn Signal Messenger Website Johannes Lintzen on LinkedIn PQShield Website Want exclusive insights on post-quantum security? Stay ahead of the curve—subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
In the premier episode of Shielded: The Last Line of Cyber Defense , Johannes Lintzen welcomes Bas Westerbaan , Research Engineer at Cloudflare , to break down real-world post-quantum migration challenges and solutions: Cloudflare’s early PQC adoption - lessons from years of real-world implementation Why you need two migrations (encryption today, authentication next) How to secure executive buy-in & conduct a cryptographic inventory The hidden performance & compatibility challenges of PQC deployment Why vendor readiness & regulatory compliance will shape adoption Bas Westerbaan is a Research Engineer at Cloudflare, specializing in post-quantum cryptography and its practical implementation at scale. With a PhD in theoretical quantum computing from Radboud University and experience across academia and industry, including roles at UCL and PQShield, Westerbaan brings a unique perspective to the intersection of mathematical theory and real-world cryptographic engineering. He has been instrumental in Cloudflare's post-quantum initiatives since 2017, leading efforts in implementing quantum-safe encryption and helping shape the company's phased approach to post-quantum migration Want exclusive insights on post-quantum security? Stay ahead of the curve - subscribe to Shielded: The Last Line of Cyber Defense on Apple Podcasts, Spotify, and YouTube Podcasts. ✔ Get insider knowledge from leading cybersecurity experts. ✔ Learn practical steps to future-proof your organization. ✔ Stay updated on regulatory changes and industry trends. Need help subscribing? Click here for step-by-step instructions.…
Welcome to Shielded: The Last Line of Cyber Defense, the podcast that explores the urgent need for quantum-ready cybersecurity. Hosted by Jo Lintzen, we dive into the world of post-quantum cryptography, examining how businesses and industries can prepare for the upcoming quantum revolution. From practical steps to real-world case studies and expert interviews, Shielded is your essential guide to navigating the future of cybersecurity. Subscribe now and stay one step ahead in the quantum era.…
ברוכים הבאים אל Player FM!
Player FM סורק את האינטרנט עבור פודקאסטים באיכות גבוהה בשבילכם כדי שתהנו מהם כרגע. זה יישום הפודקאסט הטוב ביותר והוא עובד על אנדרואיד, iPhone ואינטרנט. הירשמו לסנכרון מנויים במכשירים שונים.