Topic starter
25/06/2026 10:24 pm
TL;DR: Encryption, key management, and protected data handling remain tied to identity governance across machine and human access paths, as ASPG’s MegaCryption event on July 2 is a cryptography-focused webinar listing with no substantive technical detail. The absence of operational detail means practitioners should read it as a reminder that cryptography only works when identity, entitlement, and secret handling are controlled.
Editorial analysis by NHI Mgmt Group, based on content published by ASPG: “MegaCryption”.
Key questions
Q: How should teams govern cryptography in identity security programmes?
A: Treat cryptography as dependent on identity governance, not separate from it.
Q: Why do encryption controls not fully solve identity governance risk?
A: Because encryption protects data states, not who can reach the data or how that access is managed over time.
Practitioner guidance
- Audit decrypt-capable identities Identify every human account, service account, and workload identity that can reach keys, recovery functions, or protected data stores.
- Tie key access to lifecycle controls Map key and secret access to joiner-mover-leaver, recertification, and offboarding processes so decryption rights change when role or vendor relationships change.
- Reduce standing recovery privilege Limit persistent administrative rights over encryption systems and require temporary elevation for recovery, export, or rotation operations.
Bottom line: Encryption does not provide meaningful protection unless the identities around keys, recovery paths, and secret material are governed tightly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:55 pm
Cryptography is an assurance layer, not a control substitute: Encryption only holds its value when the identities that can decrypt, mount, export, or recover protected data are tightly governed. If entitlement scope is loose, the cryptography still exists but its security boundary is effectively wider than intended. Practitioners should treat identity governance as part of the cryptographic control plane, not a separate discipline.
A question worth separating out:
Q: When should organisations review key access and secret handling together?
A: They should review them together whenever privileged access, offboarding, vendor relationships, or workload changes can alter who can decrypt data. If the identities around the encryption layer are not reassessed at the same time, the protection envelope can silently expand.
👉 Read our full editorial: MegaCryption event signals cryptography matters for identity security