Scanning and Building an Inventory of Deployed Ciphers to ensure Post-Quantum Readiness

Challenge

Create CI/CD stages to ensure that all ciphers currently in use by deployed applications, comply with organizational goals for ensuring post-quantum readiness.

Solution

The project began with a detailed evaluation of current stages within the code pipelines as well as gaining an understanding of both security/compliance requirements and existing cipher implementation techniques by various development teams. Once a thorough understanding was in place, an analysis of appropriate tools and techniques for creating a cipher inventory was performed.

Analysis findings and approach:

• Dynamic scanning would be required. Very often ciphers are not configured within code but instead are defined by the underlying third-party services and libraries being used. Therefore scanning would need to be performed against deployed applications to identify the ciphers being used various combinations of operating systems, languages and libraries rather than statically.
• Scanning could be run in parallel with existing dynamic security scans within the code pipelines in order to maintain development velocity.
• A Cryptographic Bill of Materials (CBOM) format would need to be standardized to allow for automated analysis of every application.
• Storage of CBOM data would need to be created along with alerting measures and report generation tools allowing for easy digestion for security and compliance teams along with quick remediation (if necessary) by development teams.

Outcome

• The project successfully and unobtrusively future proofed the organizations goals regarding post-quantum readiness across all deployment environments.
• Security teams were able to quickly gain an understanding of existing ciphers being deployed and help to ensure that applications were complying with organization objectives.
• Development teams gained immediate awareness if any non-compliant ciphers were in use by their applications without any additional friction.
• Compliance teams were able to easily maintain a list of approved ciphers knowing that any changes would be immediately identified going forward.