Frontiers stage summary

8 min 5 concepts 5 figures

Frontiers covers the four subjects the rest of the course could not honestly compress into a practice stage: transport security after the arrival of post-quantum standards, the device networks that now outnumber the machines people type on, the automation stack that replaced box-by-box configuration, and the transport work still moving through the standards process. It ends with a capstone that makes you say all of it out loud to a board and defend it.

One argument runs through the stage, and it is not about prediction. Every change taught here is already in production somewhere, and every one of them carries a date. Hybrid post-quantum key exchange has been the browser default since Chrome 124 in April 2024. Matter runs over Thread in homes that never chose IPv6. Certification syllabuses added automation in 2024. So the professional skill on the frontier is dating and sourcing rather than forecasting: name what is standardised, name what is still an Internet-Draft, name the observatory that produced the number, the population it watched and the day it was measured. A claim without those four things is a rumour with a decimal point.

The sections follow the stage's teaching order, so you can read straight through to rebuild the stage, or jump to the concept you need. Each section links back to its module for the full treatment.

What you carry out of this stage

  • Order a post-quantum migration correctly, key exchange first and signatures later, and justify that order from harvest-now-decrypt-later rather than from vendor messaging
  • Say what each finalised NIST standard does (FIPS 203 ML-KEM for key encapsulation, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for signatures) and place an estate against the NIST IR 8547 dates of 2030 and 2035
  • Design an industrial segment as IEC 62443 zones and conduits, using Purdue levels only as a map, and explain why cloud and IIoT data paths cross those levels by design
  • Read a Matter and Thread home network for what it is, an IPv6 mesh joined to the LAN and the internet by a border router
  • Name the model-driven automation stack (NETCONF, YANG, RESTCONF, OpenConfig, gNMI) and say which component a given failure belongs to
  • Tell an RFC from an Internet-Draft inside a citation, and refuse a claim that the draft cannot support even when the feature is already shipping
  • Triangulate an adoption claim across Cloudflare Radar, APNIC Labs, W3Techs and the NIST RPKI Monitor, naming the population, method and date behind each figure
  • Brief a board on what changed in networking, with a recommended next step and a date for each migration position, and hold the claim when someone asks where the number came from

Four stages carry a learner from vocabulary to frontier judgement

Foundations, Applied and Practice run along the top row and Frontiers returns to the exam terminus, and each connector names what the stage before it hands on, so a stage taken out of order arrives without the language the next one assumes.

The course is one request path learned four times over, each pass deeper than the last, then examined: vocabulary, protocol behaviour, operational judgement, frontier readiness, two papers. Source: blueprint sections 1 and 4.

Four stages carry a learner from vocabulary to frontier judgement A serpentine map of five stage cards, module chips in brackets. Row one, left to right: Stage 1 Foundations, vocabulary of the path (IPv6, Wi-Fi, URL to first byte); Stage 2 Applied, the living protocols (TCP and congestion, DNS, TLS); Stage 3 Practice, securing and observing the path (zero trust, cloud, DDoS). The chain turns down the right into row two, read right to left: Stage 4 Frontiers, where the path is going (post-quantum, automation, measurement); then the Stage 5 exam and certification terminus, tinted red (revision guide, exam practice, mock exams). Connectors read shared vocabulary, protocol behaviour, operational judgement, frontier readiness, two papers one certificate. Stage 1Foundationsthe vocabulary of the pathIPv6Wi-FiURL to first byte Stage 2Appliedthe living protocolsTCP and congestionDNSTLS Stage 3Practicesecuring and observing thepathzero trustcloudDDoS Stage 4Frontierswhere the path is goingpost-quantumautomationmeasurement Stage 5Exam andcertificationFoundation andPractitioner papersrevision guideexam practicemock exams sharedvocabulary protocolbehaviour operationaljudgement frontier readinesstwo papers, one certificate

Key exchange migrated first because confidentiality has a deadline and authentication does not

Harvest-now-decrypt-later sets the order of the whole migration. An attacker who records an encrypted session today needs no quantum computer today, only storage and patience, so anything confidential with a long shelf life is already exposed to a machine that does not yet exist. Authentication does not work that way. A signature forged in 2035 cannot retroactively fake a handshake that completed in 2026, because by then nobody is trying to convince you of anything about that session. Confidentiality therefore has a deadline that runs from the moment traffic crosses the wire, and signatures can follow at the pace of the certificate estate.

