In Part 1, I wrote that when an organization cannot see its cryptography, the i 2026-11-5 12:17:0 Author: www.guidepointsecurity.com(查看原文) 阅读量:17 收藏
In Part 1, I wrote that when an organization cannot see its cryptography, the inventory gap is not a footnote – it is the program. GAO’s report, Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, puts numbers behind that point: only one of 24 agencies fully addressed the prioritized-inventory activities, 18 reported lacking cryptography expertise with no plan to close the gap, 23 had no documented inventory maintenance process, none fully addressed funding and none had tested PQC in their environment.
These are not simply compliance findings. They are indicators of execution risk. If I cannot see quantum-vulnerable cryptography, I cannot prioritize it; if I cannot prioritize it, I cannot budget it; if I have not tested the replacement, I do not know what will break.
The part of the report I keep rereading is not the scorecard. It is the explanations agencies gave, in good faith, for why each practice could wait a little longer: too early for automated tools or waiting on the Cybersecurity and Infrastructure Security Agency (CISA) to name them (CISA says it never asked anyone to wait); too early to test (open-source PQC tooling has existed for years); too early to document funding without vendor pricing – which is how the Government arrived at an approximate $7.1 billion estimate OMB itself calls a rough order of magnitude.
None of these reasons is unreasonable on its own. Together they form a dependency chain: no automation, so no inventory; no inventory, so no funding estimate; no testing, so no idea what breaks. Every year spent waiting for a better tool or a vendor quote is a year subtracted from the migration clock – the one clock agencies actually control.
The concept is captured well by what is often called Mosca’s inequality, from Michele Mosca’s 2015 paper:
One department told GAO its unclassified environment supports more than four million endpoints – and it had no plan yet for inventorying the cryptography inside them. M-26-15 calls manual approaches “often insufficient” and directs automated discovery into a central Cryptographic Bill of Materials (CBOM); EO 14412 gives CISA and the National Institute of Standards and Technology (NIST) 270 days to publish minimum CBOM elements. Build toward that format now; do not wait for it.
PQC may be the best test of that idea in years. There are two ways to fail. Move too slowly and information protected today may eventually become readable by an adversary. Move without discovery, engineering and testing and we disrupt the mission ourselves. That is why the answer cannot be “move everything immediately.” And it cannot be “we have until 2030.”
For long-lived sensitive data in transit today, the exposure window may already be open. By 2030, agencies should be measuring what they migrated – not discovering where their vulnerable cryptography lives.
Timothy Amerson is currently the Federal Chief Information Security Officer (CISO) at GuidePoint Security. While also serving as the the President of the Board of Directors for The KEY (Keep Elevating Yourself) Community Non-Profit. He brings more than 30+ years of distinguished service in federal cybersecurity leadership. Most recently, he served as the CISO and Associate Commissioner at the Social Security Administration (SSA), where he was recognized as a 2023, 2024 and 2025 Top 100 Information Security Professional; 2024 FedScoop Top 50 Federal Leader Nominee; 2025 CyberScoop Government Leaders, FedScoop Top 50 Federal Leader Nominee and Finalist US Forces in Business Lifetime Achievement Award.
如有侵权请联系:admin#unsafe.sh