We know a post-quantum world is likely coming. What we don’t know is when. Organizations should begin preparing now for the day quantum computers become commercially available to help evolve security needs for their critical IT assets.
No one knows for certain when the first cryptographically relevant quantum computers (CRQC) will go online, but organizations shouldn’t wait until after the fact to prepare for post-quantum cryptography (PQC).
The time to think about planning the transition to PQC-ready security is now. Organizations should understand what their exposure to risk will be, the types of threats PQC can create, and how to align their infrastructure investments to meet NIST recommendations and future security requirements.
Understanding PQC
PQC refers to the development of cryptographic algorithms designed to offer security against the future threat of quantum computing.
It is only a matter of time until CRQCs are developed and then the question becomes how long until they are commercially viable and available to threat actors.
The uncertainty around when Q-Day—the moment when CRQCs can run the algorithms to crack encryption—will arrive is why organizations should be preparing for it now.
Government entities like NIST have already released PQC standards and, earlier this year, the White House issued an executive order to push an accelerated PQC transition. With these guidelines, organizations have a foundation to progress toward PQC readiness.
Challenges facing the PQC future
The PQC shift isn’t only about adopting emerging technology, but about fundamentally new approaches to how organizations secure their systems. Challenges in preparing for PQC readiness include the following:
- Attackers may already be collecting encrypted data now for future PQC capabilities. Threat actors know that Q-Day is coming, so there is concern that they are taking a “harvest now, decrypt later” (HNDL) approach. The risk is that a vast quantity of files of encrypted sensitive information gathered in past data breaches can be a future liability. As cryptography is embedded broadly across an organization’s infrastructure—from applications and APIs to identities and certificates—it is difficult to know what has already been exposed, what might be at risk during migration, and what has to be protected for PQC.
- A bigger and slower migration than organizations anticipate. Becoming PQC-ready means a comprehensive transition across the entire infrastructure. Hardware, software, firmware, platforms, and supply chains that might need to be migrated to PQC. It’s a process that could take several years.
- Uncertainty about what PQC readiness entails. There is no one-size-fits-all solution to PQC readiness. NIST offers standards to follow to get started, but there are no consistent guidelines on what to expect from vendors and how third-party software and platforms will meet PQC readiness, so enterprises are responsible for their own due diligence.
Recognizing steps towards PQC readiness
Organizations with mature cybersecurity systems may already be on the path to PQC readiness.
According to Mike Spanbauer, Field CTO, Security with HPE, conducting an assessment or inventory of the entire environment to know which assets (e.g. data, apps, etc.) are high value, where they are located, and how they are secured is step one to becoming PQC ready.
Documenting currently deployed security across the infrastructure jumpstarts PQC readiness because it offers a benchmark for what needs to be changed, how long the migration could take, and where the biggest vulnerabilities for long-term risk are. Similarly, understanding how cryptography works inside the environment now will offer visibility on what applications and data sets are most at risk when Q-Day arrives.
Phasing in PQC plans
Like most digital transformations, PQC readiness isn’t a single-step process. It should be thoughtfully phased with ongoing business operations in mind. Steps include:
- Establish a PQC strategy that spans the entire infrastructure, supply chain, lifecycle management, and governance systems. Cryptographic agility is the goal, so that accommodation or adjustments can be made more easily.
- Consider the lifespan of data and determine whether it can be shortened.
- Hypothesize what threat actors may have already harvested and the risks if that harvested data is decrypted.
- Determine new hardware that will be required as early as possible so costs can be factored into budget considerations.
- Launch a PQC-readiness assessment process.
- Expand PQC support across platforms.
Conclusion
PQC may be among the most significant security requirements that organizations will face. It requires comprehensively moving cryptographic and encryption mechanisms within the entire organization to a PQC-ready capability.
“Being able to apply the robust mechanisms proposed for post-quantum-readiness can help organizations reduce Q-Day impacts,” Spanbauer says.
