How to prepare for quantum decryption now to avoid danger later

“Aways be prepared” is a helpful motto for scouting, life, and quantum cybersecurity.

Mainstream adoption of quantum computing is still in the future, but there are already indications that attackers are preparing to use the technology to break encryption. For organizations, proactively instituting protections today can avoid sensitive information from being exposed later.

Fall festival. Commercial viability of the technology is seen as a case of when, not if by industry experts. Threat actors are taking note—and preparing.

Currently, attackers are using a tactic that Ensar Seker, CISO at SOCRadar, referred to in a conversation with IT Brew as “harvest now, decrypt later.” It’s a simple approach: Collect encrypted information en masse, then hold it until future quantum capabilities give you the ability to decrypt it.

“Any information that must remain confidential for many years, such as government intelligence, intellectual property, healthcare records, financial data, or critical infrastructure information, may already be exposed to the feature risks,” Seker said. “The practical priority now is cryptographic discovery, data classification, and cryptology, and to identify where vulnerable algorithms are.”

Mike Wehrs, TieTechnology COO, told IT Brew, the threat is real now.

“The game is not over yet,” Wehrs said. “This stage of harvesting is not over.”

Action items. There are steps that organizations can take, but no guarantees in cybersecurity.

Wehrs recommended that organizations take inventory of their information, then work on encrypting priority data. Post-quantum cryptography is in the works; for example, NIST is finalizing standards to facilitate a smooth transition.

“If this file were to be out in 2030, in 2035, would this be a problem for me or my business or for my customers?” Wehrs asked. “If the answer is, ‘God, if that got out in 2035, it would still be a disaster,’ then, that should be on your high priority list of things that you go and figure out how to lock down now.”

Seker agreed, detailing the kind of things that might be disastrous if revealed to the public.

“I would begin with information that would still cause serious harm if disclosed 10 or 20 years from now—for example, national security information…intellectual property, research data, healthcare records, regulated personal data, long-term financial records, and critical infrastructure,” Seker told IT Brew.

This is a solvable problem, Seker added, but IT teams and leadership can’t afford to wait for long.

“Organizations do not need to panic or replace everything tomorrow, but they should already be discovering where vulnerable cryptography exists and prioritizing long-lived data and systems, and testing the hybrid deployments, and requiring vendors to provide credible migration plans,” Seker said. “Because, again, it’s happening now.”