How trust is built, operated and changed.

Identify the actor. Limit the authority.

Authentication establishes who or what is requesting access. Authorisation determines which actions are permitted in a particular context. Both people and non-human identities need an owner, appropriate permissions and a way to revoke access.

Begin with an inventory of identities and high-impact actions. Review privileges, credential lifetime and how permissions change when a role, task or system changes.

Reference: NIST: identity and authority of software agents.

Certificates are operational dependencies.

A public-key certificate binds an identity to a public key and is signed by an issuing authority. Systems validate a chain of trust and other conditions when using certificates. The surrounding private keys, issuance policies and lifecycle processes matter as much as the certificate itself.

Map where certificates are used, who owns them, expiry dates, renewal methods and dependencies. Test renewal and emergency replacement; an inventory is useful only if it stays current.

Reference: NIST NCCoE: TLS server certificate management.

Different controls solve different problems.

Encryption protects confidentiality; message authentication and signatures help establish integrity and authenticity; hashing produces a digest used in many security constructions. Symmetric cryptography uses shared secret keys, while public-key cryptography uses mathematically related public and private keys.

Cryptography depends on implementation, configuration and key management. Avoid presenting any single algorithm as a complete security solution.

Reference: NIST: cryptographic key management.

Find what you will eventually need to change.

Record the applications, protocols, certificates, libraries, hardware and vendors that use cryptography. Include ownership, business criticality, data sensitivity, upgrade paths and known unknowns. A cryptographic bill of materials can support this work, but its completeness depends on discovery methods and supplier evidence.

Reference: Australian Cyber Security Centre: post-quantum questions for vendors.

Plan for a changing cryptographic future.

A sufficiently capable quantum computer could undermine widely deployed public-key cryptography. The timing is uncertain, and not every cryptographic mechanism is affected in the same way. Long-lived sensitive information and difficult-to-replace systems deserve early attention.

Preparation starts with understanding dependencies and data lifetimes, rather than claiming a present capability to break current systems.

Reference: Australian Cyber Security Centre: prepare for post-quantum cryptography.

Transition is a programme, not a switch.

NIST published FIPS 203 for ML-KEM key establishment and FIPS 204 and 205 for digital signatures. These standards address different functions; adopting one does not automatically make an entire service secure.

Check vendor support, interoperability, performance, certificate and key management, and applicable jurisdiction-specific requirements. Pilot changes and plan recovery before production rollout.

References: NIST post-quantum standards · Australian transition guidance.

A shared ledger still has many attack surfaces.

Security depends on the network, smart-contract code, signing and key custody, application interfaces and external data feeds. A ledger does not automatically make the software or information around it trustworthy.

Review access control, transaction approval, contract upgrade paths and external data dependencies. For quantum readiness, inventory signature schemes and consider how keys and assets could migrate; approaches depend on the network and are not yet universal.

Reference: NIST: token design and management overview.

Put controls around consequential actions.

Agents can combine retrieved information, tools and decisions. Treat retrieved content as untrusted input, restrict tool permissions, validate actions in the systems that execute them and record outcomes. A human review route should be available when authority or policy cannot be established.

Reference: NIST: design tenets for agent identity.