Cyber Security Archives - Netrust

Why Multi-Factor Authentication (MFA) Is Important

Wei Kee Teo — Thu, 13 Aug 2026 01:30:10 +0000

Cyber threats are becoming increasingly sophisticated, and organisations face growing challenges in protecting critical information and systems. While passwords remain the most common method of authentication, they are vulnerable to attacks such as phishing, credential theft, password spraying, and data breaches. As a result, relying solely on passwords is no longer sufficient to protect business applications, networks, and cloud services.

Multi-Factor Authentication (MFA) provides an additional layer of security by requiring users to verify their identity using more than one authentication factor before access is granted.

The Challenge

Many organisations still rely on usernames and passwords to secure access to business applications, VPNs, and cloud services. However, attackers can gain unauthorised access through sophisticated techniques such as phishing campaigns, brute-force attacks, credential stuffing, and the use of leaked credentials obtained from previous breaches.

Compromised credentials continue to be one of the leading causes of cybersecurity incidents worldwide. A single stolen password can expose sensitive business information, disrupt operations, and cause financial or reputational damage.

By adding an additional layer of authentication, organisations can significantly reduce the risk of unauthorised access, even if a password has been compromised.

Understanding Multi-Factor Authentication

MFA enhances security by requiring users to provide two or more forms of verification before they can successfully authenticate. These factors typically include:

Something you know – such as a password or PIN.
Something you have – such as a hardware token, mobile authenticator application, or security key.
Something you are – such as a fingerprint or facial recognition.

Modern MFA solutions support a variety of authentication methods, including hardware tokens, mobile authenticator applications, push notifications, and phishing-resistant authentication methods, enabling organisations to strengthen access security while balancing usability and user experience.

By requiring users to verify their identity using more than just a password, MFA significantly reduces the risk of unauthorised access, even if credentials are compromised through phishing, data breaches, or other cyberattacks.

Best Practices for MFA Deployment

To maximise the effectiveness of MFA, organisations should consider the following best practices:

Enforce MFA for all remote access and privileged accounts.
Protect critical business applications and cloud services with MFA.
Adopt phishing-resistant authentication methods whenever possible.
Educate users on cybersecurity awareness and phishing threats.
Regularly review authentication policies and user access rights.
Monitor authentication activities and investigate suspicious login attempts.
Disable legacy authentication methods that may bypass MFA protections.

Conclusion

As cyberattacks continue to evolve, MFA has become an essential component of a modern cybersecurity strategy.

By implementing MFA, organisations can significantly reduce the risk of unauthorised access, support regulatory compliance, and strengthen their overall security posture.

Implementing MFA today is a practical and effective step toward protecting users, systems, and sensitive business data against increasingly sophisticated cyber threats.

Contact Us: General enquiries or free consultation

We’re really grateful for giving us a chance to connect with you. Please do not hesitate to ask us anything and we will respond to you asap.

[contact-form-7]

The post Why Multi-Factor Authentication (MFA) Is Important appeared first on Netrust.

Is Your OT Network Really Isolated? Why Trust Isn’t Enough

Kai Jalonen — Thu, 30 Jul 2026 01:30:24 +0000

Guest Contributor, Kai Jolonen, Head of Sales and Business Development, Asia-Pacific of SensorFu

Is Your Operational Technology(OT) Network Really Isolated? Why Trust Isn’t Enough

When we think about protecting Singapore’s critical infrastructure—our power grid, water supply, transport systems, manufacturing plants and healthcare services—we often assume that these systems are safely separated from the internet and corporate networks.

But what if they aren’t?

Many organisations believe their Operational Technology (OT) networks are isolated simply because they were designed that way. Unfortunately, in reality, that isn’t always the case.

Network Segmentation Is No Longer Optional

As more industrial systems become connected and organisations embrace digital transformation, protecting OT environments has become increasingly important.

In Singapore, the Cyber Security Agency (CSA) requires Critical Information Infrastructure (CII) owners to implement network segmentation, separating systems based on their risk level and limiting unnecessary communication between them.

The goal is simple:
If a cyber attack happens in one part of the network, it shouldn’t be able to spread to the systems that keep essential services running.

Segmentation is one of the strongest cybersecurity defences available today.

But there’s one important question many organisations don’t ask:

How do you know your network is actually isolated?

The Hidden Gaps Nobody Sees

Even with the best intentions, network isolation can slowly break down over time.