The standards finally landed in August 2024: FIPS 203 ML-KEM for key encapsulation, FIPS 204 ML-DSA and FIPS 205 SLH-DSA for signatures. NIST IR 8547 puts a clock on the classical algorithms, deprecating public-key cryptography after 2030 and disallowing it after 2035. What actually deploys today is hybrid. X25519MLKEM768, specified in draft-ietf-tls-ecdhe-mlkem and still a draft, carries a classical X25519 share and an ML-KEM share in the same handshake so an attacker has to break both. It has been default in Chrome since version 124 in April 2024 and in Firefox 132, and it was negotiated in more than 30 percent of TLS 1.3 handshakes at Cloudflare's edge in early 2026.

Certificates are the part that has not moved. The chain a browser validates is still classical, and ML-DSA signatures have only started to appear on the network, with Cloudflare beginning to offer them on origin-facing connections in mid 2026. That gap is the whole misconception this module exists to kill: post-quantum TLS in 2026 means a post-quantum key exchange under a classical certificate. The useful work now is inventorying long-lived secrets, checking which group your stack actually negotiates in the browser security panel, and planning against the IR 8547 dates rather than a supplier's roadmap.

Two key exchanges, one session: hybrid post-quantum TLS

One ClientHello carries both the classical and the post-quantum share, and the two secrets are combined into a single key schedule, so recorded traffic stays private unless an attacker breaks both exchanges rather than either.

Hybrid key exchange puts a classical X25519 share and an ML-KEM-768 share in one ClientHello, so a recorded session survives unless both fall; X25519MLKEM768 is draft-ietf-tls-ecdhe-mlkem, still a draft.

Two key exchanges, one session: hybrid post-quantum TLS A sequence diagram with two lifelines, Client (browser) on the left and Server (TLS 1.3) on the right. The ClientHello arrow carries two key shares: X25519, the classical share, and ML-KEM-768, the post-quantum share. The ServerHello arrow returns both halves in one named group. Below the lifelines, two cards name the classical X25519 secret and the ML-KEM-768 secret from FIPS 203; labelled arrows feed both into a single emphasised card, Combined shared secret, which states that both secrets feed one TLS 1.3 key schedule. A final band concludes that an attacker must break both exchanges, and notes that X25519MLKEM768 is an IETF draft, not an RFC. Client (browser) Server (TLS 1.3) ClientHello key_share: X25519, the classical share key_share: ML-KEM-768, the post-quantum share ServerHello key_share: X25519 share and ML-KEM ciphertext both halves carried in one named group CLASSICAL HALF X25519 key exchange Elliptic-curve secret,at risk from a futurequantum computer. POST-QUANTUM HALF ML-KEM-768 key exchange Key encapsulation fromFIPS 203, finalised inAugust 2024. classical half post-quantum half ONE SESSION Combined shared secret Both secrets feed one TLS 1.3 key schedule. The named group is X25519MLKEM768. one TLS 1.3 key schedule An attacker must break both exchanges Recorded traffic stays private unless X25519 and ML-KEM-768 both fall. X25519MLKEM768 is specified in draft-ietf-tls-ecdhe-mlkem, an IETF draft, not an RFC.
Go deeper in Module 30: Post-quantum TLS: what migrated first and why

Purdue is a map of a plant; zones and conduits are what you actually design

Consumer and industrial devices are the growth edge of networking, and everything the course has taught so far now applies to hardware that cannot run an agent and will not be patched this quarter. Matter, from the Connectivity Standards Alliance, is one application standard that devices speak across Wi-Fi, Ethernet and Thread. Thread is the low-power IPv6 mesh underneath it, and the Thread border router is what joins that mesh to the home LAN and the IPv6 internet. The consequence is quietly large: households are running IPv6 segments nobody consciously chose, so the addressing material from the foundations stage arrives in ordinary homes through the back door.

