Jul 25 2025

Redefining Digital Sovereignty: Wire CEO Urges Europe to Build Resilient, Independent Tech Infrastructure

Category: Cyber resiliencedisc7 @ 9:48 am

1. In an interview published July 25, 2025, Help Net Security features Wire CEO Benjamin Schilz discussing Europe’s digital sovereignty and framing it as a central strategic goal, shifting the discussion from mere regulation to building independently resilient, European-centered technology infrastructure.

2. Schilz notes that despite past regulatory efforts like GDPR and Schrems II, data still flows across the Atlantic via fragile legal frameworks such as the U.S. CLOUD Act. He highlights Gaia‑X as a milestone project intended to create a federated, transparent European cloud ecosystem, though he emphasizes it’s still in early implementation phases.

3. He emphasizes that the EU AI Act offers regulatory traction and confirms Europe can enforce tech rules—but what’s critical now is building independence so digital infrastructure isn’t shaped by foreign powers. In his view, digital sovereignty is now about European resilience, not just privacy.

4. Open-source and decentralized technologies are highlighted as foundational to Europe’s strategic autonomy. By treating digital infrastructure like energy or water, Schilz argues Europe must support public‑interest tech built with transparency and local control. More than funding, he says Europe needs a “risk-on” environment that rewards ambition and scale.

5. According to Schilz, simply labeling platforms as sovereign—without guaranteeing compliance with EU legal frameworks—is deceptive marketing. True sovereignty requires vendors to commit to EU law, end‑to‑end encryption, data residency, and open standards. If a provider can override those with U.S. obligations, their sovereignty claims fall flat.

6. As concrete proof of impact, Schilz cites deployments of Wire in several German ministries (Interior, Education & Research, Health), showing how secure, sovereign messaging platforms can improve public‑sector efficiency and transparency.

7. Finally, he outlines the necessary criteria for EU‑based AI deployments: they must be hosted within the EU, encrypted end‑to‑end, built with open‑source models, and eliminate reliance on non‑EU jurisdictions. These measures, he says, are essential for maintaining control, trust, and compliance in a complex threat environment.


Perspective

Overall, Schilz offers a compelling vision of digital sovereignty that moves beyond abstract principles toward tangible infrastructure and governance choices. I agree that sovereignty isn’t achieved through legislation alone—it demands architecting systems around open‑source, encryption, interoperability, and EU‑jurisdictional commitments. These design choices are critical for trust and autonomy in an increasingly geopolitically charged tech landscape.

That said, the challenge remains daunting. Projects like Gaia‑X still face hurdles of scale and coordination, and Europe’s fragmented regulatory and investment environment may slow progress. As reported by the Financial Times, Europe continues to lag in venture capital, unified strategy, and industrial scale compared to U.S. and Chinese tech powers. Without robust funding mechanisms and a political consensus, even the best‑designed systems may struggle to reach global competitiveness.

In conclusion, Schilz’s framing—seeing digital sovereignty as resilience, not rhetoric—is both timely and necessary. But turning this vision into reality will require deep systemic reforms in procurement, investment, and culture, as well as sustained public‑private alignment. Europe has the pieces, but assembling them into a coherent strategic stack (as advocates call the “EuroStack”) remains the critical mission for its digital future

Digital Sovereignty: Protecting Your Crypto Assets Against Common Threats

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Digital Sovereignty


May 20 2025

Steal Now, Crack Later: The Urgency of Quantum-Safe Security

Category: Cyber resilience,Data encryptiondisc7 @ 8:29 am

The security of traditional encryption hinges on the computational difficulty of solving prime number-based mathematical problems. These problems are so complex that, with today’s computing power, deciphering encrypted data by brute force—often referred to as “killing it with iron” (KIWI)—is practically impossible. This foundational challenge has kept data secure for decades, relying not on randomness but on insurmountable workload requirements.