A firewall rule added during maintenance.
A contractor connecting new equipment.
A routing or VLAN misconfiguration.
An overlooked third-party system.

Individually, these changes may seem harmless. Together, they can quietly create unexpected communication paths between networks that were never meant to talk to each other.

These hidden gaps often go unnoticed because everything appears to be working normally—until a cyber incident occurs.

Verification Is Just as Important as Implementation

Building a segmented network is only the first step.

The bigger challenge is making sure it stays that way.

This is where continuous verification becomes valuable.

Instead of assuming firewall rules and network configurations are working as intended, organisations can regularly test whether traffic can actually cross network boundaries.

Think of it like checking whether a locked door is still locked, rather than simply trusting that someone closed it months ago.

What We’ve Learned from Real Deployments

Over the past decade, organisations using SensorFu Beacon have discovered that network isolation isn’t always as strong as they believed.

In fact, hidden isolation weaknesses have been found in around 80% of deployments.

One of the most common issues isn’t sophisticated malware or advanced hacking techniques.

It’s ordinary DNS traffic.

Systems that should never communicate were quietly exchanging DNS requests, creating unintended pathways between supposedly isolated networks.

In another case, a customer’s own security product unintentionally created a covert communication channel, demonstrating that even security tools themselves can introduce unexpected risks.

The lesson is clear:

Even well-designed environments can contain hidden weaknesses that only become visible when they’re actively tested.

A Real Example

One industrial organisation deployed SensorFu Beacon across its environment to validate its network segmentation.

Within a short period, the solution identified an old firewall rule that was accidentally allowing traffic between two network segments that should have been completely isolated.

The issue had existed unnoticed for years.

Once identified, it was corrected immediately—before it could become a security incident.

Continuous Assurance Builds Real Cyber Resilience

Cybersecurity isn’t just about installing firewalls or meeting compliance requirements.

It’s about having confidence that your security controls continue to work as intended every single day.

For organisations operating critical infrastructure, manufacturing facilities or industrial environments, continuous verification provides that assurance.

Because when it comes to protecting essential services, assuming your network is isolated simply isn’t enough. Verifying it is.

Contact Us: General enquiries or free consultation

We’re really grateful for giving us a chance to connect with you. Please do not hesitate to ask us anything and we will respond to you asap.

[contact-form-7]

The post Is Your OT Network Really Isolated? Why Trust Isn’t Enough appeared first on Netrust.

The Role of Digital Signatures in an AI-Driven World

Kimchav Sov — Thu, 16 Jul 2026 02:00:51 +0000

Today is an era where AI can write a contract, compose an email in a human tone, generate a detailed report, and produce a video that impersonates you. This is getting better every day, so how can we trust what we see?

This is not a new problem, but AI has turbocharged it to a scale we have never seen before.

The good news is that the solution already exists, Digital Signature.

What is Digital Signature?

A digital signature is a mathematical code attached to an electronic document to verify its authenticity. It is created using a private key unique to the signer and can be used to verify that the document was signed by the person who claims to have signed it.

If you wish to find out more about digital signatures, please refer to this blog: https://www.netrust.net/blog/exploring-different-types-of-digital-signatures-and-their-uses/

Why Digital Signatures Matter Now More Than Ever

AI has killed the signals we relied on. For decades, we verified authenticity through subtle human cues: a poorly worded phishing email, a slightly off logo, a tone that didn’t sound like the person.

Digital signatures operate through cryptography, making them difficult for AI to forge. This is not a seal of approval on content. It is a mathematical proof of origin and immutability.

Roles of Digital Signatures in the AI-Driven World

Document

AI can draft a contract and alter a PDF imperceptibly, which is why a cryptographically sealed, timestamped signature chain has become a necessity. A digital signature binds a unique cryptographic key to a document. Any alteration to the document after signing invalidates the signature entirely, making tampering immediately detectable.

Software and Code Integrity

Every piece of software you run, from your operating system to a browser plugin, is increasingly likely to have been partially generated or modified by AI. As AI tools grow more capable of producing convincing, functional code, relying on manual code review alone is no longer sufficient. Code signing provides a verifiable, tamper-evident layer of trust across your software supply chain, ensuring you deploy exactly what the developer published.

Media

Media signing works by embedding a cryptographic signature into a photo, video, or audio file at the point of capture or creation. Standards like the Coalition for Content Provenance and Authenticity (C2PA) allow cameras, recording devices, and publishing platforms to attach a verifiable record of origin directly to the media file. Any AI-generated or manipulated content produced after the fact cannot replicate this original signature, immediately exposing it as inauthentic.

