SOBRE ESTE EPISÓDIO
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Stefan Wenig, CEO and CTO at SignPath, to discuss why code signing must be treated as a complete business process, not simply a matter of managing keys and certificates.
They explore how changing baseline requirements are reshaping code signing, why organizations need greater visibility into their certificate landscapes, and how centralized infrastructure can bring development, operations, and security teams into alignment.
What You’ll Learn:
- Why code signing is a wider security and operational process
- How evolving baseline requirements are changing code signing practices
- Why visibility into keys and certificates must come before greater control
- How centralized procurement and infrastructure reduce security gaps
- Why crypto agility is essential for post-quantum readiness
Stefan Wenig is the CEO and CTO of SignPath. He specializes in code signing, secure software development, certificate management and the infrastructure organizations need to protect their software supply chains. Through his work, Stefan helps organizations bring greater visibility, flexibility and centralized control to signing processes that often span development, security and operations teams.
If you enjoyed this episode, make sure to subscribe, rate, and review on Apple Podcasts, Spotify, and YouTube Podcasts, instructions on how to do this are here.
- [00:59] Code Signing Is a Complete Process
Code signing cannot be reduced to isolated key management or certificate management decisions. It sits inside a much larger system involving secure software development, DevOps, operations and multiple teams with different responsibilities. Security depends on those smaller practices working together rather than being handled independently.
- [02:17] Baseline Requirements Are Raising the Standard
Changes to FIPS requirements have strengthened expectations around how code signing keys are stored. Dedicated, certified devices make it harder for private keys to be copied or stolen. Certificate validity periods have also shortened, increasing the operational pressure on organizations that still manage certificates manually.
- [03:45] Crypto Agility Cannot Wait for Quantum Computing
Nobody knows exactly when quantum computers will be capable of breaking today’s cryptographic algorithms. That uncertainty does not remove the need to prepare. Organizations need signing infrastructure that can switch algorithms quickly and support the move toward quantum-safe standards as platforms adopt them.
- [07:32] Centralization Reduces Hidden Security Gaps
Certificate procurement, key issuance, and signing access should flow through a centralized process. Without it, development teams may create direct arrangements with operations teams or purchase certificates from providers without the security team knowing. Centralized infrastructure creates a clear source of truth and makes access easier to audit.
- “Code signing is a process much more than any isolated key management or certificate management issue.”
- “It’s important to lay it out for everybody who’s involved and make sure that all the little practices really work together to achieve the ultimate goal of security.”
- “We don’t know when quantum computers will be able to actually break codes, but we have to prepare.”
- “Every organization should prepare in every aspect of their crypto procedures to be able to switch to quantum-safe algorithms.”
- “If you don’t know where your keys are, if you don’t know what certificates have been issued in your organization’s name, then you’re basically sitting ducks.”
- “Whenever somebody needs a key or certificate, it has to go through some kind of central infrastructure and some kind of centralized process.”
Trust.ID Talk: The Digital Certificate and Identity Security Podcast is handcrafted by our friends over at: fame.so
Inglês
Estados Unidos da América
TRANSCRIÇÃO 🔗
Are you the producer of this podcast?
Add a podcast transcript
Need Audio-to-Text?
Transcribe with Listen411 in Just 60 Seconds
PESQUISAR EPISÓDIOS PASSADOS
Pesquisar episódios anteriores de Trust.ID Talk: The Digital Certificate and Identity Security Podcast.
OUTROS EPISÓDIOS NESTE PODCAST
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Arvid Vermote, Chief Information Security Officer (CISO) at GlobalSign, to dive into the Certificate Authority/Browser Forum (CA/B Forum), the decision-making body behind the…
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Alexander Byrne, Director of Compliance at Thrive, to discuss how organizations can leverage compliance as a competitive advantage rather than viewing it simply as a regulato…
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson is joined by Giles Thornton, Head of Information Security at The Premier League, to explore why security teams feel like they’re constantly firefighting and how to break free. Giles share…
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, host Michelle Davidson welcomes back Arvid Vermote, Chief Information Security Officer (CISO) at GlobalSign, to break down what post-quantum computing really means for organizations today.
What You’ll Learn:
H…
In this episode of Trust.ID Talk: The Digital Certificate and Identity Security Podcast, hosts Michelle Davidson and Steve Hall, reflect on 2025’s biggest cybersecurity shifts and what these changes mean for organizations in 2026. Alexander Byrne, Director of Compliance at Thrive, Olivier Ruff, Cyb…
Aviso: O podcast e a arte incorporada nesta página são de GMO GlobalSign Limited, que é propriedade de seu proprietário e não é afiliado ou endossado por Listen Notes, Inc.
EDITAR
Obrigado por ajudar a manter a base de dados dos podcasts atualizada.