Industrial networks invert the priorities the rest of the course assumes. Availability and safety outrank confidentiality, and patch windows are measured in years rather than weeks, so a control that is merely inconvenient in an office is unacceptable on a line. The Purdue model still earns its place as a conceptual map of those levels, but it is not a design. Real designs are IEC 62443 zones and conduits: assets grouped by shared security requirement, with the crossings between groups made explicit and controlled. NIST SP 800-82r3 is the engineering reference for that work, and NIS2 sets the European regulatory floor. Cloud and IIoT data paths break strict level ordering by design, which is the practical reason the map cannot be handed to an engineer as a target state.

Salt Typhoon is the case that shows where the pressure actually lands. A PRC state actor was inside major US telecoms from October 2024, CISA issued hardening guidance in December 2024, and the joint advisory AA25-239A followed in August 2025. CISA now advises high-risk users to prefer end-to-end encrypted messaging. The lesson for a network professional is that the management plane, not the data plane, was the objective: the devices that configure and monitor the network are the crown jewels, and carrier infrastructure is contested ground rather than neutral plumbing.

Zones decide the blast radius; conduits decide the crossings

The conduits are the only crossings drawn between the enterprise, DMZ and control zones, so a path with no conduit does not exist in the design, and the Purdue levels sit behind them as grey context rather than as the boundary itself.

IEC 62443 zones group assets by the consequence of a compromise and conduits are the only permitted crossings; the Purdue levels are a map, not the design (blueprint correction 22, NIST SP 800-82r3).

Zones decide the blast radius; conduits decide the crossings A zone board read from top to bottom. An opening band states that the Purdue levels are drawn here as grey context only and that IEC 62443 zones and conduits are the design. Zone 1, the enterprise zone, holds business applications and corporate laptops. Zone 2, the DMZ zone, holds a historian replica and a brokered jump host. Zone 3, emphasised, is the control zone, holding SCADA servers, operator screens, PLCs and safety instruments where availability outranks confidentiality. Between the zones sit two conduit cards, each reached and left by a labelled arrow, and they are the only crossings drawn on the board. THE DESIGN, NOT THE MAP Zones group assets by consequence; conduits are the only crossings The Purdue levels appear here in grey as context only. IEC 62443 zones and the conduitsbetween them are what an engineer designs, with NIST SP 800-82r3 as the reference. ZONE 1 Enterprise zone Purdue levels 4 and 5, context only Business applications Orders, reporting and email,run and patched by IT. Corporate laptops and identity Browsers, the open internet,ordinary users and suppliers. ZONE 2 DMZ zone Purdue level 3.5, context only Historian replica A copy the enterprise reads,never the running source. Brokered jump host Sessions are brokered, recordedand bounded in time. ZONE 3 Control zone Purdue levels 0 to 3, context only SCADA servers and operator screens Availability and safety outrankconfidentiality here. PLCs and safety instruments Patch windows are measuredin years, not in days. CONDUIT 1 Enterprise to DMZ One named protocol, authenticated at the boundary andlogged. Everything else is denied. CONDUIT 2 DMZ to control zone A brokered session only. No enterprise host reaches acontroller. the traffic that asks to cross only the named protocol continues the only path towards control one brokered session continues
Go deeper in Module 31: IoT and OT: Matter, Thread and industrial segmentation

Automation stopped being an elective when the syllabus bodies ratified it

Configuring devices one command line at a time does not survive contact with a network of any size, and the industry has moved. Industry surveys report automation rising from roughly 44 percent of organisations in 2024 towards two thirds by early 2026. The change is not that scripts appeared, it is that the unit of work stopped being a command and became a model: you describe the state you want, and something else works out the commands.

The stack has five named parts and they divide the work cleanly. NETCONF (RFC 6241) is the transaction protocol that carries a change to a device. YANG (RFC 7950) is the schema language that says what can be configured and how it is shaped. RESTCONF (RFC 8040) is the HTTP face of those same YANG models, so it shares the schema and differs in transport. OpenConfig is the vendor-neutral model set that stops each supplier inventing its own vocabulary. gNMI carries streaming telemetry back the other way. Naming the parts pays off in diagnosis, because every failure belongs to one of them: a change that will not validate is a schema problem, a change that will not commit is a transaction problem, and a device that reports nothing is a telemetry problem.