Email and Business Communications

AI can now write emails that sound exactly like your CEO. It can forge documents with flawless letterhead, the right tone, and grammatically correct details. This is where S/MIME email signing comes in. When a signed email arrives, you know three things: it came from who it says it came from, nothing in the message was altered, and no AI impersonated it.

Agentic AI

AI no longer just answers, it begins to act. Agentic AI can browse the web, send emails, fill out forms, execute code, book services, and chain together dozens of tasks without checking back with you at every step. As autonomous agents execute scripts, relay instructions, and take real-world actions without constant human oversight, there must be a cryptographic guarantee that every action is legitimate, untampered, and attributable. Digital signatures ensure that only agents execute verified code, only trust authenticated instructions from other agents, and leave a signed, immutable audit trail of everything they do.

We are entering a world where AI has made it easy to fabricate content, impersonate identities, and alter records without leaving a trace. Every domain we covered in this post is now an active battleground for authenticity. Digital signatures won’t solve everything, but they stand as the foundation of trust, ensuring everything that passes through the digital world remains authentic, secure and accountable.

Contact Us: General enquiries or free consultation

We’re really grateful for giving us a chance to connect with you. Please do not hesitate to ask us anything and we will respond to you asap.

[contact-form-7]

The post The Role of Digital Signatures in an AI-Driven World appeared first on Netrust.

Why Post-Quantum Cryptography Matters Today

Ong Zhen Yu — Thu, 02 Jul 2026 02:00:59 +0000

A while back, I was explaining encryption to my colleague and used this analogy:

“Your data today is locked inside a really strong safe.”

That’s still true, but here’s the part people don’t think about:

What if someone is already copying that same safe and is waiting for the day they can open it?

That’s essentially what’s happening with quantum computing.

Most of today’s security (PKI and digital certificates) relies on encryption methods such as RSA and elliptic curves. They’ve worked well for years. But quantum computing changes the game. It introduces a way to potentially break these systems much faster than we ever expected.

That’s where Post-Quantum Cryptography (PQC) comes in. It’s not just a buzzword; it’s the next step in making sure the “safe” stays locked, even in a quantum future.

The Risk Isn’t “Later” … It’s Already Happening.

A common reaction I hear is:

“Quantum computers aren’t here yet, so we still have time.”

Technically true. Practically risky.

There’s a strategy that attackers are already employing called “harvest now, decrypt later.”

They collect encrypted data today, even if they can’t read it, and store it.

Then, when Q-Day comes (Quantum computers become powerful enough to break widely used encryption protocols), they decrypt it.

So, the real question becomes:

How long does your data need to stay secret?

If the answer is years (and for most businesses, it is), then the risk isn’t in the future. It’s already sitting in someone else’s storage.

So… What Can You Actually Do About It?

You don’t need to rip everything out and start over. But you do need to start moving.

Figure Out Where You’re Using Encryption

Most teams don’t have full visibility here. Encryption is everywhere: servers, APIs, internal apps, even IoT devices.

Start by mapping it out. Especially anything using RSA or ECC.
Make Your Systems Flexible (Crypto-Agility)

One of the biggest mistakes is treating cryptography as something static.

It shouldn’t be.

You want the ability to switch algorithms without rebuilding your entire infrastructure. That’s what crypto-agility is about, and it’s going to matter a lot as PQC standards evolve.
Don’t Do This Alone

The good news is you’re not expected to figure this out from scratch.

Certificate Authorities and security vendors are already working on quantum-safe and hybrid solutions. The smart move is to work with partners who are already testing and rolling these out.

A Few Practical Tips That Actually Help

Start with data that needs to stay secure long-term (financial records, contracts, sensitive customer data).
Turn on logging and monitoring for your certificates. Visibility matters more than people think.
Test your automation scripts early so future changes don’t break production.
Keep an eye on NIST updates, that’s where the standards are being finalised.

Final Thoughts

You don’t need to panic about quantum computing.

But you also can’t ignore it.

The biggest mistake isn’t being unprepared today; it is assuming you can fix everything later. Because if your data is already harvested, “later” might be too late.

Getting started now, even with small steps, puts you in a much better position than playing catch-up down the road.

Ready to make your security simpler and future-proof your data?

Let’s talk about how you can stay one step ahead of emerging quantum risks.

