Applied Cryptography Security LabRachel Love · Security & Cloud Architecture

Executive overview · synthetic program

Cryptography that is selected on purpose, governed continuously, and provable on demand.

This lab models the cryptographic posture of a mid-size regulated SaaS platform. It shows the whole control loop — how an algorithm is chosen for a data classification, how key material is confined to a validated boundary, how rotation and revocation are exercised, and how each control produces evidence an auditor can read.

Explore the control catalog Open the Crypto Lab

Educational portfolio demonstration — not production key-management infrastructure. All figures are synthetic and locally generated. This app has no backend, no KMS and no connection to any real environment, and it makes no compliance or security guarantee about any real system.

Program scorecard

Where the posture stands this quarter

Four indicators the security leadership team reviews. Two are healthy, two carry named remediation owners and dates in the risk register.

Data stores with approved encryption

Effective

94%

+11 pts vs. Q1 baseline

47 of 50 synthetic stores mapped to an approved cipher suite.

Keys inside rotation SLA

Monitoring

88%

6 keys past due

Rotation SLA is 365 days for data keys, 90 days for signing keys.

TLS endpoints at 1.3-only

Monitoring

72%

18 legacy endpoints remain

Legacy partner gateways still negotiate TLS 1.2 with AES-GCM only.

Quantum-vulnerable asymmetric use

Gap / roadmap

31 assets

PQC migration wave 1 scoped

RSA-2048 signing paths queued for ML-DSA hybrid pilot.

Architecture thesis

Four pillars turn primitives into a program

Cryptography fails in enterprises for organisational reasons far more often than mathematical ones. Each pillar names the artifacts that make the control real.

01

Selection

Cipher suites are chosen from an approved catalog tied to data classification, latency budget, and regulator expectations — never by developer preference.

Approved algorithm catalogData classification matrixException request form
02

Implementation

Platform teams consume vetted crypto through a shared library and KMS façade, so app teams never touch raw key material or hand-roll primitives.

Crypto SDK contractEnvelope encryption patternIaC guardrails
03

Governance

Every control has an owner, a policy clause, an evidence artifact, and a review cadence recorded in the control register.

Control registerPolicy mappingQuarterly attestation
04

Assurance

Rotation, key inventory drift, and TLS posture are continuously monitored; findings route to a risk register with remediation owners and dates.

Drift detection queryRotation dashboardRisk register entry

Reference architecture

Request path with cryptographic boundaries

Where each control sits on a single write of a confidential record.

  client ──TLS 1.3 (X25519 + AES-256-GCM)──▶ edge / WAF
                                              │  CR-03
                                              ▼
                                       API service  ──mTLS──▶ internal services
                                              │  CR-08 HMAC on partner callbacks
                                              ▼
                                     crypto SDK (shared)
                                       │            │
                     CR-01 AES-256-GCM │            │ CR-05 grant check
                        + AAD(tenant,id)▼            ▼
                                  data store    KMS / HSM (FIPS 140-3 L3)
                                       │            │ non-exportable CMK
                                       │            └── CR-04 rotation + revoke
                                       ▼
                             backups / archives (CR-01, 10y retention → CR-09)

Coverage snapshot

Control domains and open remediation

Controls by domain

  • Data at rest2
  • Data in transit1
  • Key management3
  • Identity & integrity1
  • Application2

Coverage is deliberately uneven: key management and application integrity carry the most controls because they are where mistakes are cheapest to make and most expensive to detect.

Top open risks

  • RSK-102HighCR-07

    Artifact signing key past 90-day rotation SLA

    Platform Engineering · Wave 1 — current quarter

  • RSK-107MediumCR-03

    Legacy partner endpoints negotiate TLS 1.2

    Cloud Network Engineering · Wave 2

  • RSK-111HighCR-09

    RSA-2048 protecting data with 10-year retention

    Security Architecture · Wave 3

Full risk register

Walkthrough

Where to go next

Control Catalog

Nine cryptographic controls with objective, implementation, owner, framework mapping and evidence artifact.

Open

Key Lifecycle

Synthetic key inventory, rotation SLAs, custodians and the seven-stage lifecycle model with revocation drills.

Open

Crypto Lab

Run hashing, HMAC integrity checks and AES-GCM envelope encryption locally in your browser via WebCrypto.

Open

Governance

Decision records, review cadence, algorithm catalog and the risk register that drives remediation waves.

Open