However, the landscape is changing rapidly with the emergence of quantum computing. Unlike classical machines, quantum computers are built for solving certain types of problems—like prime factorization—exponentially faster. This means encryption that’s currently unbreakable could soon become vulnerable. The concern isn’t theoretical; malicious actors are already collecting encrypted data, anticipating that future quantum capabilities will allow them to decrypt it later. This “steal now, crack later” approach makes today’s security obsolete in tomorrow’s quantum reality.

As quantum computing advances, the urgency to adopt quantum-safe cryptography increases. Traditional systems need to evolve quickly to defend against this new class of threats. Organizations must prepare now by evaluating whether their current cryptographic infrastructure can withstand quantum-enabled attacks. Failure to act could result in critical exposure when quantum machines become operational at scale.

Adaptability, compliance, and resilience are the new pillars of a secure, future-proof cybersecurity posture. This means not only upgrading encryption standards but also rethinking security architecture to ensure it can evolve with changing technologies. Organizations must consider how quickly and seamlessly they can shift to quantum-safe alternatives without disrupting business operations.

Importantly, the way organizations view cybersecurity must also evolve. Many still treat security as a cost center, a necessary but burdensome investment. With the rise of generative AI and quantum computing, security should instead be seen as a value creator—a foundational component of digital trust, innovation, and competitive advantage. This mindset shift is crucial to justify the investments needed to transition into a quantum-safe future.

Quantum computing is the next frontier. Sundar Pichai predicts that within 5 years, quantum will solve problems that classical computers can’t touch.

Feedback:
There is an urgent need for quantum-resilient security measures. The post successfully communicates technical risk without diving into complex math, which makes it accessible. My suggestion would be to expand slightly on practical next steps—like adopting post-quantum cryptographic algorithms (e.g., those recommended by NIST), running quantum-readiness assessments, and building awareness across leadership. Adding these elements would enhance the piece’s actionable value while reinforcing the central message.

The shift to quantum-safe standards will take several years, as the standards continue to mature and vendors gradually adopt the new technologies. It’s important to take a flexible approach and be ready to update or replace cryptographic components as needed. Adopting a hybrid strategy—combining classical and quantum-safe algorithms—can help maintain compliance with existing requirements while introducing protection against future quantum threats.

Quantum Computing and Information: A Scaffolding Approach

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Quantum computing


May 07 2025

Resilience at Risk: Overlooked Threats Every Leadership Team Should Know

They’re the quiet ones—the ones that will silently gut your continuity strategy while leadership watches the wrong fire.


1️⃣ Shadow SaaS Is Out of Control
Business units are adopting tools without IT oversight—no security, no backups, no DR.
It works… until it doesn’t. Then it becomes your problem.


2️⃣ RTOs Are Fiction, Not Strategy
“30 hours” looks good—until the CEO demands answers three hours in.
If your recovery needs a miracle, it’s not a plan. It’s a pending failure.


3️⃣ Resilience Theater Is Everywhere
Policies? Written. Boxes? Checked.
But when the real incident hits, no one knows what to do. You’ve got documentation, not readiness.


4️⃣ Hidden Dependencies Will Break You
APIs, scripts, microservices—no SLAs, no visibility, no accountability.
They fail quietly. Business halts. And no one saw it coming.


5️⃣ Continuity Teams Have Quiet Quit
Resilience professionals are exhausted, underfunded, and unheard.
Their silence isn’t safety—it’s burnout. And it’s dangerous.


🔶 Resilience doesn’t fail loudly. It erodes quietly.
CISOs and leadership teams: It’s time to stop watching the wrong fire.