The post Why Post-Quantum Cryptography Matters Today appeared first on Netrust.

Beyond the Firewall: Securing the Enterprise in the Age of Agentic AI

Fareez Noor Mohd — Thu, 18 Jun 2026 02:00:45 +0000

I’ve spent a decade in tech, thinking I had a solid track record of spotting phishing emails, or that I could spot a phishing scam from a mile away. You know the ones with weird content, e.g., “Dear Valued Customer,” or a random bank I’ve never used telling me my account has been locked out.

But lately, things have changed. A few months back, I got an email from a coworker. It sounded exactly like him. It mentioned a specific project we were actually working on. He even used his habit of ending every sentence with “…” instead of a full stop. It was spot on.

And it was 100% fake.

We’re officially in the era of Agentic AI threats. Honestly, it’s a bit of a nightmare for everyone, whether you’re an employer or employee. We’re not just protecting against hackers anymore; we’re up against autonomous software that can pivot, think, and impersonate people we know better than most.

A Reality Check: What’s Actually Hitting Us Now

In 2026, the stuff we used to whisper about at tech conferences is just a normal Tuesday. Here’s what’s keeping me up:

Phishing that ‘lives’: Templates are dead. AI agents are crawling LinkedIn and company blogs to build a psychological profile of you. They do not just send an email; they start a conversation.
Shadow AI ‘Helpers’: My team is great, but they are obsessed with speed. They have started using these little unauthorised AI agents to automate tasks. The problem is that these agents have broad permissions and zero oversight. They are basically a back door we did not ask for.
Malware that evolves: We are seeing code that rewrites itself every time it moves.

For years, we treated security like building a castle: higher walls, deeper complexity. But if the threat is an AI that can fly over the wall, the complexity does not matter.

I had to change my mindset. I stopped looking for ‘bad files’ and started looking for intent.

I started hunting for something that does not just sit on the edge of the network. I needed a ‘digital immune system’. Something that actually understands the context of what’s happening – the network, the identities, and the data itself.

Finding the ‘Truth Layer’

The turning point was realising that identity is the new perimeter. If an AI can pretend to be my boss, any firewall is basically a paperweight.

I moved towards a strategy that hits three big areas:

Behavioural Baselines: Knowing what ‘normal’ looks like so well that even a 1% shift sticks out immediately.
Autonomous Response: If something breaks at 3 am, I do not want an alert. I want a system that shuts it down before anything bad happens.
Unified Visibility: One spot to see everything – cloud apps, servers, and those ‘shadow’ AI agents everyone loves so much.

The Result?

I will not tell you I’m 100% ‘safe’. Nobody is. But I’ve gone from constant anxiety to a kind of informed resilience. The tech we’re using now does not just wait for a virus. It watches the behaviour of everything in the network. It sees that ‘coworker’ is asking for a password and realises that, while the words are perfect, the request can be very strange unless you are alert about it.

It’s about fighting fire with fire. If the bad guys are using AI to scale, we have to use it to scale our own intuition and understanding.

So, how are you handling the shift? Are you still building walls, or are you looking for a better way to see through the noise? If you are ready to move past the uncertainty, contact Netrust if you are interested in an AI threat solution that is with you every step of the way.

The post Beyond the Firewall: Securing the Enterprise in the Age of Agentic AI appeared first on Netrust.

Rethinking Development in the Age of AI

Lin Jian Sheng — Thu, 04 Jun 2026 02:00:02 +0000

From Search Engine to AI: A Developer’s Journey Through Changing Paradigms

As a developer in my 40s, I have seen how our way of working has evolved over the years.

Back then, solving a problem usually meant opening Google and going through multiple tabs—Stack Overflow threads, API documentation, random blog posts, trying different approaches until something finally worked. It was often trial and error, and sometimes more “trial” than “success.”

At the same time, as systems became more complex, we were not just writing code anymore. We had to consider non-functional requirements like security, reliability, and scalability. To meet these demands, we started relying on more tools to support our development work.

Today, with the introduction of AI, things have changed again.

The Shift: From Searching to AI-Assisted Development

Previously, debugging an issue could take hours. You might encounter an exception, search for it online, compare different solutions from various sources, and then try to piece together what works for your specific case.

Now, with AI, the experience is very different.

Instead of navigating across multiple sources, AI can get a consolidated and contextualised response almost instantly. It does not mean that the answer is always perfect, but it significantly reduces the time spent searching and experimenting.

