Business Security Weekly (Audio) Say Easy, Do Hard - Crypto-Agility - BSW #440
12 snips
Mar 25, 2026 Josh Marpet, a security professional with hands-on quantum and cryptography experience, joins the conversation. He breaks down crypto-agility and why it demands architecture, automation, and governance changes. Discussion covers discovery challenges, inventory tools and C-BOMs, timelines to 2030, vendor coordination, OT and embedded device risks, and practical first steps like scanners and toolkits.
AI Snips
Chapters
Transcript
Episode notes
Use Existing Tools Before Buying Scanners
- Do not buy an expensive tool immediately; leverage existing scanners, CMDBs, and certificate lifecycle managers you already own.
- Use vulnerability scanners, CLM systems, and CMDB data to find certificates and asymmetric crypto in-place first.
2030 Start And 2035 Enforcement Timeline
- Two regulatory timeline numbers matter: by 2030 NIST-deprecation begins and by 2035 many ciphers will be disallowed.
- Josh Marpet emphasizes discovery is hard and most organizations underestimate how many asymmetric uses they have.
Engage Stakeholders With Strategic Messaging
- Identify stakeholders early and build strategic messaging to the C-suite, board, vendors, and partners for multi-year migration plans.
- Jason Albuquerque stresses relationships and trust are required because migrations will disrupt business units over years.