Around that stack sits config as code. Templates live in Git, continuous integration renders and validates them, and pre-change checks catch the outage before it ships rather than after. Intent-based and closed-loop operation extend the idea: declare the desired state, let the system converge, then verify convergence against the declaration, with the honest caveat that most real deployments sit some distance behind the slideware. The certification bodies have ratified the shift, which is the least arguable evidence available: CCNA 200-301 v1.1 (August 2024) added generative AI, cloud management, Ansible and Terraform, and Network+ N10-009 (June 2024) added SDN and SD-WAN, infrastructure as code and VXLAN, with N10-008 retired in December 2024.

Intent sits at the hub while telemetry closes the loop

Intent sits at the hub and the two extra arrows reach validate and compare, so the proposed change and the running network are tested against the same declared state, and the gap between them becomes the next change.

Network automation is a closed loop around one declared intent: YANG (RFC 7950) models it, NETCONF (RFC 6241) and RESTCONF (RFC 8040) push it, and streamed telemetry measures the running network back against it.

Intent sits at the hub while telemetry closes the loop A closed six step cycle drawn clockwise around a hub. The hub is Intent: the declared state every step serves and reports back to. Top left, step one models the device with YANG, RFC 7950, and OpenConfig. Top right, step two renders the change from that model in Git. Right, step three validates the candidate in CI. Bottom right, step four pushes it as a transaction with NETCONF, RFC 6241, or RESTCONF, RFC 8040. Bottom left, step five streams running state back with gNMI. Left, step six compares measured state to intent, and the gap becomes the next change. Two further arrows run from the hub to the validate and compare steps, since both test the same declared intent. STEP 1 Model, then command YANG (RFC 7950) is the schemathat names every field a devicewill accept. OpenConfig is thevendor neutral set of thosemodels. STEP 2 Render from the model Templates live in Git, so achange arrives as a commit anda review rather than a sessionon a box. STEP 6 Compare to intent Measured stateagainst declaredstate. The gap isthe next change. HUB Intent The declared state.Every step serves it,and every stepreports back to it. STEP 3 Validate first CI checks thecandidate againstthe model beforeanything reaches adevice. STEP 5 Stream the state back gNMI streams operational statecontinuously, so the networkreports itself instead ofwaiting to be polled. STEP 4 Push it as a transaction NETCONF (RFC 6241) commits thechange or rolls it back.RESTCONF (RFC 8040) is the samemodels over HTTP. the schema shapes the template a candidate, not a command validation passed the devices report what changed running state, as it happens the gap becomes the next change the target state the same intent
Go deeper in Module 32: Automation: from CLI craft to config as code

The frontier is dated, and every number needs a source, a method and a population

The transport frontier is smaller and more specific than the marketing suggests. MPTCP (RFC 8684) ships where multi-homing genuinely pays rather than everywhere. TCP Fast Open (RFC 7413) is the cautionary tale of the group: a sound idea that middlebox reality held back. DNS over QUIC (RFC 9250) runs in production resolvers, with Quad9 enabling DoH3 and DoQ across its network in March 2026. WebTransport over HTTP/3 gives the web something socket-shaped to build on. Multipath QUIC is still an Internet-Draft, draft-ietf-quic-multipath, at version 21 in March 2026.

Standards literacy is what keeps that list honest. The prefix draft-ietf- in a citation changes what you are entitled to claim, and shipping does not promote a document: X25519MLKEM768 is default in two major browsers and is still a draft, exactly like BBRv3 and Happy Eyeballs v3. Cite the working group document by name, call it a draft, and describe its behaviour as an implementation choice rather than a settled standard.

Measurement literacy is the same discipline pointed at numbers. The public observatories watch different populations by different methods and are not interchangeable. Cloudflare Radar measures traffic crossing one very large network, and put QUIC at roughly 21 to 35 percent of traffic depending on the window and method as measured on 13 July 2026. W3Techs measures whether sites advertise support, and put HTTP/3 at about 39 percent of websites on the same date. APNIC Labs measures end-user IPv6 capability at about 42 to 43 percent worldwide, with India and France above 70 percent, while Google's own statistics measured 50.10 percent of its users on IPv6 on 28 March 2026. The NIST RPKI Monitor measures routing objects instead of users, showing more than 50 percent of IPv4 routes covered by roughly 480,000 ROAs while only about 12 percent of stub autonomous systems are fully protected. Two honest measurements of the same phenomenon can sit a long way apart without either being wrong, so the habit that closes the course is to state source, method, population and date every time.