Beyond just asking questions, AI is also evolving into something more powerful, AI agents.

These are not just tools that respond to queries, but “workers” that can perform tasks. They can help generate code, run tests, automate workflows, and even iterate on tasks with minimal input. In a way, we are moving from using AI as a reference tool to working alongside AI as part of our development process.

Naturally, this leads to a big improvement in productivity.

Balancing Innovation with Responsibility

While AI brings clear benefits, it is not without its limitations.

From experience, AI can assist with design, but it still struggles with deeper, context-heavy decisions—such as understanding business constraints, making architectural trade-offs, or designing complex systems properly. These are areas where human judgment remains crucial.

Another key concern is data privacy.

When we use AI tools, the prompts and data we provide may be used for model improvement or training, depending on the platform and configuration. This becomes a risk when dealing with sensitive information such as proprietary code, credentials, or regulated data.

Because of this, it is important to define data sensitivity clearly before using AI. Not all data should be shared, and organisations need to establish proper guidelines.

On top of that, we must remember that AI-generated outputs still require validation. It is easy to accept an answer because it “looks correct,” but without proper verification, this can introduce risks into production systems.

The Evolving Role of the Developer

AI does not just change how we code—it changes what it means to be a developer.

There are concerns that relying too much on AI may weaken our fundamental skills. If we depend on AI to generate solutions without fully understanding them, we may lose the ability to reason through problems ourselves.

At the same time, AI is also one of the most patient “teachers” we can have. There is no hesitation in asking basic questions, repeating mistakes, or exploring unfamiliar topics. It provides a safe space to learn and improve continuously.

So, the impact of AI really depends on how we choose to use it.

I like to think of it as inheriting a great fortune. We can either invest it wisely to grow our capabilities over time, or we can simply consume it and become overly dependent on it. The outcome is entirely up to us.

Looking at the bigger picture, the role of developers has always evolved.

In the early days, programming was close to machine-level instructions. Over time, higher-level languages abstracted complexity and made development more human-readable. Then came the rise of full-stack development, where a single developer could handle frontend, backend, and even database design.

More recently, with the adoption of DevOps and CI/CD practices, developers are also involved in infrastructure setup, deployment pipelines, and automation scripts. Writing code is no longer limited to application logic—we now touch every aspect of a system’s lifecycle.

AI is simply the next phase of this evolution.

In future, developers may spend less time writing every line of code manually, and more time orchestrating multiple AI agents—assigning tasks, validating outputs, and ensuring everything comes together correctly. In a way, we are moving from being implementers to coordinators and decision-makers.

Conclusion

AI is not the end of programming—it is a continuation of it.

There is no perfect solution in technology. Every tool comes with its own strengths and limitations. While AI offers significant gains in productivity and learning, it also introduces new challenges that we must understand and manage.

As we enjoy the benefits of AI, we must remain aware of its limitations and decide whether we can accept or mitigate them.

When it comes to AI replacing humans, I personally do not see a “Skynet” (in the movie, Terminator) scenario becoming reality. Instead, it feels closer to an Iron Man scenario—where technology augments human capability rather than replaces it. AI becomes an extension of us, helping us make better decisions, move faster, and build more effectively.

At the end of the day, AI is just a tool. How much value we get from it depends on how we use it.

For developers, the goal should not be to rely on AI, but to evolve with the technology.

Contact Us: General enquiries or free consultation

We’re really grateful for giving us a chance to connect with you. Please do not hesitate to ask us anything and we will respond to you asap.

[contact-form-7]

The post Rethinking Development in the Age of AI appeared first on Netrust.

SSL Certificate Renewal: What Actually Happens Behind the Scenes

Melissa Ang — Thu, 21 May 2026 02:00:28 +0000

Many people think renewing an SSL certificate is just a quick click.

In practice, it is rarely that simple.

From what we see working with customers, renewal is usually part of a larger process. It involves multiple steps, and if something is missed, it can lead to warnings or even downtime.

Why frequent renewal is now required

SSL certificates no longer last for 398 days.

As of March 2026, certificates can be issued for up to 200 days. This is shorter than before, and it is getting shorter.

The idea is simple. Shorter lifespans reduce risk. If something goes wrong, it limits how long a certificate can be misused.

In reality, many organisations are already moving to even shorter cycles. This is usually supported by automation.

From experience, teams that still manage certificates manually tend to struggle more as these timelines get shorter.

