From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Quantum

Brianna Monsanto

itbrew.com

If former CISA Assistant Executive Director for Cybersecurity Jeff Greene had to express his thoughts on the agency today in one word, it would be “concerned.”

That’s because of the growing exodus of young talent from the cybersecurity agency, which is responsible for securing IT across the federal government, Greene said during an Oct. 8 webinar on global cyber resilience hosted by Travelers Institute, the education and public policy division of insurance company Travelers.

“What worries me is that Nick [Andersen] and Sean [Plankey] don’t have the tools that I had because a lot of young talent has left, and more folks are leaving,” Greene said, referring to two agency leaders, when asked about his thoughts on CISA amidst 

 a fiscal 2026 funding bill that would cut CISA’s budget by $135 million.

Greene, who departed CISA in January, said he is confident in CISA’s current leadership team and the work being done at the agency, but worries about the downstream impact of talent cuts and the resulting burnout among those remaining. In June, a spokesperson from the agency 

 that it had lost 1,000 employees this year under the current administration.

“People are really tired and they need some relief, because you can’t go at the pace that they’ve been going at,” Greene, who is now a distinguished fellow at the Aspen Institute and founder of his own consulting firm, said. “And I don’t know that we’ll ever be able to track a specific incident to a cut here or a cut there, but it’ll happen.”

During the webinar, Greene extended several tips to businesses on how they can up their cybersecurity stature. He recommended employee 

, while shutting down naysayers in the industry who question the effectiveness of it: “If we can string together a variety of different tools that can educate 10%, 15% of people at the time, then we’re going to put some security [in place].”

Greene also stressed the importance of not only having an 

 (IR) plan, but also engaging in exercises to simulate an attack. He recalled a recent incident with a consulting client who received an email from a bad actor claiming to have stolen their data; in that instance, some practice would have been handy.

“They had an IR plan, but their first few minutes of panic were so intense that they didn’t pull it out…Knowing what to do, having a little bit of muscle memory is essential,” he said, adding things flowed “more smoothly” once the company followed the plan.

For businesses seeking to protect themselves from 

 and similar threats, Greene advised to stay up-to-date on attackers’ latest tactics and to be cautious of dream applicants.

“The old cliché is, if it sounds too good to be true, it probably is,” Greene said. “If someone who perfectly suits your needs pops up and is willing to work for below market value, it might not be the bargain you think it is.”

When asked about the emerging threats that will test the resilience of businesses the most, Greene pointed to 

, specifically the arrival of “Q-Day,” a term in the industry used to describe the eventual day when 

 are able to crack traditional encryption methods used to secure the internet. The arrival of Q-Day will require companies to shift their attention to quantum-resistant cryptography, a quantum-proof way to secure data.

“I’m worried that when we reach Q-Day, or whatever you call it, it’s going to blow up and we’re going to be trying to put Band-Aids all over a big wound,” Greene said. “So, if you can work with your organizations, ask them, ‘Do they have a plan to migrate to post-quantum or quantum-resistant cryptography?’”

Former CISA executive worries about the impact of staff reductions

“I don’t know that we’ll ever be able to track a specific incident to a cut here or a cut there, but it’ll happen,” says Former CISA Assistant Executive Director of Cybersecurity Jeff Greene while speaking at a Travelers Institute webinar last week.

Billy Hurley

With a June 6 executive order, President Trump took a Sharpie to parts of President Biden’s final cybersecurity directive, including guidance related to post-quantum cryptography (PQC)—a defense against the 

 that could someday break many of today’s message scramblers.

While the directive acknowledges the security risks of quantum computers, the EO also erased Biden-era language encouraging the implementation of PQC keys “as soon as practicable upon support being provided by network security products and services.”

Cybersecurity pros who spoke with IT Brew reflected on a defense that remained in the Trump order: a requirement for agencies to support the internet privacy protocol known as Transport Layer Security version 1.3, or a successor version.

TLS 1.3 alone won’t save us from the encryption-breaking quantum computers, according to Nick Reese, adjunct professor at NYU Center for Global Affairs (and former DHS director for emerging technology policy).

“TLS 1.3 is not a quantum-resistant solution. It is a good security solution. It will make for a good foundation upon which we can build quantum solutions, but we still have to change the 

 algorithm, and that’s hard,” Reese told IT Brew.