What is deployed, what is drafted, what is niche

Reading across says published or still a draft and reading down says general traffic or a niche, so DNS over QUIC and TCP Fast Open are placed by the same two questions, and Multipath QUIC and Multipath TCP share a row while only one may be cited as an RFC.

Multipath TCP is RFC 8684 and Multipath QUIC is draft-ietf-quic-multipath, version 21 of March 2026: the same idea on opposite sides of the line between what you may cite as an RFC and what you may not.

What is deployed, what is drafted, what is niche A quadrant board. The columns are standards status: still an Internet-Draft on the left, published as an RFC on the right. The rows are what the mechanism aims at: general traffic on top, niche use below. Top left holds WebTransport, carried over HTTP/3 with no RFC number of its own. Top right holds DNS over QUIC (RFC 9250) and L4S (RFC 9330, 9331, 9332). Bottom left holds Multipath QUIC, draft-ietf-quic-multipath version 21 of March 2026, which must never be cited as an RFC. Bottom right holds TCP Fast Open (RFC 7413) and Multipath TCP (RFC 8684). A labelled arrow joins Multipath QUIC to Multipath TCP. A legend explains the red draft fill and the white published fill. across: status down: its reach STILL AN INTERNET-DRAFT PUBLISHED AS AN RFC General Aimed at ordinary traffic, for everyone on it Niche Solves one problem for particular hosts and paths WebTransport Internet-Draft, no RFC number A socket-shaped API for the web, carried over HTTP/3 (RFC 9114). This course cites no RFC number for it; read the current draft. DNS over QUIC RFC 9250 Encrypted DNS on UDP 853; Quad9 enabled it in March 2026. L4S low latency RFC 9330, 9331, 9332 Ships in DOCSIS low latency modes; the modern answer to bufferbloat. Multipath QUIC draft-ietf-quic-multipath The same multipath idea as MPTCP, written for QUIC instead of TCP. Version 21 dates from March 2026. Never cite it as an RFC. TCP Fast Open RFC 7413 Published, but middlebox reality kept it a specialist option. Multipath TCP RFC 8684 Published and shipping where multi-homing pays for itself. same idea, one is citable as an RFC Red fill: still a draft. Cite the draft name and its version, never an RFC number. White fill: published RFC. Cite the number, and the date you checked the claim.
Go deeper in Module 33: The transport frontier, and how to read the numbers

The capstone is a briefing you have to defend, not a summary you get to recite

The capstone turns the stage into a one-page briefing for a board, written using only claims you can source. That constraint is the exercise. Anyone can list what changed in networking; the test is whether the list survives a director asking where the figure came from and how old it is, which is the same question the measurement-literacy module trained you to ask of everyone else.

Two tabletops supply the pressure. The flood is an HTTP/2 Rapid Reset style attack, CVE-2023-44487 from October 2023, where Google mitigated 398 million requests per second, Cloudflare 201 million and AWS 155 million: the drill is what evidence layer 3, layer 4 and layer 7 can each contribute, who owns mitigation at each point, and what you are prepared to say publicly while the incident is live. The intrusion is a Salt Typhoon style carrier compromise: the management plane is the exposure, end-to-end encrypted messaging is what CISA advises high-risk users to prefer, and the regulator's questions tend to arrive before the log search finishes.

The migration position is the deliverable that outlives the exercise. Post-quantum transport is planned against the IR 8547 dates, deprecation after 2030 and disallowance after 2035. Certificate lifetimes are already falling under CA/Browser Forum ballot SC-081v3, to 200 days from 15 March 2026, 100 days from March 2027 and 47 days from March 2029, which makes ACME automation a dependency rather than a preference. IPv6-mostly rollout picks its first segments deliberately. Zero trust network access, chosen by more than 70 percent of new remote-access deployments, replaces the VPN default. Each position gets a recommended next step, a date and a source, and each one has to be held when challenged.

Every layer owes the incident evidence before blame lands

Each lane owes its evidence before its gate opens, and the fail routes down the spine read counters are clean, the path is stable and transport looks healthy, so a layer that explains nothing still hands on what it ruled out.

Run an incident as four gated evidence lanes: link, network, transport (including UDP 443 reachability, RFC 9114) and application traces either explain the timing users feel or hand on what they ruled out.

