October 27, 2026, 8:30 a.m. (JST)
[Japan]
The Challenges
of Creating a Data Inventory Inventories of Keys and Cryptocurrencies Are Also Necessary
I believe that creating a data inventory is one of the most challenging aspects of this work. Naturally, data related to payments should be properly managed in databases and similar systems. However, not all data necessarily exists solely within the systems that a company is aware of.
For example, this may include data stored in cloud environments or SaaS services contracted independently by business units, data held by external contractors, data remaining after the termination of cloud service use, and data that falls outside the scope of the organization’s management policies or the IT department’s oversight.It is often said that the ownership, access permissions, retention periods, and protection status of such data tend to be unclear. As a result, this can lead to excessive access permissions, inappropriate sharing, unnecessary long-term retention, and gaps in encryption.
The key is to first identify where critical data is located and conduct a comprehensive inventory. Furthermore, it is important not to stop after a single inventory but to continuously discover, classify, and manage data—including checking whether new data is being created outside the scope of management.
Next, an inventory of cryptographic assets is required. This covers more than just cryptographic keys.This also includes SSH keys, public and private keys, keystores, cryptographic libraries, and cryptographic algorithms. Furthermore, it is necessary to understand where these cryptographic assets are located—whether in external services, internal networks, IT assets, databases, or application code—and how they are being used.
However, it is not necessary to conduct a comprehensive investigation of everything from the outset. A practical approach is to prioritize systems that take time to modify, focusing on critical systems, data that must be protected over the long term, and data with significant business impact.
The goal is not simply to create an inventory. It is crucial to be in a position to assess the scope of potential impacts should a change in cryptographic methods become necessary in the future, and to determine the priority of migration.
DSPM as
a Starting Point for Risk Visualization Linking to Data Protection and Key Control
With the expanding use of the cloud, SaaS, and AI, the data handled by companies is distributed across various locations. Although estimates vary depending on the survey, it is said that 80–90% of corporate data consists of unstructured data.Furthermore, the proliferation of AI is accelerating the generation, replication, summarization, and reuse of data. As a result, there is a risk that confidential data could be fed into AI services in ways unintended by users, or transmitted externally via APIs whose location or managing entity is not fully understood.
In some cases, not only data but also hard-coded encryption keys, API keys, service account credentials, secrets, and keys used for inter-machine communication are scattered throughout the entire environment. With both the data and the keys and secrets needed to protect and utilize it residing in various locations, managing them is becoming increasingly complex.
Gartner predicts that by 2027, more than 40% of AI-related data breaches will result from the improper use of generative AI across national borders. In other words, as the use of generative AI expands across borders, the risk of data breaches is increasing because data is being used in environments—including overseas services—that are beyond the company’s full control.Given this situation, we believe it is essential to continuously monitor where critical data is located, who has access to it, and what encryption technologies, keys, and secrets are being used to protect it.
Here, we will explain DSPM (Data Security Posture Management).DSPM is an approach that continuously discovers data distributed across various environments—such as the cloud, on-premises, and SaaS—classifies it according to its sensitivity and regulatory requirements, and then continuously analyzes and manages who has access to it and what risks it is exposed to.
This approach is fundamentally different from simply compiling a list of data in preparation for an annual audit.What is important in DSPM is not a one-time inventory, but continuously monitoring the state of the data. For example, it continuously tracks changes—such as when new data is generated, access permissions are modified, data is replicated in the cloud, or data is made public—to identify risks.
It is important to note that discovering data and visualizing risks through DSPM is not the same as actually protecting the data. We believe it is crucial to use DSPM as a starting point to link to actual data protection and key management.
In the era of AI and PQC, it is necessary not only to understand the location and access status of data but also to consider how to protect it—including cryptography, keys, API keys, and secrets. Of course, this does not mean that DSPM alone should handle all of these tasks.DSPM continuously discovers and classifies data, analyzing access patterns and exposure risks. By linking these results to specific protection measures—such as encryption, masking, tokenization, key management, and secret management—we believe it functions as an enterprise-wide data security solution.In other words, rather than viewing DSPM as a one-size-fits-all product category, it is important to use data discovery and risk visualization as a starting point and link them to actual data protection and key control.
Continuous Data Security Management
A Four-Stage Approach to Building a System That Can Be Explained to Third Parties
The key point we’d like to convey here is the concept of continuously managing data security through four stages. The first stage is “Discover.” We continuously track where critical data is located, how it is classified, and who has access to it.
