Possession is not identity.
A credential proves possession. It has never proved identity, and every control on your estate is downstream of that one unexamined assumption, approving, correctly, exactly what it was configured to approve. The argument in full, in four parts.
The attack looks legitimate.
A stolen credential does not produce a suspicious instruction. It produces a correctly signed one, and every check you own approves it, correctly.
The two instructions are indistinguishable at every point your systems can see. That is the failure: not a broken lock, but a perfect one, opened with the right key by the wrong hands.
And attacking you is free.
Both of these doors are locked, and neither will ever open. The one on the left is being tried by a machine, right now, at no cost, and the field around it never changes. The one on the right is yours, and it remembers every attempt.
Everywhere else
Here
You stopped. Nobody stopped you.
We do not only have to stop an attacker. We make continuing cost more than stopping.
Every attack ends in one of two acts. There is no third.
Money moves, a setting is altered, an order is carried out. Value and control in transit.
Data leaves, and once it has left it cannot be un-read. Data at rest.
Everything an attacker does before either act is preparation, and the preparation looks much the same whether the target is a bank, a hospital, a network operator or a power station. We read the preparation, so that the warning arrives before either act does.
Loss reporting counts the first act once it has become a payment. The second act, and the preparation behind both, largely goes uncounted.
Read the series: The Uncounted →
One layer, beside the systems you already run.
It answers the question your existing controls were never designed to ask, which is whether the hands on a valid credential are the ones it was issued to, and it is built to keep answering it after the cryptography beneath today's credentials has been retired.
- Beside the path, by default.It advises and your systems decide. It begins off the transaction path, can be removed at any stage, and moves in-line only if you decide it should, on latency terms agreed in advance.
- It warns before the act, with the reasons attached.Probes that conventional tooling files as unrelated alarms are read as one campaign, and every warning shows its working, reviewable by your team, your auditors and your regulator.
- Protection that outlasts the algorithm.Data taken today can be read later. What we protect is protected against that later reader, and the cryptography can change without the systems above it being rebuilt.
- Built for the failure mode, not the industry.The two acts do not change from a bank to a substation; only the consequence does.
The calendar is set by other people.
The window to move early is the current procurement cycle, not the next one. The institutions that migrate last will be the ones whose archives were worth taking first.