How CISOs are readying the enterprise for post-quantum cryptography

The work CISOs are doing to prep for the arrival of quantum computing echoes the race to update computers for Y2K — with one significant difference. They may need to prove, in the here and now, that they will be ready for the expected sea change in cybersecurity.

The chief concern is quantum’s potential threat to traditional cybersecurity, which theoretically could be easily cracked by such systems. Quantum computers are built with qubits rather than traditional bits, enabling them to process complex calculations differently from classic computers. Rather than being just a matter of faster compute speed, quantum computers are expected to handle complicated processes in ways old school computers do not operate — and that can make them dangerous to traditional cryptography. The breadth of the stakes has drawn the attention of stakeholders, including engineers, attorneys and C-suite leaders, concerned about protecting data from aggressors who also want to leverage the technology.

Leslie Nielsen, executive vice president and CISO at Mimecast, said warnings about the impact of quantum computing began years ago. Its eventual arrival is expected to upend security norms and usher in post-quantum cryptography (PQC).

Shor’s algorithm, developed in 1994 by Peter Shor, demonstrated that quantum computers could break widely used encryption methods, accelerating the urgency around quantum readiness, Nielsen said.

The target year recommended by most companies and regulatory bodies to demonstrate PQC readiness is 2030, if not sooner, Nielsen said. “You need to be on higher encryption standards, bigger key sizes,” he said.

He speculated that companies might be required by regulators to embrace quantum compute by 2028 to protect their IT environments and data.

Facing such urgency, Nielsen said he has discussed with his team acquiring a hardware accelerator for quantum cryptography to protect against potential bad actors who might eventually put the technology to nefarious use. A quantum cryptography strategy would focus on more than just in-house IT environments; it would also seek to protect external data before it enters the environment.

“Data in transit is what people worry about a little bit more because it’s possible for it to be scooped up without having to get into somebody’s system,” Nielsen said.

Stakeholders seek quantum assurances

“The urgency in adopting post-quantum cryptography is immediate because the damage is taking place now and has been taking place for some time,” said Paul Stimers, partner and federal government affairs practice leader at law firm Holland & Knight.

Questions and concerns about the quantum future have reached beyond IT teams. Stimers said enterprises are starting to use current quantum compute resources to perform functions faster than classical computers.

“We’ve reached what is being called quantum advantage, where quantum is better if not exclusively able to do something,” said Stimers, who also serves as the executive director of the Quantum Industry Coalition.

He added that public- and private-sector organizations are starting to recognize these capabilities and want to be early adopters of the tech for other tasks, such as logistics optimization and modeling. While IT teams might not be under mandates to act, there is interest in seeing that quantum compute plans are laid out.

“I think they’re being responsive to their stakeholders, their boards,” he said.

Those stakeholders might be concerned about already-compromised data not yet cracked by hackers. There is a presumption that quantum computers could be used to decrypt such stolen data once the technology is fully viable.

Quantum computers could, in a sense, “dump water” on current cryptography and wash away certain security functions, Stimers said. “What we need is a new kind of cybersecurity, a new math,” he said.

Regulatory bodies are taking action. Stimers pointed to the National Institute of Standards and Technology, which has approved a handful of algorithms that rely on a kind of math that is as hard for quantum computers to unscramble, as it is for classical computers. “Collectively, those algorithms are what count as post-quantum cryptography right now,” he said.

For any holdouts, Stimers warned that developing PQC resources is akin to upgrading computers for Y2K, which might have wreaked havoc on computer systems if the calendar defect had not been fixed. “We have to get it done,” he said.

Updating compute toolboxes

There might come a time when organizations will have to show they have at least started the work to become quantum-ready. Robert Bartlett, engineering manager at Everpure, is bracing for the potential need for attestations to prove the software development lifecycle is secure in the post-quantum future.

He said there is a responsibility to ensure that development processes have security baked in and transparency. “Are we making sure that we have checks and balances as we build our products, such that we can maintain customer trust as we move forward?” he said.

Bartlett said Everpure, a data storage and software provider formerly named Pure Storage, has had PQC planning in place for more than two years. “We have a program, we have a roadmap, and we’re going through that … taking the pickaxe and chipping away at it,” he said. The goal is to create a strong PQC narrative across the company’s product portfolio, Bartlett said. “Trying to as much as possible to shift left on that, just so that we help future-proof ourselves,” he said.

The move to quantum computing can seem daunting, Bartlett said, but he regards this as the next evolutionary move in the cryptography cycle. “It’s a scary step because it’s upturning 30, 40 years of relative firmness and assuredness and confidence in what’s existed,” he said.

Creating checklists for resilience

Taking inventory of cryptography resources, meaning the algorithms used by an organization, can be a vital part of developing quantum readiness — and readiness, in general, as technology is never static, said John Bruggeman, consulting CISO at IT services and consulting firm CBTS. “Do you, God forbid, still use TLS 1.0 for any communications between a client and a server? Have you secured a transport layer?” he asked, referring to an obsolete encryption protocol.

He said free tools exist that companies can use to evaluate their own network traffic and better identify where upgrades could be made for quantum-ready encryption algorithms. “The quantum space is moving quickly … and if I’ve done nothing at this point in time, I better put something into my budget for 2027, 2028 and 2029,” Bruggeman said.

The process could take up to one year, with six to eight months spent inventorying the IT environment, he said, depending on the scale. “If it’s a smaller environment, it’s going to be a one-month inventory,” Bruggeman said.

Regulators may plan to require proof of quantum readiness in the coming years, he said. That raises questions of how quickly enterprises might need to provide proof of quantum readiness. Bruggeman said and insurance companies may introduce their own requirements to begin implementing such measures. “Whether or not a quantum computer comes [soon], you’re going to have to start making sure that you can get the insurance that you need,” he said, which will mean having tooling and controls in place to adapt.