Carlos Aguilar Melchor, Chief Scientist, Cybersecurity, SandboxAQ
Finding the cryptographic blind spots
Carlos Aguilar Melchor, Chief Scientist, Cybersecurity, SandboxAQ, believes the industry has made considerable progress on the technology itself, particularly following NIST’ s standardisation efforts. Enterprise readiness, however, remains inconsistent.
“ Enterprise readiness, however, is much less consistent. While some forward-thinking organisations are already testing post-quantum cryptography, the vast majority still cannot confidently say where vulnerable encryption sits across their infrastructure. That is at the heart of the problem: you simply cannot migrate what you cannot see.”
as the Middle East simultaneously confronts the potential risks of quantum computing and invests in developing quantum capabilities.
“ Preparedness is uneven, and many enterprises still cannot answer the basic question of where cryptography is embedded across their environment. The Middle East adds urgency because two quantum clocks are running simultaneously. One counts down to the point when quantum machines could break today’ s public key encryption. The other measures how quickly the region is building quantum capability. Saudi Aramco is already using a 200 qubit system for industrial problems, while Abu Dhabi’ s TII is developing sovereign processors and algorithms.”
Hemant Pandya, Solutions Consultant, Trellix
For CISOs, that makes cryptographic inventory a logical starting point. Organisations need visibility across algorithms, certificates, keys, protocols and libraries, but also an understanding of the data those technologies protect and how long that information needs to remain confidential.
Melchor said the objective should extend beyond simply replacing vulnerable algorithms.
“ Ultimately, the goal is not simply to swap one algorithm for another. It is to build true cryptographic agility into the architecture, so the organization can adapt to future threats without facing another costly, disruptive transformation.”
Hemant Pandya, Solutions Consultant, Trellix, also sees preparedness as uneven, particularly
The challenge is particularly important for government, energy, finance and healthcare, where information may remain sensitive for decades. Pandya said CISOs should map cryptographic assets and data lifespans while identifying dependencies spanning PKI, cloud environments, APIs, VPNs, IoT and operational technology.
Dr James A. Grieve, Senior Director of Quantum Communications at the Technology Innovation Institute, similarly believes organisations should already be establishing greater visibility.
“ In terms of preparing for this scenario, organisations should already be well on their way to conducting cryptographic inventory exercises to understand how their data is protected today across their estate.”
26 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST