Tech
Microsoft starts including PQC algorithms in cyber foundations | Computer Weekly
Two years after the debut of its Quantum Safe Programme (QSP) Microsoft is now moving steadily through the process of incorporating post-quantum cryptography (PQC) algorithms into some of the foundational components underpinning the security of its product suite.
The computing giant said that in order to maintain the resilience of its systems and servers when future quantum computers likely break current encryption protocols for good, it needs its core services to be set to go before 2029.
This is a self-imposed deadline for early adoption of quantum-safe enabled technology that, for now, sits well ahead of most government targets for take-up – the UK’s National Cyber Security Centre (NCSC) says Britain’s key sectors and organisations should be planning to switchover to PQC by 2035.
Outlining the progress made to date, Microsoft Azure chief technogy officer Mark Russinovich, and Microsoft corporate vice president, CTO of Microsoft Security and Israel R&D Centre managing director Michal Braverman-Blumenstyk said that while scalable quantum computing remains a pipe dream for now, the time to prepare for it is now.
“Migration to post PQC is not a flip-the-switch moment, it’s a multiyear transformation that requires immediate planning and coordinated execution to avoid a last-minute scramble,” they said.
“It is also an opportunity for every organisation to address legacy technology and practices and implement improved cryptographic standards.
They added: “By acting now, organisations can upgrade to modern cryptographical architectures that are inherently quantum safe, upgrade existing systems with the latest standards in cryptography, and embrace crypto-agility to modernise their cryptographic standards and practices and prepare for scalable quantum computing.”
The overall QSP strategy, as previously outlined, centres on three core pillars: updating Microsoft’s own and third-party services, supply chain and ecosystem to be quantum safe; supporting its customers, partners and ecosystems in this goal; and promoting global research, standards and solutions around quantum security.
Redmond has already conducted an enterprise-wide inventory to identify the potential risks and has been partnering with industry leaders over the past couple of years to address some of the more critical dependencies, invest in research, and work together on new hardware and firmware.
Where we stand today
As of this point in time, Microsoft has integrated PQC algorithms into components such as SymCrypt, which is the main cryptographic library used by Windows, Azure and Office 365. This library now supports Module-Lattice Key Encapsulation Mechanism (ML-KEM, formerly known as Crystals-Kyber) and Module-Lattice-Based Digital Signature Algorithm (ML-DSA, formerly known as Crystals-Dilithium), both of which were among the quantum-safe algorithms taken forward by the US National Institute of Standards and Technology (NIST) a year ago.
Addressing the threat of Harvest Now Decrypt Later (HNDL) cyber attacks in which threat actors exfiltrated data today and hold it in reserve until they can crack the code, Microsoft is also ramping up the introduction of quantum-safe key exchange mechanisms in SymCrypt, enabling transport layer security (TLS) hybrid key exchange – per the latest IETF draft – and enhancing TLS 1.3 to support hybrid and pure post-quantum key exchange methods. These capabilities will be trickling down to the Windows TLS stack before much longer, said Russinovich and Braverman-Blumenstyk.
Beyond SymCrypt, Microsoft is also updating components such as its Entra authentication, key and secret management, and signing services, and plans to move towards integrating PQX into Windows, Azure, Office 365, and its data, networking and AI services to ensure the safety of the broader Microsoft services ecosystem.
Alignment to government plans
Microsoft’s overall QSP strategy currently aligns chiefly with US government requirements and timelines concerning quantum safety – including those laid down by agencies such as the Cybersecurity and Infrastructure Security Agency (CISA), NIST, and the National Security Agency (NSA).
However it is closely monitoring quantum safe initiative emanating from Australia, Canada, the European Union (EU), Japan and the UK.
Tech
New York Bans Government Employees from Insider Trading on Prediction Markets
New York has banned state employees from using insider information to trade on prediction markets. In an executive order signed today and viewed by WIRED, Governor Kathy Hochul forbade the state’s government workforce from using “any nonpublic information obtained in the course of their official duties” to participate on prediction market platforms, or to help others profit using those services.
“Getting rich by betting on inside information is corruption, plain and simple,” Hochul said in a statement provided to WIRED. “Our actions will ensure that public servants work for the people they represent, not their own personal enrichment. While Donald Trump and DC Republicans turn a blind eye to the ethical Wild West they’ve created, New York is stepping up to lead by example and stamp out insider trading.”
The order was not spurred by any specific insider trading incidents involving New York state employees. “There are no known instances of this behavior to date,” says New York State Executive Chamber deputy communications director Sean Butler.
This is the latest in a wave of initiatives meant to curb insider trading on prediction markets like Kalshi and Polymarket, the two most popular of these platforms in the United States. California Governor Gavin Newsom issued a similar executive order last month, banning Golden State employees from prediction market insider trading. Yesterday, Illinois Governor JB Pritzker followed suit.
In addition to these executive orders, Congress has also introduced several bills intended to curb market manipulation and corruption in the industry, including legislation barring elected officials from participating in prediction markets. Some individual politicians are discouraging or outright barring their staff from buying event contracts on those platforms. According to CNN, the White House recently warned executive branch staff not to trade on prediction markets. When WIRED asked the White House about its policies on these markets earlier this year, it pointed to existing regulations prohibiting gambling activity but did not respond to requests for clarification on whether it considered prediction market participation to be gambling.
The Commodity Exchange Act, which covers derivative markets, does already prohibit insider trading, which means that both public servants and people in the private sector are breaking the law if they enact insider trades on event contracts. Rather than establishing new rules, the New York executive order serves primarily to underline the state’s commitment to enforcing existing laws and to clarify how these laws and its Code of Ethics for employees apply to prediction markets.
However, with so many high-profile examples of suspected insider trading on Polymarket focused on geopolitical events, from the capture of former Venezuelan leader Nicolas Maduro to strikes in the ongoing Iran war, many onlookers—including prominent lawmakers—see this as such a combustible issue. They’re racing to write laws and orders restating and emphasizing existing rules.
“This makes sense, and we already do this. At Kalshi, insider trading violates our rules, and we enforce them when we catch insiders,” Kalshi spokesperson Elisabeth Diana says. “Government employees should be aware that trading on federally regulated markets using material nonpublic information violates the law.” (Polymarket did not immediately respond to a request for comment.)
Facing backlash, Polymarket and Kalshi have recently announced new initiatives to combat insider trading.
In February, Kalshi publicized its decision to suspend and fine two individuals for violating its market manipulation policies; the company also confirmed that it had flagged the cases to the Commodity Futures Trading Commission, the federal agency overseeing prediction markets. In March, it rolled out a beef up market surveillance arm, preemptively blocking political candidates from trading on markets related to their campaigns.
Tech
The Best Chromebooks Are Doing Their Best to Course Correct
I was delighted to see that the Acer Chromebook Plus 516 didn’t skimp on a crappy touchpad. That goes a long way toward improving the experiencing of actually using the laptop on a moment-by-moment basis. I wasn’t annoyed every time I had to click-and-drag or select a bit of text. This one’s biggest weakness is definitely the screen, which is true of just about every cheap Chromebook I’ve tested. The colors are ugly and desaturated, giving the whole thing a sickly green tint. It’s also not the sharpest in the world, as it’s stretching 1920 x 1200 pixels across a large, 16-inch screen. But in terms of usability and performance, the Acer Chromebook Plus 516 is a great value, combining an Intel Core i3 processor with 8 GB of RAM and a 128 GB of storage. For a Chromebook that’s often on sale for $350, it’s a steal.
While we’re here, let’s go even cheaper, shall we? Asus has two dirt-cheap Chromebooks that I tested last year that I was mildly impressed by. The Asus Chromebook CX14 and CX15. Notice in the name that these are not “Chromebook Plus” models, meaning they can be configured with less RAM and storage, and even use lower-powered processors. That’s exactly what you get on the cheaper configurations of the CX14 and CX15, which is how you sometimes get prices down to as low as $130. I definitely recommend the version with 8 GB of RAM, but regardless of which you choose, the both the CX14 and larger CX15 are mildly attractive laptops. You’d know that’s a big compliment if you’ve seen just how ugly Chromebooks of this price have been in the past.
With these, though, I appreciate the relatively thin bezels and chassis thickness, as well as the larger touchpad and comfortable keyboard. The CX15 even comes in a striking blue color. The touchpad isn’t great, nor is the display. Like the Acer Chromebook Plus 516, it suffers from poor color reproduction and only goes up to 250 nits of brightness. It only has a 720p webcam too, which makes video calls a bit rough. But that’s going to be true of nearly all the competition (and there isn’t much).
