Getting ready for the post-quantum cryptography transition - how is it going?

Late last year, the ACSC recommended organisations should have a post-quantum cryptography migration plan by the end of 2026. Cyber security professionals have known since the 1990s that, in theory, a quantum computer could cause them some serious headaches, but now is the time to start taking action. With three quarters of the year gone by conference day, this talk will examine progress to date in meeting the ACSC’s recommended milestone, where the blockers are and what we should be doing about them.

This talk is aimed at business leaders, CISOs and security practitioners to help them navigate this transition. It will examine the three main stages that organisations need to step through:

• Education and awareness:​myths are still very prevalent – some people still think all cryptography is at risk, or that we still don’t really know what to do to respond. We can ignore those peddling fear stories of imminent doom, but also those who say it will never happen. We will review progress towards a cryptographically relevant quantum computer, and what it will and won’t be capable of; in particular looking at announcements from Google and others this year and what they mean.
• Understanding where the risks are:​all organisations should be preparing an inventory of their cryptography, but what are the challenges in doing so, and how do you even get started? We will look at practical experiences from our discussions across the industry and discuss some of the tools and methods that can help with this process.
• Prioritising and planning mitigations:​There will be no such thing as Q-Day when everything gets attacked at once. This, therefore, is where some of the biggest mistakes can be made. Organisations need to assess the spectrum of risks, compare this to the difficulty of upgrading or replacing systems, and prioritise their work accordingly. We will look at some of the common trade-offs and experiences to date.

At the end of this talk, you will know what the real threats are, what solutions you should be considering (and which to ignore) and know how to get started with practical tips and ideas to apply as soon as you get back to the office.