Renewal ensures:

The website remains secure
Continued browser trust
Certificate details remain up to date

Here is what happens behind the scenes:

Step 1: Creating a new request

When a certificate is renewed, the system will usually generate a new security key.

This key is kept private. It is what protects the connection between the website and its visitors.

A request is then created using this key. This is often called a certificate request.

It contains basic details about the website, along with a public version of the key.

In most environments, generating a new key is considered good practice. It reduces the risk of older keys being reused over time.

Step 2: Checking your identity

Next, the Certificate Authority needs to confirm that you still control the domain.

This is an important step regardless of the issuing Certificate Authority. It prevents someone else from requesting a certificate for your website.

For Domain Validation, this can be quick.

You might be asked to do any of the following:

Approve an email sent to your domain
Add a DNS record
Upload a small file to your website

For Organisation Validation, there are more checks.

These may include verifying your business registration and confirming your company details.

For Extended Validation, the checks go even further. The Certificate Authority will review your organisation more thoroughly.

Step 3: Issuing the new certificate

Once everything is verified, the certificate is issued.

You will receive a few files. Each one plays a role in establishing trust.

These include:

Your main certificate
Intermediate certificates
The root certificate (already trusted by browsers)

Together, they form what is called a certificate chain.

If this chain is not set up properly, browsers may show warnings even if the certificate itself is valid.

There is also something happening in the background that most people do not see.

New certificates are recorded in public logs. This adds an extra layer of transparency, allowing browsers and security systems to detect suspicious or unauthorised certificates.

Step 4: Installing the certificate

The new certificate then needs to be installed.

This usually means replacing the old certificate and making sure the full chain is configured correctly.

In smaller setups, this might be straightforward.

In larger environments, it can be more complex. Certificates may need to be updated across multiple servers, load balancers, or cloud services.

This is where we often see issues. A certificate is renewed, but not deployed everywhere it needs to be.

When someone visits your website, their browser runs a series of checks.

This happens in seconds.

The browser will:

Check that the certificate is valid
Confirm it has not expired
Verify the issuing authority
Match it to the domain

It will also validate the full certificate chain.

When an SSL certificate expires, the connection is no longer secure, resulting not only in downtime, but also in exposing systems to potential cyber threats and causing reputational damage. This is why timely renewal is critical.

A quick note on automation

With shorter certificate lifespans, manual processes become harder to manage.

This is why many organisations are moving towards automation.

In most modern setups, certificates can be requested, renewed, and installed automatically in the background.

From what we see, this significantly reduces missed renewals and operational overhead.

Automation helps to:

• Renew certificates on time
• Handle shorter validity periods
• Reduce manual errors

Solutions like Next-Generation SSL are designed to manage this centrally.

Instead of tracking certificates individually, teams can monitor and manage everything in one place.

Final thoughts

SSL renewal is not just a routine task.

It is something that needs to be managed continuously.

As environments grow, manual handling becomes difficult to maintain. This is where many teams start to feel the strain.

More organisations are now treating certificates as part of their ongoing security operations, rather than as something handled only occasionally. If your team is facing similar challenges, it may be worth looking at how an automation solution like Next-Generation SSL can help to simplify operations and reduce risk.

The post SSL Certificate Renewal: What Actually Happens Behind the Scenes appeared first on Netrust.

Security Key Management: The Backbone of Digital Trust

Eng Jing Wee — Thu, 07 May 2026 02:00:52 +0000

These days, almost everything relies on cryptography in one way or another, whether it is SSL/TLS, digital signing, identity systems, or encryption.

But when people talk about security, they usually focus on the algorithm or the technology itself. What often gets overlooked is something much more practical: how the keys are managed.

Because no matter how strong the encryption is, if the keys are poorly handled, the whole thing can fall apart.

What is security key management?

In simple terms, it is the way cryptographic keys are handled from start to finish.

That includes:

how the keys are created
where they are stored
who is allowed to access them
when they should be rotated
how they are revoked or destroyed

It sounds straightforward, but this is one of the most important parts of any cryptographic system.

Why does it matter?

A lot of security problems in real environments are not caused by weak encryption. They happen because keys are not managed properly.

For example:

private keys are stored in plaintext
certificates expire without anyone noticing
the same keys are kept in use for too long
nobody has a clear view of where certificates are deployed

Once a key is exposed or mishandled, the impact can be serious.

