Today's Edition
ABU DHABI (ALETIHAD)
Nearly two-thirds of organisations surveyed in selected GCC markets have allocated budgets to protect their data and systems from the potential ability of future quantum computers to break some of the encryption methods used today, according to a report released on Tuesday.
The concern is not that quantum computers can currently unlock such information. The report warns that attackers could collect encrypted data now, retain it and attempt to decrypt it later when sufficiently powerful quantum computers become available.
This threat, known as “harvest now, decrypt later”, is particularly relevant to sensitive information that must remain confidential for many years. It applies to public-key cryptography used to protect encryption keys and, in some instances, the information itself, the report said.
The State of Post-Quantum Readiness in Key GCC Markets was published by QuantumGate and the UAE Cyber Security Council, with support from the National Cryptography Center and the Technology Innovation Institute.
According to the findings, 64% of surveyed organisations have budgeted for a post-quantum initiative, while 84% are planning a transition to encryption designed to withstand future quantum-computing threats.
Awareness of the risk was high, with 97% of respondents recognising the “harvest now, decrypt later” threat. About 58% believed that a quantum computer capable of breaking today’s public-key cryptography could emerge within five years.
Dr Mohamed Al Kuwaiti, Head of Cyber Security for the UAE Government and Chairman of the UAE Cyber Security Council, said quantum-safe cryptography should become part of the country’s cybersecurity framework as digital services, critical infrastructure and data become increasingly connected.
“Our focus is on giving organisations a clear framework to assess their cryptographic environment, plan early and move forward in a coordinated way,” he said.
The report said an important first step was for organisations to identify the encryption technology already used across their systems. This process, known as cryptographic discovery, creates an inventory of keys, certificates, algorithms and protocols, as well as the systems and information they protect.
Such an inventory can help an organisation identify cryptography that may be vulnerable to quantum computers and decide which systems and data should be migrated first.
Only 35% of surveyed organisations had started this discovery process, although 66% said they had visibility into the cryptography they used. A further 54% planned to begin the process.
Dr Najwa Aaraj, Chief Executive Officer of QuantumGate and the Technology Innovation Institute, said organisations were committing funding and beginning to plan for the transition.
“The next step is to translate that intent into an executable programme. That starts with knowing where cryptography sits, what it protects and where the greatest exposure lies,” she said.
About 42% of respondents were working to a defined transition roadmap, while another 42% were developing one. However, only 34% considered their organisations well or very well prepared to carry out the transition.
The selection of technology providers also remained at an early stage. Around 58% of organisations were evaluating multiple providers, 35% had yet to identify one and 6% had selected a preferred partner.
The report found that 98% of respondents required cryptographic solutions to be nationally governed, locally controlled or both.
It recommended that organisations begin by compiling a cryptographic inventory, prioritise information that must remain confidential for the longest period and assign clear responsibility for the transition. Systems should also be designed so that encryption algorithms can be changed without having to rebuild the underlying technology, the report said.
