IT leaders in APAC are sounding the alarm about the need to invest now in quantum-safe transition planning; lack of clear ownership, budget or executive support are obstacles in path to preparation. 

NEWS HIGHLIGHTS

• The global study reveals that 61% of those surveyed are concerned that their organisation will not be prepared to address the security implications of PQC. 74% of organisations are concerned that bad actors can conduct “harvest now, decrypt later” attacks now, in which they collect and store encrypted data with the goal of decrypting it in the future.

• It also shows that IT leaders believe that cyberattacks are becoming more sophisticated (60%), targeted (56%) and severe (54%). 

• In APAC specifically, IT leaders also expressed concern about the timeframes in which to prepare. 39% say that their organisations have less than five years to get ready. The biggest challenges are not having enough time, money and expertise to prepare, with almost half of respondents saying that organisations’ leadership is only somewhat aware or not aware about the security implications of quantum computing.

• 53% of APAC respondents currently have a strategy (19% percent) or will have in the next six months (34%) to address the security implications of quantum computing.  

• Many organisations are in the dark about the characteristics and locations of their cryptographic keys. Slightly more than half of respondents globally (52%) say their organisations are currently taking an inventory of types of cryptography keys used and their characteristics. 

Australia—October 19, 2023 – Today, at its annual Trust Summit conference, DigiCert released the results of a global study exploring how organisations are addressing the post-quantum computing threat and preparing for a safe post-quantum computing future. Key findings reveal that while IT leaders are concerned about their ability to prepare in the timeframes needed, they are hampered by obstacles which include lack of clear ownership, budget, and executive support.

Quantum computing harnesses the laws of quantum mechanics to solve problems too complex for classical computers. With quantum computing, however, cracking encryption becomes much easier, which poses an enormous threat to data and user security.

“PQC is a seismic event in cryptography that will require IT leaders to begin preparation now. Forward-thinking organisations that have invested in crypto agility will be better positioned to manage the transition to quantum-safe algorithms when the final standards are released in 2024,” said Amit Sinha, CEO of DigiCert.

“In the APAC region, where digital transformation is rapidly evolving, the need for quantum-safe cryptography is paramount. As industry bodies and governments drive progress, we urge businesses to prioritise their preparations for PQC to safeguard their data and maintain trust in an increasingly interconnected world,” said Armando Dacal, Group Vice President APJ at DigiCert.

Study Highlights

Ponemon Institute surveyed 1,426 IT and IT security practitioners in the United States (605), EMEA (428) and Asia-Pacific (393) who are knowledgeable about their organisations’ approach to post quantum cryptography.

Key findings from the study, sponsored by DigiCert, include:

• 61% of respondents say their organisations are not and will not be prepared to address the security implications of PQC.
• Almost half of respondents (49%) say their organisations’ leadership is only somewhat aware (26%) or not aware (23%) about the security implications of quantum computing.
• Only 30% of respondents say their organisations are allocating budget for PQC readiness.
• 52% of those surveyed say their organisations are currently taking an inventory of the types of cryptography keys used and their characteristics.

Key highlights in APAC include:

• 39% percent of organisations say that their organisations have less than five years to get ready.
• 53% percent of respondents currently have a strategy (19%) or will have in the next six months (34%) to address the security implications of quantum computing.
• 63% of organisations do not have a centralised crypto-management strategy (23%) or they have a very limited one, only applied to certain applications or use cases (37%)

Challenges organisations face to be ready for a safe post quantum computing future

Key findings indicate that security teams must juggle the pressure to keep ahead of cyberattacks targeting their organisations while preparing for a post quantum computing future. Only fifty percent of respondents say their organisations are very effective in mitigating risks, vulnerabilities and attacks across the enterprise. According to the research, ransomware and credential theft are the top two cyberattacks experienced by organisations in this study.

Forty-one percent of respondents say their organisations have less than five years to be ready. The biggest challenges are not having enough time, money and expertise to be successful. Currently, only 30% of respondents say their organisations are allocating budget for PQC readiness.

Many organisations are in the dark about the characteristics and locations of their cryptographic keys. Only slightly more than half of respondents (52%) say their organisations are currently taking an inventory of the types of cryptography keys used and their characteristics. Only 39% of respondents say they are prioritising cryptographic assets and only 36% of respondents are determining if data and cryptographic assets are located on-premises or in the cloud.

Very few organisations have an overall centralised crypto-management strategy applied consistently across the enterprise. 61% of respondents say their organisations only have a limited crypto-management strategy that is applied to certain applications or use cases (36%), or they do not have a centralised crypto-management strategy (25%).

To secure information assets and the IT infrastructure, organisations need to improve their ability to effectively deploy cryptographic solutions and methods. Most respondents say their organisations do not have a high ability to drive enterprise-wide best practices and policies, detect and respond to certificate/key misuse, remediate algorithm remediation or breach and prevent unplanned certificates.

Organisations recognise they are lacking the expertise to stay out in front of post quantum requirements. As a result, hiring and retaining qualified personnel is the most important strategic priority for digital security (55% of respondents). This is followed by achieving crypto-agility (51% of respondents), which is the ability to efficiently update cryptographic algorithms, parameters, processes and technologies to better respond to new protocols, standards and security threats, including those leveraging quantum computing methods.

To be ready for post-quantum computing, organisations need to have a strategy that includes backing by senior leadership, visibility into cryptographic keys and assets, and centralised crypto-management strategies that are applied consistently across the enterprise with accountability and ownership.

Read the Full Report: Preparing for a Safe Post Quantum Computing Future

About DigiCert

DigiCert is a leading global provider of digital trust, enabling individuals and businesses to engage online with the confidence that their footprint in the digital world is secure. DigiCert® ONE, the platform for digital trust, provides organisations with centralised visibility and control over a broad range of public and private trust needs, securing websites, enterprise access and communication, software, identity, content and devices. DigiCert pairs its award-winning software with its industry leadership in standards, support and operations, and is the digital trust provider of choice for leading companies around the world. For more information, visit  www.digicert.com  or follow @digicert.