Post-Quantum Cryptography Nuclear Power Plant Cybersecurity
Nuclear plants run assets for 60 to 80 years, but the data leaving them can be recorded now and decrypted later. This guide explains which links are exposed, what 10 CFR 73.54...
Is BACnet Secure Connect post-quantum safe?
BACnet/SC protects building automation traffic with TLS 1.3 and X.509 certificates. This article explains which parts quantum computers threaten, what hybrid ML-KEM changes and how to plan the certificate migration.
Post-quantum encryption for railway signalling: what to know
Railway signalling and traction power SCADA links increasingly run over open networks. This article explains where quantum risk sits, how EN 50159 and CLC/TS 50701 frame encryption, and what the EU PQC...
ICCP TASE.2 post-quantum encryption: how to protect links
ICCP links between control centres carry data that can stay sensitive for years. This article explains the harvest now, decrypt later risk, the limits of IEC 62351-4 Secure ICCP, and how to...
Is IEEE 2030.5 post-quantum safe? DER encryption guide
IEEE 2030.5 secures solar, storage and aggregator links with TLS 1.2 and P-256 elliptic curves, both quantum-vulnerable. This guide explains the exposure, the NIST IR 8547 timeline and practical options for DER...
OT Network Monitoring: Encrypted Traffic Gateway Placement
Encrypting links between OT sites does not have to blind your passive sensors. This article covers tap placement, gateway-to-firewall ordering, tunnel health monitoring without decryption, and what IEC 62443-3-3 SR 6.2 expects.
Modbus TCP security post-quantum: is TLS still safe?
Modbus/TCP Security and ODVA CIP Security rely on TLS with RSA and elliptic-curve cryptography. This article explains the quantum exposure, the certificate deadline, PLC limits and when a quantum-safe tunnel makes more...
Quantum safe encryption data diode: can it work one-way?
Data diodes block inbound traffic, but they don't encrypt anything. This article covers how ML-KEM, pre-shared keys and one-way key rotation can protect unidirectional OT links against harvest now, decrypt later.
Is IEC 62351 post quantum safe? Substation WAN guide
IEC 62351 relies on RSA and elliptic curve cryptography for certificates, TLS handshakes and GDOI key distribution. This article shows where that creates exposure and how utilities can protect substation WAN links...
Where Does Purdue Model Post-Quantum Encryption Belong?
A practical guide to placing quantum-safe encryption in a Purdue-aligned OT architecture: which conduits to protect first, where tunnels should terminate, what changes for traffic flows, and what an encryption gateway cannot...
CISA Post-Quantum Considerations for Operational Technology
CISA's OT post-quantum guidance says OT relies less on cryptography than IT but is still exposed through its IT connections, signing and access controls. Here is what it recommends and how to...
Encryption gateway audit logs for air-gapped compliance
Gateways in air-gapped OT networks send no telemetry, but auditors still want proof that encryption is active. This article covers which events to log, how to export logs safely, what NIS2 requires...
Bump in the wire encryption legacy PLC: how does it work?
Legacy PLCs and RTUs cannot run modern cryptography. This article explains how inline bump-in-the-wire encryption protects their traffic with hybrid post-quantum key exchange, what it does to polling cycles, and how IEC...
How to update encryption on an air gapped OT network
A practical guide to updating encryption on air-gapped OT networks: staging post-quantum updates, verifying firmware offline per NIST SP 800-193, changing algorithms without remote management, and IEC 62443 change control.
How to add quantum safe IEC 104 DNP3 encryption
IEC 60870-5-104 has no built-in encryption, and DNP3 Secure Authentication only authenticates messages. This article sets out where quantum risk sits in telecontrol links and how to compare tunnels with IEC 62351-3...
ML-KEM performance on embedded ARM devices: what to expect
Benchmarks from the pqm4 project and recent Cortex-M0+ studies show that ML-KEM's computation is cheap. The real costs on OT hardware are larger messages, key buffers and radio airtime. This article explains...
Does post-quantum encryption add latency to OT real-time traffic?
ML-KEM key exchange runs at handshake and rekey time, not per packet. This article looks at measured handshake costs, what rekeying does to DNP3, Modbus TCP, IEC 60870-5-104 and IEC 61850 traffic,...
IEC 62443 conduit encryption post-quantum: what’s required?
IEC 62443 does not say 'encrypt every conduit', but SR 4.1 and SR 3.1 make cryptographic protection mandatory once the target security level and the conduit risk call for it. This guide...
OT isolation crisis: will encrypted connections keep working?
When critical infrastructure isolates vital OT systems in a crisis, encrypted links between sites must keep working with no internet, cloud or vendor access. This article covers revocation, rekeying, hidden dependencies and...
Post-quantum encryption low bandwidth links: will it work?
Post-quantum key exchange adds roughly two kilobytes per handshake. Here is what that means for slow cellular and satellite links, metered OT data plans, SCADA polling and keeping tunnels stable at remote...
How does quantum safe SCADA encryption protect OT links?
OT networks stay in service for decades, so SCADA traffic recorded today could be decrypted once quantum computers arrive. This article covers hybrid post-quantum encryption for remote sites, legacy PLCs, cloud links...
Encryption for air gapped networks: does it need the cloud?
Network encryption can run fully inside an air-gapped network, but only if the appliance does not rely on telemetry, cloud controllers or online licence checks. This article explains what to check and...