Blog

In our last blog post, we discussed post-quantum cryptography and the security priority it’s rapidly becoming. This week, we’ll dive a little deeper into the NIST post-quantum cryptography standards being built and how to prepare for meeting these new requirements. Understanding the various NIST post-quantum cryptography standards is essential for any organization concerned with future-ready security. The National Institute of Standards and Technology (NIST) Post‑Quantum Cryptography (PQC) Standardization Project is a global, multi‑year initiative established to counter the critical security vulnerabilities introduced by future quantum computing capabilities. Current public‑key encryption frameworks (such as RSA and ECC) rely on mathematical complexities...

The G7 recently moved post-quantum cryptography out of the "future problem" category, and for state, local, education, public safety, and critical infrastructure organizations, the practical question is no longer whether PQC will matter, it's how to prepare without creating unnecessary cost, complexity, or procurement confusion before the market is ready. In this context, understanding post-quantum cryptography for SLED is becoming increasingly urgent. What many people casually call "quantum cryptography" is more accurately described as post-quantum cryptography, or PQC. This is not about using quantum computers to encrypt data. It’s about replacing today's cryptographic methods that may become vulnerable once sufficiently...

Recently, the threat group known as ShinyHunters breached Instructure, the company behind Canvas, and made off with student records affecting institutions across the country. ShinyHunters is a well-documented, financially motivated group with a long history of large-scale data theft and extortion, previously linked to breaches at Ticketmaster, Santander Bank, and AT&T. Their playbook typically involves compromising credentials or session tokens, moving laterally through connected systems, and exfiltrating bulk data before detection. In the Canvas case, early indicators point to abuse of a third-party integration, which is a common and often overlooked attack surface in learning management systems.  Canvas does not exist in isolation....

The Number That Should Make Every Vendor Uncomfortable A recent industry survey found that 91% of CISOs say threat intelligence is valuable. That sounds like a win for the threat intel market. Then you read the second stat: only 26% say that intelligence actually influences their decisions. Think about that for a moment. Nine out of ten security leaders believe in the concept of threat intelligence. But fewer than three in ten find what they are getting actionable enough to change what they do. That’s not a ringing endorsement, and it seems like a polite way of saying most threat...

Your organization's cybersecurity posture is only as strong as the weakest link in your vendor ecosystem. For state and local governments, higher education institutions, financial organizations, and compliance-driven businesses, that statement carries significant weight. Implementing effective third-party risk management is essential because most organizations today rely heavily on third-party vendors and contractors to deliver core business functions. With that dependency comes risk that many security programs aren’t fully equipped to manage. After conducting hundreds of third-party risk assessments annually, our team at nuHarbor has developed a clear picture of the risks that show up time and again across industries, organization...