Crypto agility is the ability to easily scale to different encryption methods when necessary to keep data secure. As more and more information moves around between devices, over the internet, and in the cloud, businesses are quickly starting to recognize how important crypto agility is. Add to this the impending arrival of quantum computers and crypto agility has never been so important or top-of-mind. In fact, a NIST report on post-quantum cryptography stated quite clearly that a focus on crypto agility is imperative.
Today, Quantum Xchange is pleased to announce the addition of post-quantum crypto (PQC) to the Phio TX key management system. This announcement is exciting on two levels: First, it introduces the first complete, quantum-safe encryption product on the market supporting both physics and math-based approaches to quantum security. Phio TX can make traditional keys quantum-safe, while also supporting the delivery of quantum keys in any format — Quantum Random Number Generator (QRNG) sources, PQC algorithms, physics-based QKD for maximum security or a combination of both QKD and PQC for even greater security. Secondly, the productization of PQC and Phio TX’s innate scalability makes it truly crypto-agile and a risk-free, sound investment for any organization seeking to easily upgrade defenses as the threat landscape evolves.
We believe crypto agility involves understanding where crypto is being used throughout an organization, knowing how it is being used, and being able to identify and respond to problems quickly. Crypto agility also supports a defense-in-depth strategy — having a back-up plan (or several back-up plans) in case something happens to your encryption. As Digicert points out, “True crypto agility allows you to seamlessly replace outdated crypto as necessary via automation.”
To kick-start your crypto agile plans, consider the following four steps:
1. Establish Crypto Agility.
Develop and communicate clear policies and procedures that govern how your crypto is used. Inventory all crypto assets so you know where they are. Your IT asset managers should know all of the algorithms, crypto libraries and protocols used in their applications and infrastructure. When you have a handle on your crypto assets, you can switch out crypto or replace vulnerable keys as necessary without compromising your security.
2. Develop an incident response plan.
Be prepared when something happens to your crypto. Gartner specifies in its recommendations for achieving crypto agility that this should “include cryptographic alternatives and an algorithm swap-out procedure.”
3. Maintain Crypto Agility.
Once you establish crypto agility, it’s equally important to maintain it by making sure your crypto asset managers are invested in supporting the policies and taking care of their crypto. Automate crypto assets where you can. It’s also critical to work with hardware and software vendors who use the most current cryptography and can upgrade your assets within a reasonable amount of time.
4. Prepare for Crypto Agility in Quantum Environment.
Quantum computers will soon be available on a commercial level. In addition to the amazing power these computers promise for conducting medical research, predicting weather patterns, and the like, they will also be able to break our current encryption methods. The key will be to implement technology that can phase in post-quantum encryption methods as necessary. Quantum Xchange’s Phio (TX) is a perfect example of this type of technology because it works seamlessly with an organization’s existing crypto and network infrastructure, has made PQC a standard feature within the Phio TX appliance, and enables organizations to easily layer in Quantum Key Distribution (QKD) for maximum security when it’s needed.
Crypto agility boils down to 1) knowing what and where all your cryptography is and 2) having a plan in place to respond when something happens to your encryption. The requirement to protect data is only going to increase as more of that data moves around freely; ensuring security of that data will become more far more difficult when quantum computers arrive in the not-too-distant future. That’s why it’s vitally important for businesses to be prepared and become crypto agile now.
Learn more about how Quantum Xchange can help you achieve crypto agility. Contact us.
