That “future” is now getting closer as there is an urgent need for organizations and governments to begin transitioning to post-quantum cryptography (PQC) to protect sensitive data and critical assets from emerging quantum computing threats, according to a new report from the the Cybersecurity and Infrastructure Security Agency (CISA) and Group of Seven (G7) Cyber Security Working Group.
Unlike traditional computers that process data in binary digits or “bits” which have only one of two possible values, quantum computers use quantum bits or “qubits” which can exist in a combination of both values at the same time, making it possible for quantum computers to problem-solve faster than traditional computers.
As quantum computing advances, these computers will be able to break public-key cryptography widely used to protect sensitive data and communications.
Malicious threat actors are already intercepting and storing public-key encrypted data today in “harvest now, decrypt later” strategies.
Once cryptographically relevant quantum computers (CRQCs) are available to malicious cyber threat actors, they will be able to target organizations still using public-key encryption with the potential to impersonate trusted entities, compromise equipment, and access confidential data.
Prioritize PQC Migration
The security agencies’ call to action urge organizations not to wait for CRQCs to become available, but to prioritize PQC migration and begin identifying critical assets, mapping dependencies, and developing phased transition plans aligned with their national cybersecurity authorities.
To mitigate risks, governments and organizations should first identify systems that hold the most critical data and assets and prioritize PQC transition efforts accordingly. Acting proactively, rather than waiting for confirmed CRQC availability, is important to managing quantum risk.
As proposed in the G7 Cybersecurity Working Group, organizations should:
- Adopt a phased and risk-based strategy
- Start their PQC transition early
- Inventory their cryptographic assets
- Map their dependencies
- Develop a transition plan
To limit transition-related costs, they should opt to purchase products that integrate PQC and replace their systems with quantum-safe ones as part of their standard renewal schedule. As such, starting the transition early could result in lower migration costs overall. Planning and conducting their PQC transition properly would enable organizations to prevent insecure implementations and avoid increased exposure to conventional cyber threats.
Click here to download the call to action to learn more about PCQ migration and the five priority areas to consider when planning.