Why the hidden obstacle to post-quantum security isn't quantum computing

GUEST OPINION: Preparing for the post-quantum era may appear to be primarily a cryptography challenge. As organisations consider the future impact of quantum computing on widely used public-key cryptography, attention is turning to replacing vulnerable algorithms with post-quantum alternatives.

However, the first obstacle is often more fundamental: organisations cannot migrate cryptography they do not know they are using.

Cryptography is deeply embedded across modern technology environments. It can exist in applications, application programming interfaces (APIs), certificates, network appliances, firmware, software libraries, cloud services, identity platforms, internally developed applications, stored data, and third-party products.

Glenn Maiden, Chief Security Officer and Director Threat Intelligence, Australia and New Zealand, Fortinet, said, “Organisations cannot migrate what they cannot find. Most do not have a complete view of where cryptography exists across their environments, yet it can be embedded in everything from applications and certificates to appliances, firmware, cloud services, identity platforms, and third-party products.”

Before organisations can build a credible post-quantum migration strategy, they need visibility across this cryptographic estate. A practical starting point is developing a cryptographic bill of materials (CBOM).