Crypto agility puts IT Architecture in the Spotlight

Leaf Mound plc tackles crypto agility head on to bring its IT architecture up to speed for “Q-Day”. Find out how CEO Ms. Spiny and CISO Mr. Mealworm plan to replace cryptographic assets and automate processes to ensue the company is optimally placed for the new era of IT security. The following article – humorously enriched with fictitious protagonists – illustrates theories as well as concepts and concrete experiences from practice.

The hedgehogs of Leaf Mound plc have enjoyed many years of success, mainly thanks to the consistent implementation of their “buy before make” strategy. This is also due to the responsible approach of the IT architecture team, which always endeavours to ensure that the IT environment remains stable and the systems function smoothly.

Ms. Spiny (CEO) has recently been reading exciting articles from the world of IT security over the Easter holidays. While she was enjoying the right ear of her third chocolate Easter bunny, a piece about “crypto agility” that discussed the upcoming “Q-Day” really stood out to her. You can either read the whole article or a summary of what she read:

Crypto agility definition

Crypto agility describes the ability to react quickly and flexibly to changing cryptographic requirements. It focuses on the visibility and processes relating to an organisation’s crypto assets.

Crypto agility requires transparency about the use of cryptography in an organisation (e.g. protocols, libraries, cryptographic algorithms and certificates, etc.) and the ability to identify and resolve problems swiftly. An organisation that has implemented crypto agility can replace obsolete crypto assets without significantly affecting the existing system infrastructure. We’ve already reported on this in more detail in a separate blog article.

Q-Day

“Q-Day” is the day on which a powerful quantum computer will be able to crack conventional cryptographic algorithms.

By this point at the latest, the vulnerable cryptographic algorithms must be replaced by algorithms that are resistant to quantum cryptography, because otherwise the bad guys will “exploit” the computing power of quantum computers to their own ends. The article didn’t say when the Q-Day would be. However, the topic has spurred the CEO into action...

Leaf Mound plc gets moving

You guessed it: at the next IT stand-up meeting of the manager-hedgehogs, Ms. Spiny (CEO) wanted to know how Leaf Mound plc is positioned in terms of crypto agility – in other words, how the crypto assets at Leaf Mound plc. could be substituted.

Mr. Mealworm (CISO of Leaf Mound plc) pricked up his ears. With a shudder, he recalled unscheduled weekend operations needed to quickly patch an actively exploited vulnerability and keep Leaf Mound plc’s customers abreast of the progress of the patching work. That was very unpleasant every time.

He proceeded as follows:

Table 1 “Vulnerability patching” procedure

Every CISO knows these challenges. Lists are drawn up that serve as the basis for the next “hot mission”. Because the information is not updated, it quickly loses its relevance and usefulness. And the ad-hoc exercises start all over again with the next vulnerability...

Key management processes

The CISO also feels the squeeze in another area: key management. The standard processes for key management include generating, saving, renewing and cancelling keys. These processes aren’t only critical for safety reasons: if they’re not executed correctly, inappropriate keys prevent the operation of applications and lead to data loss in the worst case.

Based on the NIST key management document, Mr Mealworm created a drawing for Leaf Mound plc’s internal key management policy:

Figure 1: Internal key management of Leaf Mound plc

The manual processes cost the CISO and IT team a lot of time – quite apart from the fact that there’s no reliable information about the keys, cryptographic algorithms and applications.

The architect enters the scene

Ms. Wagglenose, the IT architect at Leaf Mound plc, makes an appearance at the management meeting. She refers to the CISO’s experience and explains that updating lists is not enough. For a long-term solution, the procedure needs to be standardised and the field of cryptography analysed.

Ms. Wagglenose mentions the following points:

Table 2 Analsysis steps

The first step is therefore to gain knowledge of how Leaf Mound plc’s IT is set up with regard to crypto assets. The keywords are “detection” and “inventor”. Ms. Wagglenose has more to say about this than you might think....

Detection and inventory 

The aim of detection is to find all crypto assets. The information is then updated in the crypto inventory. The crypto inventory can be based on a conventional inventory solution. Key here is that its data model is expandable.

The following crypto assets are of interest to Leaf Mound plc:

• Cryptographic secrets
• Devices with a cryptography function
• Storage location of secrets
• Implementation of cryptographic algorithms, cryptography libraries
• Protocols for cryptography
• Cryptographic algorithms used

The crypto assets mentioned are analysed in more detail below.

How easily detectable are cryptographic secrets 

Cryptographic secrets are more than just keys, as the following list shows. Some secrets are “volatile” and therefore difficult or impossible to detect.

Table 3 Cryptographic secrets

When asked what information regarding the keys might be relevant, Ms. Wagglenose draws a list on the whiteboard in the meeting room:

• Cryptographic algorithm
• Length of keys
• Creation date
• Expiration date
• Version no. (e.g. for rotated keys)
• Key status (not active, active, suspended, compromised, expired)

Cryptographic devices

It helps to know what you’re looking for. There’s a whole range of cryptographic devices that are part of our crypto ecosystem:

Table 4 Cryptographic devices

Storage location of secrets

The way in which secrets are stored has a significant influence on the security of the cryptography used, so storage location must also be recorded in the crypto inventory.

