T-PQC-half — PQC readiness for bank leadership, ½ day
Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)
Schedule
| Time | Block | Minutes |
|---|---|---|
| 09:00 | I-M0 — Welcome & client brief | 15 |
| 09:15 | I-M8 — Quantum & CBOM | 35 |
| 09:50 | A1 — Crypto agility | 10 |
| 10:00 | K-1 — Outside-in with Kartis | 30 |
| 10:30 | Break | 15 |
| 10:45 | C3 — Baseline assessment (CBA) | 50 |
| 11:35 | C8 — Report & readout | 30 |
| 12:05 | Wrap-up | 25 |
Before you start
Log in
Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.
| System | Address | Login | Used in |
|---|---|---|---|
| Eon Insights | https://insights.edu.eoncore.net | traineeNN | I-blocks, I-TAG, X1 |
| Eon Center | https://center.edu.eoncore.net | traineeNN (org_admin of team-NN) | C-blocks, K-blocks, X1 |
| Center, Kartis pages only | https://center.edu.eoncore.net | kNN (kartis_only) | K-blocks in the Insights + Kartis tracks |
| Isla public sites | https://<vhost>.isla.edu.eoncore.net | none | I-M2, K-1, C6, I-M11 |
In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.
Shared environment
- One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
- Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (
webshop — chain); do not change or delete a view you did not create. - There is no personal reset. Do not delete data, uploads or tags you did not create.
- Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
- Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by
traineeNNandkNNof the same team, and invisible to other teams. - Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
- AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.
Isla at a glance
Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.
| App (team) | Internal hosts | Subnet | Public vhosts |
|---|---|---|---|
| webshop | shop, api, db, pay .webshop.isla.test | 10.20.1.0/24 | www, shop, api, pay |
| intranet | sso, portal, cache .intranet.isla.test | 10.20.2.0/24 | intranet |
| payments | gw, vpn, hsm .payments.isla.test | 10.20.3.0/24 | none |
| loyalty | app, api, old .loyalty.isla.test | 10.20.4.0/24 | loyalty, loyalty-old |
Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.
Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.
Exercises
I-M0 — Welcome & client brief
| Exercise | Task | Finding |
|---|---|---|
| I-M0.1 | Log in to Insights; note the number of unique hosts on Home. Ask the Chat which hosts under isla.test have the lowest level. Center tracks: also log in to Center | — |
I-M8 — Quantum & CBOM
| Exercise | Task | Finding |
|---|---|---|
| I-M8.1 | CBOM page: quantumVulnerable, quantumSafeCount, readiness ratio, two weak algorithms, protocol versions, any hybrid KEX, first host to migrate | F01, F02, F05, F07, F08, F14 |
The hook to A1 (crypto agility) follows this block in some tracks.
A1 — Crypto agility
No exercise. Discussion question: NIST deprecates an algorithm Isla uses for card payments. Who at Isla knows how long replacing it takes, and where is that written down?
K-1 — Outside-in with Kartis
| Exercise | Task | Finding |
|---|---|---|
| K-1.1 | Log in to Center, switch to EN, start a discovery for isla.edu.eoncore.net on Scorecard; after 30 s note the scorecard counters | F03, F04, F08 |
| K-1.2 | Certificates: which host expires first, issuer, days left, scorecard bucket, owning team | F03 |
| K-1.3 | DNS / Email for isla.edu.eoncore.net: map every SPF include and DKIM selector to a party; compare with the brief; is spoofing covered? | F11, F12 |
| K-1.4 | Technology: CDN and cloud provider per vhost; in the brief? What does a CDN in front of www mean for TLS keys? | — |
C3 — Baseline assessment (CBA)
| Exercise | Task | Finding |
|---|---|---|
| C3.1 | Interview the CISO (trainer). Short: the 10 marked questions; full: all 36, your pair's subcategories. Write her answers in her words; probe at least three | — |
| C3.2 | Set a maturity level per question with a one-line reason; create assessment Isla — PQC baseline for team-NN and import the workbook | — |
| C3.3 | Run the AI assessor on question 17 (full: also 33); compare its level with yours, edit, decide on Approve | F03 |
| C3.4 | Gap table per subcategory: current level, 12-month target, gap, driver (DORA / NIS2 article or PQC exposure) | F14 |
C8 — Report & readout
| Exercise | Task | Finding |
|---|---|---|
| C8.1 | Generate the Kartis management report: which of F02, F03, F08, F09, F11, F12 appear, in which counter, which is missing and why? | F02, F03, F08, F09, F11, F12 |
| C8.3 | One page per group: where we stand (Q1, Q2), what it costs (hours), what first (three actions, owner, date); read out to the CISO | — |
Queries, live checks and templates
Live checks
Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.
B.1 3DES on pay (I-M2.3, K-1.6, C6.1)
openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
-tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/nullB.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)
openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
-tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/nullHandshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.
B.2 TLS versions on intranet (K-1.5, C6.2, I-M11)
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null