Security and resilience. Business continuity management systems. Requirements

Cyber Resilience – Defence-in-depth principles

Becoming Resilient – The Definitive Guide to ISO 22301 Implementation: The Plain English, Step-by-Step Handbook for Business Continuity Practitioners

ISO 22301:2019 and business continuity management – Understand how to plan, implement and enhance a business continuity management system (BCMS)

ISO 22301 Free to read

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Cyber Resilience


May 05 2025

Security and resilience. Business continuity management systems. Requirements

Category: BCP,Cyber resiliencedisc7 @ 1:08 pm

1. Purpose and Scope:
The concept of business continuity in management systems focuses on preparing organizations to respond effectively to disruptions. Its primary goal is to ensure that essential business functions can continue during and after incidents such as cyberattacks, natural disasters, or system failures. Business continuity planning is an integral part of an organization’s broader risk management and security posture.

2. Integration with Management Systems:
Business continuity must be embedded into the overall management system, aligning with standards like ISO 22301. This integration ensures that continuity planning, implementation, and testing are not isolated activities but coordinated with information security, quality management, and operational strategies. It emphasizes a risk-based approach and continuous improvement.

3. Key Components:
A robust business continuity framework includes a business impact analysis (BIA), risk assessment, recovery strategies, and response plans. These elements help identify critical processes, assess vulnerabilities, and define acceptable downtime and recovery objectives. Regular training, awareness programs, and incident response drills support readiness and resilience.

4. Communication and Leadership Commitment:
Effective business continuity management depends on top-level commitment and clear communication channels. Leadership must allocate resources, define roles, and ensure all employees understand their responsibilities during a crisis. Internal and external communication strategies are also essential to maintain trust and manage stakeholder expectations.

5. Testing and Continuous Improvement:
To ensure resilience, organizations must regularly test and review their business continuity plans. Simulations, audits, and after-action reviews help identify gaps and improve preparedness. Lessons learned from real incidents or exercises should feed into an ongoing cycle of improvement, reinforcing the organization’s ability to adapt and recover quickly.

BS EN ISO 22301:2019+A1:2024 – TC

BS EN ISO 22301 is the international standard which specifies the requirements for a business continuity management system (BCMS). It helps you to identify potential threats to your business and build the capacity to deal with unforeseen events.

It enables an organization to have a more effective response and a quicker recovery, thereby reducing any impact on people, products and the organization’s bottom line.

What are the benefits of BS EN ISO 22301 – Business continuity management systems

BS EN ISO 22301 empowers organizations to put in place a business continuity management system. By implementing its principles and guidelines in your organization, your business can benefit from:

  • Reduced frequency and impact of disruptions
  • Ability to return to “business as usual” as swiftly as possible
  • Cost savings on reducing the impact of disruptions
  • Confidence that your plans are robust and ensures you are resilient and well-placed to deal with change
  • Increased stakeholder confidence and trust
  • Lower insurance premiums

Cyber Resilience – Defence-in-depth principles

Becoming Resilient – The Definitive Guide to ISO 22301 Implementation: The Plain English, Step-by-Step Handbook for Business Continuity Practitioners

ISO 22301:2019 and business continuity management – Understand how to plan, implement and enhance a business continuity management system (BCMS)

ISO 22301 Free to read

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: BCMS, ISO 22301


Feb 02 2022

10 Steps to Cyber Security

Category: Cyber resilience,cyber securityDISC @ 4:34 pm

8 Steps to Better Security: A Simple Cyber Resilience Guide for Business

Harden your business against internal and external cybersecurity threats with a single accessible resource. 

In 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business, cybersecurity researcher and writer Kim Crawley delivers a grounded and practical roadmap to cyber resilience in any organization. Offering you the lessons she learned while working for major tech companies like Sophos, AT&T, BlackBerry Cylance, Tripwire, and Venafi, Crawley condenses the essence of business cybersecurity into eight steps.  

Tags: Cyber Resilience, Steps to Cyber Security


Sep 04 2021

JAPANESE ROCKET ENGINE EXPLODES: CONTINUOUSLY AND ON PURPOSE

Category: Cyber resilienceDISC @ 4:01 pm

Liquid-fuelled rocket engine design has largely followed a simple template since the development of the German V-2 rocket in the middle of World War 2. Propellant and oxidizer are mixed in a combustion chamber, creating a mixture of hot gases at high pressure that very much wish to leave out the back of the rocket, generating thrust.

