Legacy Admin Keys and Default Passwords Hamper Post‑Quantum Migration in Banks and Hospitals
What Happened — In a recent interview, Quantus CEO Christopher Smith highlighted that cryptographic inventories at banks and hospitals frequently uncover hidden admin keys and default passwords still held by former employees. The larger key sizes required for post‑quantum algorithms also break legacy protocol limits in IPsec, SSH, TLS and libp2p, adding operational friction to migration.
Why It Matters for Compliance & Audit Readiness
- Un‑revoked admin credentials constitute a direct violation of SOC 2 CC6.1 (Logical Access) and must be tracked as part of continuous access‑control monitoring.
- Oversized post‑quantum keys that cause protocol failures can be evidence of inadequate change‑management controls (SOC 2 CC7.2) and may lead to audit findings if not documented.
- Mapping these hidden assets to a formal inventory enables the SOC2_ACCESS_CONTROLS capability to provide defensible audit evidence of key‑management hygiene.
Who Is Affected — Financial services (banks) and healthcare providers (hospitals).
Recommended Actions
- Conduct a formal cryptographic asset inventory and reconcile it against your privileged‑access management (PAM) system.
- Immediately revoke or rotate any default passwords, admin keys, or credentials held by former staff.
- Update protocol configurations (IPsec, SSH, TLS, libp2p) to accommodate post‑quantum key sizes and document the change in your change‑management system. Source: Help Net Security
Technical Notes
- Hidden admin keys and default passwords represent credential‑compromise risk; they are often discovered through forensic inventory rather than an active breach.
- Post‑quantum algorithms increase key lengths (e.g., 4‑8 KB for lattice‑based signatures) which can exceed legacy packet‑size limits, causing silent failures in IPsec, SSH, TLS and libp2p. Source: Help Net Security