Abu Dhabi advances Government-wide post-quantum encryption

Abu Dhabi is advancing towards the implementation of post-quantum encryption across its government systems, signaling a proactive approach to security in the quantum era. H.E. Najyb Al Maskari, Executive Director of the Government Cybersecurity Operations Sector, highlighted investments by the UAE Cybersecurity Council and the Technology Innovation Institute (TII) into locally designed encryption protocols aimed at enhancing agility.

These protocols are intended to secure data exchanges between various departments, such as finance and health, as well as interactions with citizens through services like TAMM.

Dr Victor Mateu, chief researcher at TII’s Cryptography Research Centre, noted the emergence of cryptographic inventories as a pivotal step for organizations to migrate to more secure systems. These inventories help organizations identify existing cryptographic systems, many of which may be deprecated and unknown to IT teams. Dr Mateu emphasized that visibility into these systems is crucial, as the first practical challenge for organizations is overcoming a lack of awareness.

Assigning clear responsibilities for migration is the second challenge, with Dr Mateu pointing out that introducing new personnel midway can cause delays. Pradeep Menon, Chief AI and Security Officer at Paramount Assure, observed that while some advanced organizations have begun formal assessments, most enterprises are still in the discovery phase of migration.

Vendor dependency is the third challenge, as much of the cryptographic technology in use is sourced from external vendors whose priorities may not align with the organization’s needs. The UAE currently relies heavily on imported cryptographic solutions, which could be advantageous as cloud providers like AWS and Microsoft invest in post-quantum technology, providing migration timelines that aid in planning transitions.

Despite the progress, Dr Mateu cautioned that no formal migration timelines have been published by cloud providers, and these timelines may change. The shift towards post-quantum encryption presents an opportunity for the UAE to develop sovereign technologies that can be audited and modified according to national requirements, ensuring better control over cryptographic standards.

Menon noted that this challenge is not unique to the UAE, with many international organizations, including those in the GCC, beginning to acknowledge the quantum threat and the importance of crypto-agility and long-term resilience.