Quantum computing risks and challenges

One group CISOs should probably assume is preparing for Q-Day: malicious hackers.

"Governments and cybersecurity agencies have warned for years that sophisticated adversaries may be collecting encrypted data today in anticipation of future decryption," said Lina Dabit, executive director of the office of the CISO at cyber advisory firm Optiv Canada, and formerly an inspector in the Royal Canadian Mounted Police's cybercrime team.

The public sector faces particular risk, with significant, ongoing nation-state campaigns targeting critical infrastructure and governmental organizations, Dabit added. Potentially compounding PCQ transition challenges is the fact that critical infrastructure, such as power facilities and water treatment plants, has long struggled with timely patching. That's something governments and the people they serve can ill-afford to overlook as quantum threats evolve.

According to experts, quantum is also particularly challenging for medical facilities and financial institutions, since they manage extremely sensitive data and operate under some of the most stringent regulatory requirements. Dos Santos said medical devices and ATMs are among the most difficult to secure.

As the former CISO and CIO of Silicon Valley Bank, Nick Shevelyov is well aware of the pending PQC threat and its potential impact on the financial sector. But he argued that previous transitions have prepared the industry for the current challenge, citing the industry's migration off the SHA-1 algorithm and the rollout of EMV chips on credit cards.

"Banking has run this play before," said Shevelyov, now founder and CEO at cybersecurity advisory firm vCSO.ai. "The lesson is that a long transition is won or lost on governance, not on technology. Resilience is execution, held together by governance."

The second lesson, he added, is to evaluate and quantify quantum risk much as an underwriter at a bank would: assess the value of the assets at risk, identify annual loss expectancy, and define tolerable and intolerable levels of risk.

"A migration nobody has put a number on is a migration nobody will fund," Shevelyov said.

How CISOs can prepare for Q-Day

While high-risk industries are leading the way in PQC readiness, experts warn that any organization with private or sensitive data must start preparing for Q-Day.

"The first thing you need to do is have visibility into your network to make sure that you know what is or isn't PQC-safe already," dos Santos said.

Security leaders must then get on the same page with their suppliers, he added. A CISO should consider any current equipment purchase, whether it has a five-year depreciation period and whether it will still be active when PQC is mandated. "These conversations need to start happening right now," dos Santos said.

Beyond identifying areas of quantum risk and planning migration, Vedere Labs recommended that organizations begin employing secure remote access to protect every interaction between a user and an unmanaged asset.

Chris Butera, acting executive assistant director for cybersecurity at CISA, said the transition to PQC is a "complex, challenging multiyear process" that requires collaboration with government and industry partners.

"We urge organizations to begin preparing now by creating quantum-readiness roadmaps, conducting inventories, applying risk assessments and analysis, and engaging vendors," he said, adding that it is important to update systems using a risk-based approach to incorporate current and future quantum-resistant encryption and safeguards.

What's ahead

The G7 nations, comprising the U.S. and six of its closest allies, adopted a roadmap targeting 2030 as a cutoff date for migration, anticipating that's when a quantum computer will be able to break encryption -- or be close to it. And while no penalty structure is in place for noncompliance just yet, it's likely to become a requirement for doing business as a vendor in many countries.

In other words, the clock is ticking as a quantum computing reality draws near.

Craig Galbraith is the founder and owner of Galbraith Multimedia, an independent journalism company that provides writing, editing, video hosting, podcasting, onstage presentation and consulting services to the technology industry.