Forescout says healthcare OT lags on post-quantum cryptography
Original title: OT systems complicate quantum-resistant data protection
Of more than 2.5 million devices studied, few IoMT and OT systems run PQC-capable SSH, and many exposed medical systems lack TLS 1.3.
Forescout’s report argues that post-quantum migration is harder for healthcare and other OT and IoT estates because embedded devices need vendor firmware updates and recertification. Researchers examined more than 2.5 million devices across more than 50 organizations and warn of harvest-now, decrypt-later risk for long-lived patient data. A Shodan search found more than 5,500 internet-exposed medical information systems, and TLS 1.3 support was limited. The G7 Cybersecurity Working Group has urged organizations to start migrating, with expectations clustering around 2030.
Unconfirmed: Forescout and cited experts project quantum computers might break current algorithms around 2030; that date is an expectation, not a demonstrated capability.
- Electronic medical record platforms were 46% of exposed instances and PACS 40%.
- TLS 1.3 support was 36% of PACS, 33% of EMR systems, and 13% of LIMS.
- Only 11.8% of internet SSH servers were PQC-capable, falling to 3% for Dropbear.
- Inside networks, PQC-capable OpenSSH was 28% of IoT, 16% of OT, and 6% of IoMT devices.
- Vendors
- Forescout
- Organizations
- G7 Cybersecurity Working GroupNIST
From the original article
7 min read at csoonline.com
Quantum-resistant cryptography presents security leaders with various challenges, but CISOs in industries dependent on IoT and operational technology (OT) devices may face a particularly difficult journey to quantum readiness, especially if sensitive information that must remain confidential for years passes through those devices.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.