Hygiene now, migrate later

There is a test server in your network from 2019. It is still reachable from the internet, and it still accepts TLS 1.0. It is not in the CMDB, so no monitoring agent was ever installed and no scan ever runs against it. Every report says all is fine.

Ask a security team which cryptography runs in their network, and you’ll probably get a confident answer, based on the policy, the register and the last pen test. What runs on the wire often differs. The problem is that NIS2 policies and post-quantum migration plans start from that answer.

Before you can migrate, you need the real list. That is why our approach is hygiene now, migrate later. Hygiene means knowing what you run and cleaning up weak spots such as old protocol versions, broken ciphers and expired certificates. It improves your security whatever the date of Q-day. We start at the edge since that’s the most important attack surface.

The host-first trap: you only see what you already know

The obvious route to an inventory runs through your hosts. You install an agent on every server, scan every machine and combine the results. It feels thorough, and it fits the register you already keep. It also has four problems.

• It misses what is not registered. Your agents are installed on the hosts you know about, and each one only reports on its own host. The test server from 2019 is not on that list, so your scan never sees it. Host-first gives you a complete picture of the systems you already knew about.
• It takes years. Every host needs an agent, an approval, a test and a change window. Across thousands of servers, that is a project that never finishes.
• It needs access everywhere. Agents require privileged access to the very systems you want to protect.
• It adds risk. Every agent is new software on a critical system.

Host scanning has its place. It sees what the network cannot, such as encryption of stored data and crypto libraries in code. The question is where you start.

Outside-in: starting at the edge

We believe crypto discovery should start where an attacker starts, at the edge of your network. Every organisation has servers that face the outside world, such as its website, mail server, VPN gateway and API endpoints. Each of them negotiates encryption with anyone who connects, which makes them the most exposed part of your estate. A single probe just behind your firewall sees those connections, and the ones your own systems make to the outside.

What turns up at the edge shows which internal systems deserve attention first. Inside and outside together give the full picture. The order matters, and we think the edge comes first. Here’s why:

• Least intrusive. One probe at the edge needs no agents and no access to your hosts.
• Fast to value. It shows how your exposed servers are used, without a rollout project.
• Highest exposure first. Traffic that crosses your perimeter is the traffic an attacker can record today and try to decrypt later.

Two ways to see what crypto you run

When we started building, we kept seeing tools that looked at the wire in only one of two ways. Scanners ask each server what it accepts. Network monitors listen to what systems use. Each answers half the question.

• What systems negotiate. Every encrypted connection opens with a handshake in which client and server agree on the protocol version, cipher suite and key exchange. Listening to those handshakes shows which cryptography is in use and between which systems, without sending or decrypting anything.
• What servers accept. A server can keep a broken cipher enabled for years without ever negotiating it. Listening misses that. Asking the server directly what it accepts shows it is still on the menu.

Crypto discovery is rarely a choice between the two. Together, they turn up the ciphers everyone believed were switched off years ago.

What a cryptographic inventory needs to do

An inventory is where hygiene starts. To be worth the effort, it has to do more than list what you have.

• Match what runs. A register only stays useful when you check it against the wire. That check turns up shadow systems, which are plausibly yours but missing from the register, like the test server from 2019. It also turns up drift, meaning registered systems that have moved away from your own crypto policy, such as a server that was hardened once and later rolled back.
• Lead to fixes. Findings only help once they are grouped into the handful of changes a team can make, such as disabling TLS 1.0 and 1.1 on every server that still allows it.
• Prove progress. A fix counts once the weak cipher has disappeared from the traffic. That makes progress something you can show an auditor. And since certificate lifetimes are shrinking towards 47 days in 2029, an inventory that is checked once a year is out of date long before the next check.

Beyond insights: from handshakes to a handful of fixes

Visibility is where most discovery tools stop. But millions of logged connections are a bookshelf nobody reads. That is why we built Eon Insights, our crypto discovery platform. It shows what runs, and it turns what it finds into a short list of fixes.

Eon Insights works in the same order as this post. It starts with a single probe at your edge. Inside, agentless probes at a few strategic points in your network listen to the handshakes between your systems, and a scanner asks each server what it accepts. From there, the data moves through four steps.

1. Observe. Handshakes from the probes and answers from the scans.
2. Inventory. The connections become the servers, clients and certificates you manage, checked against your register.
3. Classify. Each system is rated on classical strength and on quantum exposure. A system can be fine today and still vulnerable to harvest now, decrypt later. A policy then decides what deserves an alert.
4. Remediate. Alerts that share a fix are grouped into one action, which your team can work through or send on to your SIEM. An alert closes once the problem has gone from the traffic.

Each part of this approach combines two views: the outside and the inside, the network and the hosts, listening and asking. Leaving one out leaves gaps. What decides whether the project ever finishes is the order in which you use them.

Where to begin

You don’t need a full rollout to start. The free Cryptography Maturity Benchmark is a fifteen-minute self-assessment that shows where your organisation stands on people, process and technology. Rather have us do it? The Cryptography Baseline Assessment gives you an expert-led look at your perimeter, conversations with your team and a prioritised roadmap. Eon Insights takes it from there and keeps watching, edge first and then inside.

Talk to us about Eon Insights →

Hygiene now, migrate later.