The second stage is “Analyze.” We analyze risks by considering the data’s value, sensitivity, retention period, access status, exposure to external parties, and regulatory implications, and then determine the priority of countermeasures. Based on the results of this assessment, we implement appropriate protective measures such as encryption, tokenization, and masking.
The third step is “Protect.” Based on the analyzed risks and priorities, we apply measures such as encryption, tokenization, masking, and access control to effectively protect critical data.
The final step is “Control.” We manage keys, certificates, API keys, secrets, access permissions, policies, and other elements under a consistent framework to ensure organization-wide control.
Another important aspect is ensuring we are in a position to explain our practices to third parties. We believe it is crucial to be able to demonstrate to third parties—for example, by maintaining audit logs—what controls we have in place and that they are functioning properly.
To summarize once again, we believe that simply deploying encryption products is not sufficient to effectively protect data or to adequately demonstrate that controls—including those related to keys—are functioning properly.
Looking at the external environment—including RaaS and HNDL (Harvest Now, Decrypt Later) attacks, as well as the transition to PQC—the timeline, or “by when we need to respond,” becomes a critical metric. We must not only view these changes as imminent threats but also consider when and what actions we should take.
To do this, we must first identify where critical data is located, how important it is, and how long its confidentiality must be maintained. Based on that, we must conduct an inventory of which encryption technologies and keys are used to protect the data and who manages them. Even more important is determining the timing of the transition, taking into account the lifecycle of systems and products.If we wait until PCI DSS is revised and compliance with PQC is included as a requirement in some form before taking action, we may not be able to complete system procurement or upgrades in time. That is precisely why I believe it is crucial to begin the necessary preparations now—such as conducting an inventory, setting priorities, and verifying vendor roadmaps—rather than waiting for future requirements to be finalized.
Furthermore, looking back at the evolution of PCI DSS to date, there has been a growing emphasis not merely on implementing encryption, but on the controls necessary to ensure it functions effectively. We believe that how data is protected and how keys are managed and controlled will remain unavoidable issues moving forward.Up to this point, I have discussed these topics from our perspective while remaining as product-agnostic as possible. Finally, I would like to introduce Thales’ solutions to these challenges.
Thales
: A Leader in Cryptographic Key Management Building an Ecosystem with Key Players
We consider cryptographic key management to be one of Thales’s major strengths. At the same time, the transition to PQC cannot be accomplished by a single company alone. Globally, we are building an ecosystem to support the PQC transition by forming partnerships with technology vendors specializing in cryptographic asset discovery, as well as consulting firms, system integrators, and various other technology vendors.
If you are wondering, “How should we address PQC?”, please do not hesitate to consult with Thales. Rather than relying solely on Thales products to handle everything, we provide comprehensive support for your PQC transition through this partner ecosystem.In terms of solutions, we offer products and technologies that support the transition to PQC, such as the Luna HSM, High Speed Encryptor (HSE), and the CipherTrust Data Security Platform. For example, the Luna HSM natively supports NIST-standardized ML-KEM and ML-DSA.In addition, the Thales CipherTrust Data Security Portfolio offers a wide range of features necessary for data protection, from the discovery and classification of sensitive data to encryption, tokenization, access control, and key management.When combined with the Data Security Fabric (DSF), it also enables visualization of data access, continuous monitoring, and risk analysis. By combining these capabilities, we provide comprehensive support not only for protecting the data itself but also for controls that include keys and secrets.
Regarding DSPM, we provide a platform that can discover, classify, and comprehensively manage data—whether structured or unstructured—distributed across the cloud, SaaS, and on-premises environments.It uses machine learning and other technologies to automatically classify sensitive data, enabling continuous monitoring of data location, access status, and risks. Furthermore, we are expanding our capabilities to provide a more comprehensive view and management of security posture, including AI-related data, assets, keys, and secrets.
In terms of PCI DSS compliance, we also offer Imperva Cloud WAF and Client-Side Protection.While Cloud WAF protects public web applications, Client-Side Protection detects and inventories scripts on payment pages and monitors for tampering, thereby supporting compliance with PCI DSS 4.0 requirements 6.4.3 and 11.6.1.
If you are interested, please feel free to contact us.
Thank you very much for your attention today.
■Contact
Information 
Thales DIS Japan Co.
, Ltd. Cybersecurity
Products Division URL: https://cpl.thalesgroup.com/ja
Email: cpl.jpsales@thalesgroup.com