Every layer owes the incident evidence before blame lands A decision board read top to bottom. An alert card enters at the top: checkout is slow for a subset of users. Four lanes follow, one per layer, for link, network, transport and application. Each lane names the evidence that layer owes and carries a gate strip with the question that evidence must answer. From each gate a labelled arrow runs right into a pass card, reading counters move, the path moved, the timing fits and the clock fits, and each pass card states what to do next. The fail route runs down the spine, labelled clean and escalate, into the next lane. A closing card says four ruled out layers are still evidence. Alert: checkout is slow for a subset of users The tabletop opens with a symptom. Each layer then owes the incident the evidence only it canproduce, and each gate either names the cause or hands on what it has ruled out. Link: the switch port and the radio Interface counters, error rates, Wi-Fi retries androaming. Gate: do the counters move when the users complain? Network: the path the packets took Routes, next hops, and traceroute read as evidence. Gate: did the path change when the timing changed? Transport: the conversation itself Handshakes, retransmissions, round trip time, UDP 443. Gate: does the transport timing match the symptom? Application: what the server actually did Server timings, status codes and correlated traces. Gate: does the server clock account for the wait? Pass: link at fault Fix the port or the radio.The rest was a symptom. Pass: the path changed Take it to routing, not tothe application team. Pass: transport owns it Loss or a blocked UDP 443explains the wait. Pass: the server is slow The trace has to prove it,not the dashboard. start at the bottom of the stack counters move the path moved the timing fits the clock fits counters are clean, escalate the path is stable, escalate transport looks healthy, escalate no lane answered it If no lane answers, say so, and say what you ruled out An unresolved incident with four ruled out layers is still evidence: it narrows the next test, andsaying so out loud is what the tabletop exists to rehearse.
Go deeper in Module 34: Frontiers capstone: brief the board on what changed

The traps this stage warns against

  • Saying that post-quantum TLS means the site now has a post-quantum certificate.

    Instead: What deployed is hybrid key exchange: X25519MLKEM768, a draft, combining a classical X25519 share with an ML-KEM share, default in Chrome since version 124 in April 2024 and in Firefox 132, and above 30 percent of TLS 1.3 handshakes at Cloudflare's edge in early 2026. Certificates are still classical, and ML-DSA signatures only began appearing on origin-facing connections in mid 2026.

  • Handing an engineer a Purdue level diagram and calling it the segmentation design for an OT network.

    Instead: Purdue is a conceptual map. The design instrument is IEC 62443 zones and conduits, engineered against NIST SP 800-82r3, with NIS2 as the European regulatory floor. Cloud and IIoT data paths cross the Purdue levels by design, so a plan that assumes strict level ordering is describing a plant that no longer exists.

  • Citing Multipath QUIC, BBRv3, Happy Eyeballs v3 or X25519MLKEM768 as an RFC because a browser or kernel already ships it.

    Instead: All four are Internet-Drafts. Shipping is an implementation decision, not publication. Cite the working group document (draft-ietf-quic-multipath, draft-ietf-ccwg-bbr, draft-ietf-happy-happyeyeballs-v3, draft-ietf-tls-ecdhe-mlkem), call it a draft, and keep the claim inside what a draft can support.

  • Treating network automation as a specialist elective that the team can adopt when there is spare capacity.

    Instead: Industry surveys report automation rising from roughly 44 percent of organisations in 2024 towards two thirds by early 2026, and the syllabus bodies have ratified the shift: CCNA 200-301 v1.1 in August 2024 added Ansible, Terraform, cloud management and generative AI, and Network+ N10-009 in June 2024 added SDN, SD-WAN, infrastructure as code and VXLAN, with N10-008 retired in December 2024.

  • Quoting a single adoption percentage for QUIC, HTTP/3 or IPv6 with no observatory, method or date attached.

    Instead: Name all four parts. QUIC ran at roughly 21 to 35 percent of traffic on Cloudflare Radar depending on window and method, about 39 percent of websites advertised HTTP/3 on W3Techs, both measured 13 July 2026; APNIC Labs put IPv6 capability at about 42 to 43 percent while Google measured 50.10 percent of its own users on 28 March 2026. Different populations, different methods, both true.

  • Reading Salt Typhoon as an attack on customer traffic and responding by hardening the data path.