Of the two models, I definitely prefer the CX14 though, as it doesn’t have a numberpad and off-center touchpad, which I’ve always found to be awkward to use. Look—no one’s going to love using a computer that costs the less than $200, but if it’s what you can afford, the Asus Chromebook CX14 will at least get you by without too much frustration.
Whatever you do, don’t just head over to Amazon and buy whatever ancient Chromebook is selling for $100 for your kid. It’s worth the extra cash to get something with better battery life, a more modern look, and decent performance.
Other Good Chromebooks We’ve Tested
We’ve tested dozens and dozens of Chromebooks over the past years, having reviewed every major release across the spectrum of price. Unlike Macs and Windows laptops, Chromebooks tends to stick around a bit longer though, and aren’t refreshed as often. I stand by my picks above, but here are a few standouts from our testing that are still worth buying for the right person.
Photograph: Daniel Thorp-Lancaster
Tech
Interview: Critical local infrastructure is missing link in UK cyber resilience | Computer Weekly
Critical local infrastructure that supports council services, social care services and local transport in the UK is falling through the gaps in government and business planning for cyber resilience, claims Jonathan Lee, director of cyber strategy at cyber security company TrendAI.
In an interview with Computer Weekly, Lee says that municipal areas, such as London or Greater Manchester, could be at risk from multiple cyber attacks that could damage local infrastructure, causing escalating problems for residents that could add up to severe disruption.
“We need to be thinking about what would happen if multiple attacks happened at the same time across the city region – and the human impact of not being able to do your job properly, not being able to travel around and not being able to deliver public services,” he says.
The Cyber Security and Resilience Bill (CSRB), which is currently going through Parliament, aims to ensure that critical national services, such as healthcare, water, transport and energy, are protected against cyber attacks that cost the economy billions of pounds a year. But local infrastructure has been relatively neglected, claims Lee.
The National Cyber Security Centre’s (NCSC) Cyber Assurance Framework, for example, aims to help operators of critical national infrastructure (CNI) demonstrate a base level of cyber security preparedness – but it is not mandatory, and not every organisation that should implement it is implementing it.
Whole of society risk
“We need to be more stringent in making sure that people are taking this seriously and are looking not just at their own organisation, but are looking at the whole of society risk,” says Lee.
Attacks on public services, such as council-run social care, can have a catastrophic, knock-on effect on the NHS and patient care, he adds.
There is a need for more “top-down” advice for regional infrastructure providers, from organisations such as the NCSC, which is not as well known as it could be among the companies and public sector bodies that provide local infrastructure.
“The message has got to be diffused down into local levels to ensure that a consistent message is spread out, and that can also be through industry partners. That is something I feel quite strongly about,” says Lee.
The Cyber Essentials programme, which has been updated to include new requirements for organisations to use multifactor authentication (MFA), and requirements for cloud providers to patch vulnerabilities within 14 days, has helped build resilience, but only for organisations that choose to adhere to it.
Keeping the resilience score
The UK government is also intending to publish a Cyber Action Plan in the coming months, which will guide organisations to get basic security right and improve their cyber security over time.
Although there is no shortage of initiatives and action plans, there is a danger that many of these plans will be left on a shelf.
One approach is for organisations to rate themselves on a scorecard for cyber resilience, on a scale of, say, 1 to 100, and to report their progress back to board-level directors.
“We need a mechanism to measure how impactful these interventions are, whether it be things like the Cyber Assessment Framework, Cyber Essentials or legislation,” says Lee.
-
Fashion6 days agoFrance’s LVMH Q1 revenue falls 6%, shows resilience amid Iran war
-
Entertainment1 week agoIs Claude down? Here’s why users are seeing errors
-
Sports1 week agoPSL 11: Peshawar Zalmi win toss, opt to field first against Quetta Gladiators
-
Tech1 week agoThe Deepfake Nudes Crisis in Schools Is Much Worse Than You Thought
-
Tech1 week agoBremont Is Sending a Watch to the Moon’s Surface
-
Tech1 week agoHuman-machine teaming dives underwater
-
Business1 week agoBP sees ‘exceptional’ oil trading result as Iran war sends crude costs soaring
-
Fashion1 week agoWhat no one is saying about the 2026 apparel slowdown
