Encryption & Key Management
,
Security Operations
Forrester’s Sandy Carielli on Quantum Readiness, Key Steps for Successful Migration
Q-day is coming, even if we don’t know when quantum computers will break the algorithms underpinning today’s cryptography, and tech leaders are starting to prepare. Quantum security migrations are multi-year, cross-functional projects that touch product, infrastructure and supply chains.
See Also: Securing Patient Data: Shared Responsibility in Action
While the scope of migration to post quantum cryptography can be daunting, CIOs can follow several practical steps to make the project more manageable, said Forrester vice president and principal analyst Sandy Carielli.
“There’s a process here that’s going to need to be addressed in order to get to where the organization needs to be,” she said. “Discover, prioritize, remediate and add cryptographic agility.”
One of the biggest misconceptions she sees from CIOs is on what being ready for quantum-resistant security means. “Sometimes people have the misconception that you need a quantum computer for quantum security,” Carielli said. “You don’t need quantum computers. And, in fact, you’re not going to. You’re doing this to be protected.”
The urgency of these migrations is being driven by two things, she said, both of which should be communicated to the board and stakeholders: regulatory pressures and the rapid pace of technological advancement.
Standards bodies and government guidance have already laid out the planning horizon for organizations, including government and critical infrastructure. NIST’s post-quantum transition guidance sets a deadline: Quantum-vulnerable public-key cryptography must be deprecated by 2030 and disallowed by 2035. CISA urges organizations to begin now because the scope and complexity of the transition will take years and incorporate governance, budgeting and vendor management.
“You need to start now, and probably you need to have started a few years ago, because it is such a long journey,” Carielli said.
The initial discovery phase should include a full cryptographic inventory across applications, data, identities, networks, IoT devices, cloud and code. It can also expose areas in which tech debt creates vulnerabilities.
While smaller organizations may be able to manage inventory in spreadsheets, CIOs at larger ones should consider hiring vendors to manage discovery. Larger organizations should also consider leveraging tools for continuous discovery and policy maintenance.
But some technologies will be easier to inventory than others. Cloud providers are often public about their migration plans and will ease the burden of work for the customers, Carielli said. Homegrown technologies, or those built in house that may have old software libraries, are potential areas of risk. So are IoT devices running firmware that may not have been updated, as well as data center hardware.
One “easy win” first step, Carielli said, is bringing procurement to the table early and updating RFP and SLA language to ensure that third-party products brought into the ecosystem are not introducing risk. For existing vendors, teams should question their migration plans and timelines.
Organizations should prioritize data that has long-term value, that could still be valuable in 10 to 15 years like health or banking data and they should assume that data stolen today will be decrypted in the future: “Harvest now, decrypt later.”
Digital signatures should be high priority. Once algorithms validating digital signatures are broken, assurance that contracts or other documents are uncorrupted is gone. “If I’m a CIO, if we’re digitally signing contracts, I’m very concerned about that,” Carielli said.
Remediation then involves making changes in bite-size chunks, working with procurement and finance on managing refresh cycles, potentially delaying upgrades until hardware is quantum-ready and enforcing vendor timelines.
Designing for crypto agility is the final step in the process, and organizations should strive to create systems so that algorithm changes necessitate configuration changes, not re-architecting. “Good for crypto agility means that the next time an algorithm is broken, we are able to adapt to that by changing a configuration. We’re able to adapt in a matter of weeks, rather than a matter of years,” Carielli said.
The regulatory impact should make quantum migration an easier sell than it would have been even a few years ago, as deadlines loom in the United States, Australia, EU and Asia countries. “Regardless of when a quantum computer is going to be able to break today’s cryptography, we are being asked to migrate by the organizations and the countries that we want to do business with,” Carielli said.
This isn’t the only strategic imperative on CIOs’ plate. They’re also under pressure to invest in AI, digital initiatives and legacy modernization. But quantum should also be a high priority, she said.
“The road map matters,” Carielli said. “You need to protect your customers. You need to protect your employees. There’s a lot of data out there that you don’t want to get out. Everything today has probably left the barn, but you can still protect going forward.”