Table 5 Storage location of secrets

Implementation of cryptographic algorithms

Cryptographic algorithms can be implemented by developers in different ways.

Table 6 Implementation locations of cryptographic algorithms

Protocols for cryptography

There are cryptographic protocols for different needs. Protocols can be detected by analysing the network traffic, which itself provides a good overview of the protocols. Here are some representatives:

Table 7 Protocols in the area of cryptography

Data collection

Ms. Spiny, the CEO, thinks that’s all well and good. However, she can’t imagine how this information could be obtained automatically at Leaf Mound plc.

The architect explains that there are two options for collecting information: scanning and agents. There are pros and cons to both, which she summarises here:

Table 8 Scanning vs. agents

Five reasons in favour of the crypto agility approach

It is now clearer that there is plenty of information about crypto assets. But the final question remains: what’s the point of all this?

Practical benefit 1: risk assessment

The information obtained can be used to determine risk, enabling new vulnerabilities to be prioritised for remediation based on the assigned vulnerability.

Ms. Wagglenose shows a (very) pragmatic formula for determining risk based on the information obtained. categorisation is based on a scale 1-4 for the values low, medium, high and very high.

Table 9 Influencing factors for risk assessment

Here are a few examples to illustrate this. The values were quantified according to the above scheme.

Table 10 Examples risk assessment

Practical benefit 2: queries and compliance

Queries from the crypto inventory can provide information about:

• Outdated or weak cryptographic algorithms
• Obsolete libraries
• Rotation requirement for keys
• Storage locations of secrets

Practical benefit 3: key management

Information about cryptographic secrets makes key management easier by providing relevant information, e.g. about the keys used.

Practical benefit 4: patching

The information in the crypto inventory is a good basis for patching. The cryptographic attributes of the relevant components are stored in it. Queries such as “Show all systems on which MD5 is used as a hash algorithm” enable migration to a current algorithm.

Do you remember how Mr. Mealworm went through his list for the “hot mission”? He pondered that if Leaf Mound plc had a crypto inventory, the work steps would be as follows:

Table 11 Procedural steps with crypto inventory

Practical benefit 5: crypto bill of material

As a manufacturer of mobile leaf mounds and hedgehog houses, Leaf Mound plc must comply with EU legislation for exports to the EU. The Leaf Mound products transmit telemetric data such as location, temperature and operating hours to Leaf Mound plc. Mr Mealworm quotes from the proposal for a regulation of the European Parliament and of the Council on cybersecurity requirements:

Article 2, Scope (1):
“This Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network.”

He continues by saying that the crypto bill of material CBOM is an extension of the software bill of material (SBOM) concept. It maintains software BOMs, which are a formal record of the details and supply chain relationships of the components contained in the software elements of a product with digital elements.

Finally, Mr. Mealworm explains the reference to cyber security, which can be seen in the recitals of the regulation: “In order to facilitate vulnerability analysis, manufacturers should identify and document components contained in the products with digital elements, including by drawing up a software bill of materials. A software bill of materials can provide those who manufacture, purchase, and operate software with information that enhances their understanding of the supply chain, which has multiple benefits, most notably it helps manufacturers and users to track known newly emerged vulnerabilities and risks. It is of particular importance for manufacturers to ensure that their products do not contain vulnerable components developed by third parties.”

Crypto agility as an opportunity

The manager-hedgehogs believe that crypto agility is a sound approach. Mr. Mealworm (CISO) and Ms. Wagglenose don’t always see eye to eye, and the CISO considers this to be an opportunity to make his work easier in future and avoid stressful remediation measures. The only steps everyone would like to see simplified are those involving “fixing the vulnerability” and “testing and deploying”. They decide to keep an eye on measures in this regard as a pending issue. In addition, the key management process should be automated to a greater extent because the CISO team at Leaf Mound plc is still spending too much time replacing keys and certificates.

This is no cause for concern for the manager-hedgehogs: they already have a few ideas for optimisation on this topic. In a further step, the hedgehogs are tackling the topic of crypto-agility-“ready” architecture and automation.

You’ll soon find out how the hedgehogs at Leaf Mound plc are tackling this challenge in the second part of this blog series. Sign up for the blog updates to be notified as soon as the second part is published.

Are you interested in making your IT infrastructure cryptographically agile  and taking it to the next level of security? We’ll be happy to assist you in mastering the many challenges of crypto agility together.

Our approach includes a thorough analysis of your existing architecture, with a particular focus on crypto-agility-readiness. We work with you to develop a detailed profile of your strengths and weaknesses. Based on the cryptographic inventory, we identify development and optimisation opportunities so that you can complete the transition towards crypto agility step by step. Ultimately, our goal is to integrate your IT architecture into the cyber landscape in a secure and strengthened manner.