5 related insights
Use this topic page to move quickly through the most relevant Attomus thinking without losing the wider context across the full insights section.
Insights Topic
Security
Browse Attomus insight related to security, with a focus on programme delivery, operational judgement, and professional execution in demanding environments.
The Authentication Model Contradiction Nobody Talks About
Authenticator apps look simple. They generate six-digit codes. The cryptography is forty years old. The protocol is an IETF RFC from 2011. You could probably implement the core algorithm in a lunch break. The genuinely hard part isn’t the TOTP maths. It’s a design tension baked into the product category itself, one that every authenticator app has to resolve, that most resolve quietly and without documentation, and that the industry has somehow decided not to discuss openly.
Read articleWhat Android's Keystore Actually Does with AES Keys (and What It Doesn't)
There is a question that comes up constantly in Android security engineering, usually phrased something along the lines of: “how do I prove to my server that this AES key is hardware-backed?” The common answers to this question are often wrong in that they make you think you have a guarantee that you do not have. The short answer is: you cannot prove an AES key’s hardware provenance to a server directly. The certificate chain mechanism that makes remote attestation possible for asymmetric keys does not exist for symmetric keys. If you are building a system that depends upon being able to remotely attest an AES key’s provenance, you need to redesign the system, not find a better API call.
Read articleThe Cybersecurity Paradox: Investing in What Organisations Hope to Never Need
A peculiar tension plays out in boardrooms across every sector: cybersecurity represents one of the most critical investments an organisation can make, yet it delivers none of the excitement that typically drives corporate spending decisions. This paradox has become a defining challenge for modern corporate governance, particularly as cyber threats continue to escalate in sophistication and frequency. When a company invests in product development, marketing infrastructure or operational technology, stakeholders can point to tangible outcomes — new features customers will value, expanded market reach, or efficiency gains that boost the bottom line. These investments generate enthusiasm amongst executive teams and shareholders alike because they promise growth, competitive advantage, and visible returns. Cybersecurity, by contrast, promises only that things will continue to function as they currently do. There are no new capabilities to demonstrate, no flashy innovations for the next AGM, no features that will delight customers or differentiate the organisation from its competitors.
Read articleHow Quantum Computing Could Defeat Today's Encryption and What We Should Do to Protect Ourselves
In the ever-evolving landscape of technology, quantum computing stands out as one of the most revolutionary advancements of the 21st century. While it promises to solve complex problems in fields like medicine, materials science, and artificial intelligence, it also poses a significant threat to the cryptographic systems that underpin modern cybersecurity. In this blog post, we’ll explore how quantum computing could defeat today’s encryption methods and what steps we should take today to safeguard our digital future.
Read articleHow a PostgreSQL database could be compromised by an attacker
PostgreSQL, an open-source relational database management system (RDBMS), is widely regarded for its robustness, scalability, and flexibility. However, like any other piece of software, it is not immune to security vulnerabilities. Understanding how a PostgreSQL database could be compromised by a hack is crucial for database administrators and developers to implement effective security measures. This blog post explores the various methods hackers might use to compromise a PostgreSQL database, offering insights into potential vulnerabilities and how to mitigate them.
Read article