Understanding the Blast Radius of a Cryptographic Change

[music] So every organization has to change the cryptography in their source [music] code eventually. There can be any number of triggers. Um an auditor flags a finding, a vendor deprecates an algorithm [music] and postquantum road map lands on the engineering team's plate. So anytime this [music] kind of change happens, it's interesting that it's not actually making the change itself that's the hard part. Swapping an algorithm is fairly [music] easy. The hard part is actually understanding the blast radius of that change once you make it. Cryptography underpins absolutely everything. So knowing you know what are [music] the the systems the dependencies the repositories the applications what are all of the things touching [music] you know that piece of photography that you are changing is often invisible to most people [music] and shows up in the form of production outages that you never expected after you've made a seemingly simple change. So [music] this leaves a lot of organizations in a really tough spot. they often decide, we know something's going to break, so we're going to [music] leave the risk in place or they make the change and [music] sort of reserve three more weeks to fix all of the things that that unexpectedly broke after they did. [music] And this is really the gap that Thread Point solves is we help you understand the impact of that change before you make it. So, Threpoint will actually classify every cryptographic asset in your estate [music] as a classical or quantum risk. Uh, but much more importantly, we'll actually show you how to trace that change all the way through your environment through all the dependency it touches so that you can change it safely without [music] breaking something. So I think the important thing for organizations to remember because many are not ready to pursue a quantum migration yet. But whether you are moving to postquantum cryptography or deprecating an algorithm that your auditor flagged 15 years ago, the muscle is still the same. And [music] really learning how to do it now to find where it is and understand what it touches um will put organizations in a much better position to do a quantum migration whenever they are ready. So think about how these dependencies actually work. An algorithm is not, you know, or a hash function. They're not just sitting in one place. [music] They are referenced by dozens of repos. They're called across multiple functions. [music] There are things that you cannot possibly see within even your own internal environment databases. When you make a change, things that you would never think of, like is the database I'm storing [music] this thing in actually capable of storing the new value if I improve the encryption. There are so many downstream effects and with something like a hash function, [music] if you change your encryption and the data underneath it wasn't decrypted before you did it, you will never get that data back. [music] So the impact is enormous and it really often can be a one-way street. Let's take a look at a quick example in this demo organization. Let's [music] say for example that an auditor has flagged unsafe usage of Shaw 1 in a specific application. You can very quickly understand the full graph of your cryptographic estate. Not just your cryptographic assets, which would [music] be any kind of basic inventory, but the true trace of everything that it touches. You can use these filters [music] at the top to very quickly filter this universe down to the specific assets that they're looking for. In [music] this case, Shaw 1. Narrow it down to that actual business application that is in scope [music] for the audit. And now we're looking at a much more manageable six cryptographic assets that need to be migrated, which sounds [music] simple, right? Make a swap in six places. But when we take a look at this shared signature that all of these five hashes [music] are are interacting with and click on showing the data flow, this reveals a much different story and this is really where we have some information [music] that the team can really work with. So when we click on this crypto asset, we can now see that it has a pretty significant blast radius. It touches five different repositories [music] um you know two external resources and and most critically there are two [music] external APIs that would break if this change were made out of sequence. So looking at this, you have all the context [music] that you need. It's shortening a process that would often be months of forensic manual discovery into a few short minutes. Then you can click on migration plan and immediately understand where to go from here. As you can see in this case, we've got three different phases that need to [music] take place. Um we have 18 different tasks, two of which require external coordination. You can drill into these phases, [music] export them to Jira. We use a process so that you can easily view the difference in your code and even um [music] use a merge ready PR so that this work really becomes on autopilot. So our goal is to [music] take the mystery out of this. We obsess over cryptography changes so that you don't have to. You can really trust this migration plan to do [music] the work for you so that you can get the teams back to the work that they came to do that day. The first is just the discipline and [music] the focus. Cryptography is not something that everybody understands even you know incredible security experts. Our CTO is Dr. Zufakar Ramzan. He's one of the [music] nation's leading experts in cryptography. This has been a lifelong you know passion and expertise for him. [music] He's really helped us assemble a team of worldclass cryptographers, AI engineers who deeply understand not only cryptography but what it's like to you know do cross [music] repository data mapping and really you know approach this in a way that is sustainable. Um this is not something that your LLM will be able to do on your behalf with a simple prompt. It [music] requires a lot of discipline and focus that we can really you know bring to the table long term. Um and we are not a new company. We are [music] you know pursuing a new problem in a different way. But we are our parent company point has been around for [music] many many years is a absolute leader in the cyber security space and really gives us the backing that we need you know for longevity [music] and stability long term. Great [music] question. And you know, we've been cryptography nerds for a long time, but the quantum migration and the looming threat of [music] a 2030 migration deadline has really made this everybody's problem and not something that [music] you can sort of sweep under the rug. When you think about, you know, cryptographic risk in a [music] sea of other vulnerabilities, it often gets, you know, swept over a because there's not expertise and and b because often it's a risk that you you can't see and it breaks silently. [music] So with quantum migration looming, you know, customers are going to begin asking companies [music] to prove that they are quantum ready. Depending on the customers you serve, um it will be just a non-negotiable. So [music] this risk is real. It's it's coming soon. And I think you we've seen so much evidence that even minor cryptographic changes [music] can take organizations literal years, 5, 15 years to change. So starting to prepare for quantum now is inevitable. So when we think about why this problem isn't solved [music] today, there are scanners everywhere, right, that are going to find the vulnerabilities. And [music] when we talk to companies, they don't need any more help finding vulnerabilities in their code. That part is solved. They also don't really need help, you [music] know, coding again the change. What they need help with and the gap that we're really solving is, okay, if they know the problems there, what do I what do I need to [music] do first, second, and third in order to safely change it? And and that's really where we can help.