Foundations: Network, Cloud, Cryptography & Supply Chain

Reading time ~13 minutes · No technical prerequisites · Day 3, Module 3.1

A leader does not need to run these systems, but must grasp four foundations well enough to ask the right questions and fund the right work. They are the architecture of trust in a modern organisation: how networks decide what to trust, how cloud responsibility is divided, how cryptography protects secrets over time, and how far your security perimeter really extends through your suppliers.

Zero trust: the perimeter has collapsed

The old "castle-and-moat" model trusted anything inside the network wall. Remote work, cloud services, and mobile devices dissolved that wall, and with it the assumption that being "inside" means being safe — because a single breach inside then gave an attacker the run of everything. Zero trust replaces implicit trust with continuous verification: never trust, always verify; treat identity, not network location, as the real perimeter; grant least privilege, just enough and just in time; and use micro-segmentation so a breach in one place does not open every place. This is the substance of modern guidance such as NIST SP 800-207 — a direction of travel to steer toward, not a product to purchase.

Cloud: shared responsibility and misconfiguration

Moving to the cloud does not outsource your security. Under the shared-responsibility model, the provider secures of the cloud — the data centres, hardware, and core platform — while you secure in the cloud: your data, your access, and your configuration. That second half is where breaches overwhelmingly happen. Misconfiguration — a storage bucket left public, a setting left open — is the dominant cause of cloud incidents, followed closely by over-broad identities and entitlements, the cloud's version of the insider problem. You cannot protect what you cannot see, so visibility of what you are actually running is itself a control.

Cryptography and the post-quantum clock

For a leader, cryptography reduces to a few durable ideas. Encryption protects data at rest and in transit; the mathematics rarely fails, but key management — how keys are generated, stored, and rotated — frequently does, which is why keys are the true crown jewels. And crypto-agility, the ability to change algorithms without re-architecting everything, has moved from nicety to necessity. The reason is the arrival of post-quantum risk. Large quantum computers could one day break much of today's public-key encryption, and the threat is not purely futuristic: under harvest now, decrypt later, adversaries steal encrypted data today and store it to decrypt once the capability matures. Anything that must remain secret for years is therefore already exposed.

Encrypted data you must protect for a decade can be a liability today. The post-quantum clock is already running.

Supply chain: your extended surface

Finally, your security is only as strong as your suppliers'. Third-party risk means a vendor's breach can become yours; software provenance asks whether you actually know what is inside the software you run; and a software bill of materials (SBOM) — an ingredients list for software — lets you find what is vulnerable when the next flaw is disclosed. An adversary who cannot breach a hard target directly will breach the small supplier that holds its access, which makes supply-chain compromise a primary route into well-defended organisations. This is the same lesson Day 1 opened with: your partners sit inside your target surface, so the security you require of them is part of your own defence.