Cryptography is crucial for protecting data and ensuring the confidentiality and integrity of information. It is everywhere. It can be on a system, in a network, in a device, etc. Quantum technologies are advancing, and global mandates are pushing the migration to post-quantum cryptography (PQC). However, the problem is that many organizations don’t know where this cryptography exists in their systems, how to use it, or if it adheres to security requirements. Before new algorithms can be implemented or systems can be updated, organizations need to understand what they already have before it is too late.
First Step in Post-Quantum Cryptography: Cryptographic Discovery
The first step of post-quantum cryptography migration is cryptographic discovery. Cryptographic discovery provides visibility into knowing which cryptography is in use and what data is protected. Discovery focuses on the initial identification of cryptographic assets across an organization’s infrastructure.
What is a Cryptographic Inventory?
A cryptographic inventory is the managed and updated catalog of all cryptographic assets in an environment. In other words, a structured overview of what exists in an organization’s system, and how it is used. Visibility and awareness alone aren’t enough. Inventory is also maintaining and monitoring a record of these assets to ensure compliance and future cryptographic needs over time.
An inventory typically includes:
- Endpoints
- Logs
- Algorithm usage (e.g., RSA, AES, SHA‑1) across all layers of the stack
- Key and certificate types, locations, and expiration timelines
- Protocol configurations and supported cipher suites
- Cryptographic libraries and their associated software versions
- Device- or hardware-specific cryptographic functions (e.g., TPMs, HSMs, firmware encryption)
Why is a Cryptographic Inventory Important?
Without a cryptographic inventory, you are unaware of hidden vulnerabilities and compliance gaps. Outdated algorithms, protocols, and libraries pose an increasing risk to security and operational measures. Cryptographic inventory is also the first step in implementing crypto-agility. Crypto agility is important in defending against SNDL attacks. Monitoring the lifecycle of these assets allows organizations to gain control, ensure integrity, and manage weaknesses that bad actors can otherwise capitalize on. You can’t protect what you can’t see, and you can’t migrate what you can’t inventory and govern. Overall, maintaining a cryptographic inventory provides the necessary visibility and management of current risks with the preparation to defend future quantum threats.
Who Should Manage a Cryptographic Inventory?
Managing a cryptographic inventory can be done by the CISO, CIO, security architects, or other collaborative efforts. However, as an important part of the cryptographic architecture, infrastructure, and security, there must be clear accountability. According to the ISACA Pulse of Quantum Computing poll, only 5% of technology and cybersecurity professionals consider post-quantum cryptography as a “high priority” in the near term.
Especially with the advancements of quantum computing and government timelines, many enterprises are unprepared. Therefore, it is less important who manages the inventory, but that someone manages it and can respond to system-level questions:
- What algorithms are in use?
- What assets are exposed to the quantum threat?
- Where are the assets located?
- How much infrastructure and data is outside direct control?
Where to Start Cryptographic Discovery/How to Conduct a Cryptographic Inventory?
To start, organizations need to identify their High Value Assets (HVAs) or systems and critical information that carry the most sensitive data and risk. QuProtect Recon creates a browsable and centralized inventory of cryptographic assets throughout your network. It can automatically scan your environment to find unknown cryptographic assets across your network. Additionally, real-time updates are provided to maintain accuracy as conditions change within environments. The solution aligns to CNSA 2.0, NIST PQC, IL5+/FedRAMP, and CMMC 2.0. With QuSecure, organizations don’t need all their discovery and inventory done before migration.