However, the Japan Aerospace Exploration Agency (JAXA) has recently completed a successful test of a different type of rocket, known as a rotating detonation engine. The engine relies on an entirely different method of combustion, with the aim to produce more thrust from less fuel. We’ll dive into how it works, and how the Japanese test bodes for the future of this technology.

DEFLAGRATION VS. DETONATION

Humans love combusting fuels in order to do useful work. Thus far in our history, whether we look at steam engines, gasoline engines, or even rocket engines, all these technologies have had one thing in common: they all rely on fuel that burns in a deflagration. It’s the easily controlled manner of slow combustion that we’re all familiar with since we started sitting around campfires.

Tags: DEFLAGRATION VS. DETONATION


Apr 19 2021

Alarming Cybersecurity Stats: What You Need To Know For 2021

Cyber Attack A01

The year 2020 broke all records when it came to data lost in breaches and sheer numbers of cyber-attacks on companies, government, and individuals. In addition, the sophistication of threats increased from the application of emerging technologies such as machine learning, artificial intelligence, and 5G,  and especially from greater tactical cooperation among hacker groups and state actors. The recent Solar Winds attack, among others,  highlighted both the threat and sophistication of those realities.

The following informational links are compiled from recent statistics pulled from a variety of articles and blogs. As we head deeper into 2021, it is worth exploring these statistics and their potential cybersecurity implications in our changing digital landscape.

To make the information more useable, I have broken down the cybersecurity statistics in several categories, including Top Resources for Cybersecurity Stats, The State of Cybersecurity Readiness, Types of Cyber-threats, The Economics of Cybersecurity, and Data at Risk.

There are many other categories of cybersecurity that do need a deeper dive, including perspectives on The Cloud, Internet of Things, Open Source, Deep Fakes, the lack of qualified Cyber workers, and stats on many other types of cyber-attacks. The resources below help cover those various categories.

Top Resources for Cybersecurity Stats:

If you are interested in seeing comprehensive and timely updates on cybersecurity statistics, I highly recommend you bookmark these aggregation sites:

 300+ Terrifying Cybercrime and Cybersecurity Statistics & Trends (2021 EDITION) 300+ Terrifying Cybercrime & Cybersecurity Statistics [2021 EDITION] (comparitech.com)·        

The Best Cybersecurity Predictions For 2021 RoundupWhy Adam Grant’s Newest Book Should Be Required Reading For Your Company’s Current And Future LeadersIonQ Takes Quantum Computing Public With A $2 Billion Deal

134 Cybersecurity Statistics and Trends for 2021 134 Cybersecurity Statistics and Trends for 2021 | Varonis

 2019/2020 Cybersecurity Almanac: 100 Facts, Figures, Predictions and Statistics  (cybersecurityventures.com)

Source: The State of Cybersecurity Readiness:

Cyber-Security Threats, Actors, and Dynamic Mitigation

Related article:

Top Cyber Security Statistics, Facts & Trends in 2022

👇 Please Follow our LI page…


DISC InfoSec

#InfoSecTools and #InfoSectraining

#InfoSecLatestTitles

#InfoSecServices

Tags: Cybersecurity Stats


Mar 24 2021

What businesses need to know to evaluate partner cyber resilience

Category: Cyber resilience,Vendor AssessmentDISC @ 9:32 am

Many recent high-profile breaches have underscored two important cybersecurity lessons: the need for increased scrutiny in evaluating access and controls of partners handling valuable customer data, and the imperativeness of assessing a third party’s (hopefully multi-layered) approach to cyber resilience.

Given the average number of tech tools, platforms and partnerships today, having a clear and consistent partner evaluation process is critical for the protection of customer data and in limiting overall risk of exposure to cyber attacks. It is not an area where a business can “cut corners” to save time or dollars if the partnership cost seems too good to pass up – the long-term risk is simply not worth the short-term gain.

