Post-quantum & security, explained

Why post-quantum, why now

• Why post-quantum, and why nowEveryone
• Harvest now, decrypt later: the reason the clock is already runningEveryone

How to use this knowledge base

• How to use this knowledge baseEveryone

Quantakrypto services

• Quantakrypto services: audit, tooling, training, certificationLeadership

The road to quantum-readiness

• The road to quantum-readinessLeadership

Cryptography basics

• Cryptography basics: the pieces the quantum threat rearrangesEveryone

The quantum threat

• Shor vs Grover: what breaks and what only weakensIT & security

PQC algorithm families

• PQC algorithm families: lattice, hash-based, and the ones that failedIT & security

Crypto-agility & hybrids

• Crypto-agility and hybrids: changing algorithms without a rewriteIT & security

NIST PQC standards

• The NIST post-quantum standards, and what each one replacesIT & security
• FIPS 203 (ML-KEM): the standard that replaces RSA and ECDH key exchangeIT & security
• Post-quantum signatures: ML-DSA, SLH-DSA, and FN-DSA comparedIT & security

NIST SP 800-63B

• What NIST SP 800-63B actually says about passwordsIT & security
• Why 800-63B dropped forced rotation and complexity rulesLeadership

CISA guidance

• CISA's post-quantum roadmap: inventory, engage, prioritizeLeadership
• CISA on phishing-resistant MFA and Secure Our WorldEveryone

FIDO2 / WebAuthn / passkeys

• How FIDO2 and WebAuthn make phishing structurally impossibleIT & security
• Device-bound vs synced passkeys: which to requireIT & security

IETF, ETSI, BSI & ISO

• IETF and hybrid TLS 1.3 key exchangeIT & security
• ETSI, BSI, ISO/IEC and the rest: who does whatLeadership

Compliance mapping

• Which standard satisfies which obligationLeadership
• The US federal post-quantum mandates, mappedLeadership

Migration lifecycle

• The PQC migration lifecycle: discover, assess, prioritize, plan, execute, validateIT & security
• From inventory to roadmap: turning findings into a sequenced planLeadership

Cryptographic inventory & CBOM

• What belongs in a cryptographic inventory, and how to discover itIT & security
• CBOM: expressing your cryptographic inventory in CycloneDXIT & security

Risk & prioritization

• Prioritizing migration by data lifetime and HNDL exposureIT & security

Crypto-agile architecture

• Crypto-agility: designing so the next algorithm change isn't a rewriteIT & security

Migrating by domain

• Migrating TLS and network encryption to post-quantumIT & security
• Migrating PKI and certificates to PQC signaturesIT & security
• Data-at-rest, code signing, secrets and identity: the other migration domainsIT & security

Hybrid deployment

• Hybrid deployment: running classical and PQC side by sideIT & security

Testing & validation

• Testing PQC: interoperability and performance before you commitIT & security

Rollout & supply chain

• Rollout and supply-chain readiness: the crypto you don't controlLeadership

Checklists & templates

• The PQC migration master checklistIT & security

Accounts & passwords

• Strong passwords that actually workEveryone
• Why a password manager is the single best upgrade you can makeEveryone

MFA & passkeys

• Turn on MFA, and move to passkeys when you canEveryone

Spotting phishing

• Spot a phishing email in ten secondsEveryone

Social engineering

• Recognizing social engineering, and verifying out of bandEveryone

Mobile & device security

• Keep your phone and laptop secureEveryone

If something goes wrong

• What to do if you clicked, or think you're compromisedEveryone

Password policy & IAM

• A modern password policy that follows NIST SP 800-63BIT & security
• RBAC, least privilege, and joiner-mover-leaverIT & security

MFA at scale

• Deploying phishing-resistant MFA across the orgIT & security

Password manager deployment

• Choosing and deploying an enterprise password managerIT & security

Email authentication

• Email authentication: SPF, DKIM, and DMARC with alignmentIT & security

MDM & endpoint

• MDM and endpoint hardening: a baselineIT & security

PKI & certificates

• Certificate management and PQC readinessIT & security

Key management

• Key management with KMS and HSM, built for agilityIT & security

Monitoring & enforcement

• Monitoring and enforcing identity policyIT & security

Credential-compromise response

• Containing account takeover the right wayIT & security

Policy templates

• Identity policy templates and rollout checklistsIT & security

Standing up a program

• Standing up a post-quantum migration programLeadership

Leadership briefing

• Briefing leadership on quantum risk: the risk and the askLeadership

Metrics & reporting

• Measuring and reporting post-quantum readinessLeadership

Awareness program design

• Designing a blame-free security awareness programLeadership

Third-party risk

• Assessing third-party and vendor post-quantum readinessLeadership

qScan & tooling

• qScan: cryptographic discovery and readiness scoringIT & security

GitHub & CI

• Wiring cryptographic scans into GitHub and CIIT & security

Hands-on how-tos

• How to run your first cryptographic scanIT & security
• How to enable passkeys on your accountsIT & security
• How to deploy DMARC for your domainIT & security

Primary sources

• Primary sources: PQC standards and authoritative guidanceEveryone

Further reading

• Curated further reading on post-quantum and modern securityEveryone