Quantum is coming, and your encryption probably isn’t ready
Lots of interest but not much progress, says Gartner
Although there is “lots of interest” in postquantum cryptography, fewer than half of CISOs have made a start with it – and only 24% of those have made measurable progress.
That was according to Gartner analyst Sarah Almond at Gartner’s Security and Risk Management Summit in London today. She said the scale of the problem can be overwhelming at first – likening the reaction of most IT leaders to the seven stages of grief – but it is manageable.
There are three levels of readiness, but “nobody” is really at the two most advanced: crypto-agility (“You can change to any algorithm at any time in response to any threat”) and full PQC adoption.
The most realistic measure of progress today is simply having a plan on track, though Gartner’s data shows most companies aren’t there yet, either.
“Anyone thinking this isn’t a priority, we won’t be a target of a state actor with a quantum computer – how do you know?” Sarah asked. “How do you know how exposed you are? How long it's going to take you to remediate, and therefore how urgent it is for you to act right now?”
Most people are still at the very early stages. Only 8% of CISOs in Gartner’s survey had a view of their inventory, and only 6% had done a PQC risk assessment.
There are three concepts to “anchor yourself to” as you progress through the postquantum journey.
First is knowing where you stand: understanding the threat, your cryptographic assets and which ones are quantum-vulnerable.
“That's going to tell you everything you need to know about the action you need to take and the urgencies you need,” said Sarah.
The first part of solving the first step is establishing a cryptographic centre of excellence. That “sounds very grand,” but simply means establishing a team of subject matter experts to spearhead your PQC response and track developments in the quantum space. You should also assess both your cryptographic assets and your vendors’ PQC readiness, and may need to be prepared to change vendors if their roadmap doesn’t match your own.
Most organisations lack both the time and the tools to solve this quickly: the clients Sarah has spoken to have taken “months, if not years” to build visibility of assets. Rather than doing an exhaustive search (and finding a sea of red), she recommended focusing discovery on your most critical apps and exposed locations.
That brings us to tooling. You may find you already have some of the tools you need to assess PQC readiness: network security appliances, enterprise lifecycle management and certification lifecycle management, for example. Your choices here are to look at your existing tools and handle it all yourself (“a good starting point”) or invest in a new class of tools known as cryptographic posture management, which “mature or more complex organisations” are already doing.
Second is mapping it out, where you start to make decisions. This is where the stages of grief – especially depression, manifesting as paralysis – can really bite. To avoid this, break the journey down into incremental steps:
- Set policy. Either everyone pulls in their own direction or you standardise it. Recommendations already exist to help; for example, NIST has recommended dates for deprecating old algorithms.
- Define priorities. This will heavily depend on your organisation: some will prioritise systems, some will focus on sensitive data, etc. Some will prioritise based on complexity, or algorithm weakness. This will be personal to your organisation.
- Build roadmaps based on visibility, vendor readiness, policy and priorities. Again, you may need to evaluate other vendors.
- Define crypto-agility. Which of your systems will be hard to upgrade to PQC? Where will you have algorithms that will be hard to change? These are the gaps you need to be assessing now.
- Start testing. “Many of us learn through doing, so don't be afraid to pick some pilot implementations and try migration.” This can be a great way to prepare for an upgrade at scale.
Finally, Sarah stressed that “perfect does not exist,” so don’t wait for it – start moving on PQC now, not two years after identifying the threat. She didn’t name and shame, but did say she knows an organisation doing just that.
Third and finally, look to the horizon. This is where you begin to execute on the previous steps, but it’s not just about having a plan that is progressing: it’s about progressing on track. This is your time to evaluate if the plan is working, what you have learned, and – the big one – whether you are actually materially reducing risk as you go.
If you have yet to start your PQC planning, the first step should be gathering your SMEs and establishing a centre of excellence, setting a single achievable goal to start progress. In the 90 days after that, start evaluating and using tools to develop your cryptographic visibility, update policies and assess critical vendors.
Finally, over the next 12 months, aim to complete a pilot PQC migration and define an agile architecture strategy, plus an associated delivery plan.
“PQC is a huge opportunity for transformation, to be more seamless, more automated,” said Sarah.
“Please embrace it and think about it strategically, rather than just as a point in time uplift.”
Gartner's findings agree strongly with Computing's own research among UK IT leaders, which revealed a low level of preparedness about the quantum computing threat, with cost and budget, competing priorities and uncertainty about timelines cited as the main barriers to action.