Future proof or history less?
Sep 25th, 2024 by Jesper Kråkhede
Following my post on post-quantum cryptography, a few thoughts for management.
Quantum computers that can break today´s encryption may be ten years away, maybe more, maybe less. Nobody knows. So why should management care now?
Because some of your data has a long life. Contracts, patents, medical records, customer data, state secrets. If it is encrypted with today´s algorithms and recorded by someone today, it may be readable in the future. Will your data still be sensitive in 2035? Then the risk exists today.
Because migrations take time. The last big change in cryptography, from SHA-1 to SHA-2, took many organisations more than a decade. Post-quantum will be bigger, because it touches everything: certificates, VPNs, applications, devices and suppliers.
And because you don´t know where your cryptography is. Most organisations have no inventory of which algorithms they use, where, and who is responsible.
So what should management do? Make someone responsible for cryptography as an asset. Ask for an inventory. Include post-quantum requirements in procurement now, so the systems you buy today don´t become tomorrow´s problem. And plan the migration as a multi year programme, not a project.
Organisations that start now will be future proof. Those that wait will discover that their history was readable all along.