An attacker may be able to impersonate a system, decrypt sensitive information, or get around the trust built into the environment. And when it reaches that stage, the problem is no longer minor. It becomes a full compromise.

What good key management looks like

First, keys should be generated properly using strong standards and in a secure environment. For more sensitive use cases, this is usually done inside an HSM.

Second, private keys need to be stored securely. They should never be left exposed or kept in insecure locations. Depending on the setup, this could mean using HSMs, TPMs, or a cloud KMS.

Third, access must be controlled properly. Not everyone should be able to view or use sensitive keys. Good practice includes role-based access control, separation of duties, and stronger approval controls for critical actions.

Then there is the lifecycle itself. Keys should be rotated regularly, replaced before expiry, and retired properly when they are no longer needed.

The challenge in real life

In theory, all of this sounds manageable. In reality, it often is not.

Certificates end up scattered across servers, load balancers, applications, and cloud platforms. Different teams may be using different CAs. Some environments still rely heavily on spreadsheets or manual tracking. After some time, nobody has a complete picture anymore.

That is usually when problems start showing up, such as expired certificates, unmanaged keys, duplicated certificates, or avoidable outages.

This is why centralised management and automation matter so much. At a certain scale, manual handling is just not enough.

What actually helps

In practice, a few things make the biggest difference: using HSMs for critical keys, centralising certificate and key management, reducing reliance on manual tracking, automating renewals and monitoring, limiting access to authorised personnel, and ensuring key usage is logged and auditable.

These are not complicated measures, but they are the ones that make a real difference in reducing risk.

The organisations likely to struggle in the PQC transition are not those lacking quantum expertise.

Final thoughts

At the end of the day, key management is really about control and visibility.

You can have strong encryption and a solid security design, but if the keys are not managed properly, the whole setup is at risk.

This is why key management is not just an operational concern. It is a critical part of overall security.

The post Security Key Management: The Backbone of Digital Trust appeared first on Netrust.

High Stakes and Digital Trust: My Reality as a Netrust Presales Consultant

Tommy Goh — Thu, 23 Apr 2026 01:10:24 +0000

If you looked at my calendar right now, you would see a colourful Tetris-like board of Teams meeting links, RFP deadlines, and site visit reminders. People often ask what a “Presales Consultant” actually does. In short, I’m the bridge between a “cool idea” and a technical reality that actually works.

At Netrust, my client base focuses on Singapore and the wider APAC region, which means my day-to-day is anything but predictable.

The Morning Sprint (and the Caffeine)

My day usually starts with a quick scan of the regional landscape. Because I handle the APAC market, I might be answering a technical query from a partner in Thailand at 9:00 AM, then pivoting immediately to a high-level strategy session for a Singapore government project an hour later.

It’s not just about “selling.” I spend a lot of time playing detective, digging into a client’s infrastructure to find out why their existing security is failing them. Are they struggling with manual document signing? Is their certificate management a mess? That’s where the “consultant” part of my title actually earns its keep.

Turning Chaos into Compliance

When I’m in these meetings, I’m not just talking about abstract concepts. I’m matching real-world headaches with the specific solutions we have at Netrust. Here are the three heavy hitters that usually dominate my conversations:

Managed CA Services: This is the heart of what we do. As Singapore’s only IMDA-accredited Certificate Authority, we provide what “root-of-trust” companies crave. I often talk to banks or government agencies that need high-assurance identities. Whether they want us to host it or need an internal PKI built on their premises, we provide the legal certainty that their digital IDs actually mean something.
Certificate Lifecycle Management (CLM): If you want to see a CISO’s blood pressure rise, mention “expired SSL/TLS certificates.” With public TLS certificate lifespans dropping to 47-day cycles by 2029, manual tracking in spreadsheets is a recipe for disaster. I spend a lot of time demoing our CLM platforms, showing how it automates discovery, renewal, and provisioning so the lights stay on without a human having to intervene.
nSignHub: This is the “productivity hero.” It’s our cloud-based signing workflow. I love showing this to teams that are still chasing people for physical signatures. nSignHub handles everything from “Sign with Singpass” to Netrust Secure Electronic Signature, which is AATL-trusted and recognised globally by Adobe and Microsoft. It turns a week-long paper trail into a five-minute digital process.

The APAC Hustle

The best part of the job is the variety. One day, I’m navigating the specific regulatory requirements of the Singapore Electronic Transactions Act (ETA), and the next, I’m helping a regional enterprise scale their certificate authority infrastructure across three different time zones.