Recently, the Cybersecurity and Infrastructure Security Agency (CISA) included security ratings or scorings as part of its cyber risk reduction initiative. This is significant as it showcases there’s a need for consistent industry measurement to give businesses an objective, quantifiable way of determining an entity’s cyber risk and the level of trust they may incorrectly give to their partners who handle their data. While severalagencies and government stakeholders are starting to use security ratings, this idea of a uniform scoring system is still a pretty novel concept that will continue to evolve.

In the meantime, here are four questions businesses should ask when determining a partner’s cyber resilience to reduce the possible risks that come with giving external parties access to sensitive data.

What are your current standards for protecting customer data?

IT Vendor Risk Management A Complete Guide - 2021 Edition by [Gerardus Blokdyk]

Tags: evaluate partner cyber resilience


Jun 16 2020

Elite CIA unit that developed hacking tools failed to secure its own systems, allowing massive leak, an internal report found

The publication of ‘Vault 7’ cyber tools by WikiLeaks marked the largest data loss in agency history, a task force concluded.

The theft of top-secret computer hacking tools from the CIA in 2016 was the result of a workplace culture in which the agency’s elite computer hackers “prioritized building cyber weapons at the expense of securing their own systems,” according to an internal report prepared for then-director Mike Pompeo as well as his deputy, Gina Haspel, now the current director.

Source: Elite CIA unit that developed hacking tools failed to secure its own systems, allowing massive leak, an internal report found.

Wikileaks Vault 7: What’s in the CIA Hacking Toolbox?
httpv://www.youtube.com/watch?v=X45Bb8O-gMI

CIA Hacking Tools Released in Wikileaks Vault 7 – Threat Wire
httpv://www.youtube.com/watch?v=5LYSjLwkAo4

Download a Security Risk Assessment steps paper!

Download a vCISO template

Take an awareness quiz to test your basic cybersecurity knowledge

Subscribe to DISC InfoSec blog by Email





Jul 25 2019

Protecting Controlled Unclassified Information

Category: Cyber resilience,cyber securityDISC @ 12:04 am

Protecting Controlled  Unclassified Information 





CCPA: What You Need to Know About California’s New Privacy Law


CCPA Assessment:

A Roadmap to NIST 800-171 Compliance

DISC helps business owners in California to meet the new 2018 requirements of the CCPA and how to implement the National Institute of Standards and Technology’s (NIST) 800-171 cybersecurity framework. The roadmap is provided specifically to the CCPA either for a business, agency or organization that is required to meet this new State Law and describes both technical and administrative measures that will attain an acceptable level of compliance for State certifying officials. Assessment will include but not limited to compliance with policies and procedures, security strategy/plan, and plan of actions & milestones. The initial assessment will determine the as-is state of your data privacy program business, legal and regulatory requirements. DISC will provide a target state (to-be) which will include tech controls, mgmt. control, and ops control to build your data privacy program based on NIST 800-171. So basically the transition plan (roadmap) will enumerate the details of how to get from as-is state to to-be state.

DISC Cybersecurity consultant support business and agencies effectively to meet the 110 security controls in NIST 800-171 which has become the de facto standard for cybersecurity compliance. It ensures that security policies and practices of the framework meet the intent of CCPA. Adequate security is defined by ”compliance” with the 110 NIST 800-171 security controls.


NIST 800-171 Overview






Enter your email address:

Delivered by FeedBurner





Apr 10 2019

How to achieve cyber resilience in 7 steps

Category: Cyber resilienceDISC @ 5:28 pm

[pdf-embedder url=”https://blog.deurainfosec.com/wp-content/uploads/2019/04/Cyber-Resilience-in-7-Steps.pdf” title=”Cyber Resilience in 7 Steps”]

 

  • Cyber Resiliency Metrics | MITRE

  • Enter your email address:

    Delivered by FeedBurner