GREG WETMORE at Entrust Cybersecurity Institute argues that it is never too early to start preparing for cyber-security in a world of quantum computers.

We often hear about all the technological advancements that quantum computing will enable, however along with its promise to enable new discoveries, the advancement of quantum brings new security challenges for enterprises.

Quantum computers use the laws of quantum mechanics to process information in quantum bits, or qubits.

Classical computers can only encode information in bits that take the value 1 or 0. Quantum computing, on the other hand, uses quantum bits or qubits – exploiting the unique property of subatomic particles to exist in more than one state, i.e. to be a 1 and a 0 at the same time, called quantum superposition. Another quantum property, entanglement, allows qubits to interact in fundamentally different ways.

These revolutionary properties allow quantum computers to process data and solve some kinds of problems at an exponentially faster rate than classical computers.

Significant investment into quantum computing by both government and industry is driving its advancement. At some point in the future, a scaled quantum computer will have the power and stability needed to break the widely-used public key encryption we use today.

With studies finding that the global cyber-security workforce needs to grow by 65 per cent to effectively prepare and defend against cyber-threats, even without the added impact of quantum, addressing enterprise security is more pressing than ever.

Unprepared for the threat of quantum computing

Bad actors are already storing high-value encrypted data to eventually be accessed by breaking today’s public key cryptographic systems. The traditional encryption algorithms that are part of today’s information technology systems will not be robust enough to withstand attacks from suitable advanced quantum computers, which forecasters predict will be viable in 10-15 years.

Ten years might seem like enough time, but organisational changes in security can take years to implement, and when today’s computers and human power are racing against the power of quantum computers it’s imperative to get a head start.

The transition to post-quantum security is much more complex than previous cryptographic transitions, such as the migration from SHA-1 to SHA-2 which resulted in disruption and proved both costly and time consuming to implement. Post-quantum cryptography consists of measures that can be implemented with the computers of today, but are also impervious to attacks from quantum computers of the future.

The National Institute of Standards and Technology (NIST) is standardising new quantum-safe public key algorithms that have very different performance characteristics to what is in use today.

If your organisation processes or holds data that has value beyond five-ten years or builds connected products that have a lifespan of longer than five-ten years, you need to address post-quantum readiness urgently.

How to approach post-quantum

Physical machines and hardware require more time for updates than cloud-based infrastructure, sometimes needing to be replaced fully. Pre-emptively moving your enterprise security infrastructure to post-quantum ready cryptographic systems will put you in good stead for the updates to come.

This will support your timeline by building maturity into the way cryptographic assets such as certificates, keys, secrets and crypto libraries are managed,

The National Security Agency (NSA) has released guidance on a timeline for addressing quantum-resistant cryptography. It includes parameters around when specific areas and industries should migrate, citing software and firmware signing as the first area to address. The NSA advises that this should begin immediately.

When approaching post-quantum migration within your business, the first step is to carry out an inventory of data to understand where sensitive and long-life data is kept. Once this is understood you can then proceed to assess the security measures currently in place and what’s needed by taking necessary steps such as:

Inventory cryptographic assets: Gain in-depth visibility into what cryptographic assets already exist in your environment

Build a cryptographic agility strategy: Cryptographic agility is the ability to easily move from one algorithm to another, even a quantum-resistant one. This will be critical for the post-quantum transition

Test and plan the migration: Know that what you are trying to achieve is possible and sufficient for post-quantum security

 Help is at hand

The technology behind quantum-safe cryptography is rapidly advancing. Last year the NIST post-quantum competition announced the four algorithms that will be standardised over the next year.

Businesses can turn to their security vendors, many of which are offering early access to quantum-safe crypto in their products, to help establish their post-quantum cryptography plan.

• Wetmore is VP Software Development at Entrust Cybersecurity Institute.