It’s a busy life, sure. There are days when the RFPs feel endless, and the technical requirements are a mile long. But there’s a specific kind of buzz you get when a complex solution finally clicks into place.

The Verdict

Life at Netrust isn’t about sitting behind a screen all day. It’s about being in the thick of the APAC digital transformation. It’s fast, it’s furious, and it’s incredibly rewarding to be the person who helps turn “We need to be secure” into “We are Netrust-secured.”

If you want to see me in action (or just want to see if I can actually explain PKI without using a 50-deck PowerPoint), let’s talk! Contact us at https://www.netrust.net/contact-us/.

The post High Stakes and Digital Trust: My Reality as a Netrust Presales Consultant appeared first on Netrust.

The 47-Day Certificate Era and the Post-Quantum Reality: Are We Ready?

Edwin Lee — Thu, 09 Apr 2026 02:00:44 +0000

There are two things happening in the SSL/TLS world right now that, in isolation, are manageable.

Together, they’re disruptive.

The first is well known: quantum computing is moving from theoretical research into practical engineering. Whether we think it will take 5 years or 15, one thing is clear: the public key algorithms protecting today’s internet were not designed for a quantum-capable adversary.

The second is more immediate and operational: the CA/Browser Forum has formalised the progressive reduction of SSL/TLS certificate validity periods, culminating in a maximum lifespan of 47 days by 2029.

Forty-seven days.

That’s not a typo.

If you run a public website, APIs, cloud workloads, or anything customer-facing, this isn’t just a compliance detail. It’s an operational shift.

Why This Combination Is Different

Let’s break it down.

1. The Post-Quantum Shift Is About Crypto Agility

Most organisations are not worried about quantum computers breaking RSA tomorrow.

What they should be thinking about is this:

When PQC becomes production-ready and mandated, how fast can you transition?

If your certificate infrastructure is rigid, manually managed, and scattered across business units, then the real risk isn’t quantum; it’s organisational inertia.

Crypto agility is not about deploying PQC today.

It’s about ensuring you can switch when the time comes.

2. 47-Day Certificates Change the Operating Model

For years, certificate management was treated as an administrative task. A renewal reminder here, a spreadsheet there.

That model doesn’t survive a 47-day validity world.

At 47 days:

Renewals become constant
Manual tracking becomes error-prone
Outage risk increases exponentially
Audit and compliance complexity grows

Shorter lifespans are good for ecosystem security.

But they demand automation.

The Real Issue Isn’t PQC. It’s Lifecycle Management.

Based on what we observe across industries, the real bottleneck isn’t algorithm readiness.

It’s visibility.

Many organisations don’t have:

A complete inventory of their SSL/TLS certificates
Centralised expiry monitoring
Automated issuance and renewal workflows
A structured plan for algorithm transition

And without those fundamentals, talking about post-quantum migration is premature.

You can’t modernise cryptography if you don’t even know where it’s deployed.

What Forward-Looking Organisations Are Doing

The more mature organisations we observe are taking a phased approach:

Step 1: Gain Full Certificate Visibility

Build a complete inventory across public websites, internal systems, cloud, containers, and load balancers.

Step 2: Automate the Lifecycle

Move away from manual renewals. Integrate issuance and renewal into DevOps and infrastructure pipelines.

Step 3: Design for Algorithm Flexibility

Ensure that certificate management systems are not tightly bound to a single algorithm. Prepare for hybrid (classical + PQC) deployments when standards stabilise.

Step 4: Monitor Industry Signals

Track NIST PQC standardisation, browser support, root program policies, and regulatory guidance to be prepared.

A Subtle but Important Shift

Historically, SSL/TLS certificates were treated as point-in-time security artefacts. From now on, they need to be treated as continuously managed cryptographic assets.

The 47-day timeline accelerates this.

The post-quantum era makes it non-optional.

Final Thought

The organisations likely to struggle in the PQC transition are not those lacking quantum expertise.

They’re the ones still managing certificates manually.

If there’s one practical takeaway from both trends, it’s this:

Before thinking about quantum-safe algorithms, make sure your certificate lifecycle is automated, visible, and crypto-agile. Everything else builds on that foundation.

If you’re assessing your certificate lifecycle readiness or thinking about crypto agility, we’re always happy to share what we’re seeing across the industry. Contact us today.

The post The 47-Day Certificate Era and the Post-Quantum Reality: Are We Ready? appeared first on Netrust.