Lab 05 · System dependencies · 35–45 minutes
PQC: Follow Every Dependency
Where does cryptography live in a system, and what remains exposed after just one upgrade?
Fictional system map, not a security assessment · No account needed
One secure connection is not a secure system
Imagine opening a protected record in a browser. The browser connects to an edge service, the edge connects to an application, and the application connects to a database. Each time a connection ends and a new one begins, a separate cryptographic agreement may be involved. Identity tokens, certificates, stored keys, backups, and software updates add other dependencies.
Count functions, not boxes
There is no universal number of PQC points. One device can perform several cryptographic functions. A switch that only forwards encrypted traffic might not terminate cryptography at all. A load balancer that decrypts and re-encrypts traffic does.
Encryption and trust are different jobs
PQC key establishment helps protect secrets. PQC signatures help protect authenticity and integrity. Upgrading one does not automatically upgrade the other. Symmetric encryption such as AES has a different role and is not simply replaced by a key-establishment algorithm.
Your fictional system has nine functions to inspect
First change only the public connection. Follow what remains unaddressed. Then examine each dependency and compare the complete map. The “validated” state assumes the listed evidence exists in this scenario; this lab does not inspect your system.
Even every mapped point addressed does not mean “fully protected.” Real security also depends on correct implementation, access control, endpoints, unknown dependencies, and previously captured data.