    Instead: The management plane was the target. A PRC state actor was inside major US telecoms from October 2024, CISA published hardening guidance in December 2024 and joint advisory AA25-239A in August 2025, and CISA now advises high-risk users to prefer end-to-end encrypted messaging. Harden the devices that configure and monitor the network first.

Core distinctions

  • ML-KEM (FIPS 203) encapsulates keys and is what migrated first; ML-DSA (FIPS 204) signs, and signature migration is only beginning, which is why the certificate chain your browser validates is still classical
  • Hybrid key exchange defends confidentiality against decryption years from now; post-quantum certificates defend authentication only at the moment the handshake happens, so a signature cannot be attacked retrospectively and the migration order follows
  • Matter is the application standard the devices speak; Thread is one of the link layers it can run over, alongside Wi-Fi and Ethernet, and the Thread border router is what joins the IPv6 mesh to the LAN
  • A zone groups assets that share a security requirement; a conduit is the controlled crossing between zones, and the policy lives on the conduit, not inside the zone
  • Purdue levels are a conceptual map of a plant; IEC 62443 zones and conduits are the design instrument, and cloud and IIoT paths cross the levels by design
  • NETCONF (RFC 6241) is the transaction protocol on its own session; RESTCONF (RFC 8040) is the HTTP face of the same YANG models, so the schema is shared and the transport differs
  • YANG (RFC 7950) is the schema language; OpenConfig is a vendor-neutral set of models written in it, and gNMI carries telemetry back rather than pushing configuration out
  • An RFC is published and citable as settled; an Internet-Draft such as draft-ietf-quic-multipath or draft-ietf-ccwg-bbr is work in progress, and being default in a shipping browser does not promote it
  • Cloudflare Radar measures traffic share across one very large network; W3Techs measures how many sites advertise support, so 21 to 35 percent of QUIC traffic and about 39 percent of sites advertising HTTP/3 are two different measurements rather than a contradiction
  • APNIC Labs measures end-user IPv6 capability at about 42 to 43 percent worldwide; Google measured 50.10 percent of its own users on IPv6 on 28 March 2026, and the gap is population, not error

That is the Frontiers stage in one place: a migration order that follows from harvest-now-decrypt-later rather than from marketing, device networks where IPv6 arrived without anyone deciding and where zones and conduits replaced a wall chart, an automation stack whose parts each own a class of failure, a transport frontier that is honest about what is standardised and what is still a draft, and a capstone that makes you defend the lot with dates. The frontiers scenario practice now puts that judgement under pressure with situations where the tempting answer is the confident one, so the habits of dating a claim and naming its source get tested before the exam does it for real.

Start the scenario practice

Sources and further reading

  • NIST Post-Quantum Cryptography projectFIPS 203 ML-KEM, FIPS 204 ML-DSA and FIPS 205 SLH-DSA, finalised August 2024, behind the migration order taught in this stage.
  • NIST IR 8547The transition timeline this stage plans against: classical public-key cryptography deprecated after 2030 and disallowed after 2035.
  • draft-ietf-tls-ecdhe-mlkemThe hybrid key exchange behind X25519MLKEM768, and the stage's worked example of a document that ships by default while remaining an Internet-Draft.
  • Cloudflare post-quantum to originThe deployment evidence behind the hybrid handshake share and the mid 2026 arrival of ML-DSA on origin-facing connections.
  • NIST SP 800-82r3The operational technology security engineering reference behind the zones and conduits treatment and the Purdue correction.
  • Connectivity Standards Alliance MatterThe application standard behind the Matter and Thread section, including its use over Wi-Fi, Ethernet and Thread.
  • RFC 6241 NETCONFThe transaction protocol at the base of the model-driven automation stack taught in module 32.
  • OpenConfigThe vendor-neutral model set that gives the automation stack a shared vocabulary across suppliers.
  • Cloudflare Radar adoption and usageThe traffic-share observatory behind the QUIC range, and one of the four sources the measurement-literacy section triangulates.
  • APNIC Labs IPv6 measurementThe end-user capability measurement contrasted with Google's own user population in the measurement-literacy section.
  • NIST RPKI MonitorThe routing-object observatory behind the ROA coverage and stub autonomous system figures used as the fourth triangulation source.