Think of TLS like a message carrier, negotiating protections between two parties: a “handshake” key swap between a sender and receiver, and the resulting agreed-upon encryption between the two parties.

The key, in TLS 1.3, is exchanged through a process known as 

 (ECDH), which uses algebraic functions to create and encode a key on the client and server, simultaneously.

While Reese appreciates 1.3’s built-in rejection of outdated encryption methods like SHA-1, he is concerned that the protocol’s reliance on ECDH could lead to a quantum computer breaking the algebra, enabling an attacker to access past and current information exchanges.

“We know that data and information are both highly valuable and highly weaponizable,” Reese said. “If we agree on that, then a quantum computer that is able to break our asymmetric encryption is going to be the centerpiece of the most important cybersecurity challenge that we face in our lifetimes, and it’s not something that any one organization can do itself, whether that’s a nation or an individual company.”

The TLS 1.3 standard was released in 2018 by the Internet Engineering Task Force (IETF). The National Institute for Standards and Technologies also released 

“Yes, let’s do TLS 1.3, but not only TLS 1.3; we need to do TLS 1.3 

 the NIST algorithms,” Reese told us, adding in a follow-up email that IT system managers should be actively asking vendors for their plans to integrate the NIST post-quantum standards into their products. “Together with the TLS 1.3 transition, this creates a true hybrid approach,” he wrote.

 which uses two (or more) key exchange algorithms based on different cryptographic setups: one traditional algorithm and one next-gen algorithm.

“Many (though not all) post-quantum algorithms currently under consideration are relatively new; they have not been subject to the same depth of study as RSA…or Elliptic-curve Diffie–Hellman, and thus the security community does not necessarily have as much confidence in their fundamental security,” the IETF wrote.

The June 6 cybersecurity order acknowledges that a quantum computer could break “much of the public-key cryptography used on digital systems across the United States and around the world,” and the directive still requires the Department of Homeland Security to release a list of products supporting post-quantum cryptography.

Michael Smith, field CTO at DigiCert, sees only small changes between the dueling EOs and their take on quantum preparations.

“The overall direction is still there. The overall direction is moving forward,” he said.

An April ISACA study found that 40% of respondents are not aware of their company’s quantum-preparation plans.

An illustration features a golden, unlocked padlock at the center of a blue atom model with orbiting electrons, all set against a solid light purple background.

What is TLS 1.3 (and why one security pro says it’s not quantum-safe)

A professor and former DHS director weighs in.

, Deloitte warns of fast-calculating quantum computers and their ability to break the public-key cryptography that businesses rely on. Organizations must inventory their current cryptography and update it with new quantum-resistant encryption algorithms, the pro services firm recommends.

If that kind of all-hands-on-deck effort to guard against unknown catastrophe gives you some of those scary New Year’s Eve 1999 vibes, you’re not alone. Deloitte pros compare the quantum update prep to remediation strategies for Y2K—the two-character programming problem that surfaced almost 25 years ago as computers and applications registered a new century.

The National Institute of Standards and Technology (NIST) recently released 

, and vendors like Apple, Google, and Microsoft have modified products and platforms to incorporate quantum-ready encryption.

Deloitte, in its report, pointed to NIST’s National Cybersecurity Center of Excellence for 

“In their response to Y2K, organizations saw a looming risk and addressed it promptly. Today, IT faces a new challenge, and it will have to respond in a similar, proactive manner,” the authors wrote.

Bill Briggs, CTO at Deloitte, talked with IT Brew about Y2K and what is being dubbed “Y2Q.”

Responses below have been edited for length and clarity.

What lessons from the Y2K experiences should be applied to quantum encryption preparations?

Y2K was something that the…business leader, C-suite, and board member could understand, and there wasn’t much ambiguity of, is this something we should care about? It was a pretty clear story of: Our operational backbone is at potential risk here if we don’t invest. People look back maybe, and say, “Well, planes didn’t fall out of the sky. Was it really a big deal, or did we just make a big deal out of nothing?” It wasn’t a big deal because of the hard work and investment that went in to make sure that we were ready.

So, there’s a similar lesson here. This isn’t to be overly hysterical, or to use this to force an undue amount of risk and attention from the business, but it is something that should be talked about now in appropriate terms of, it’s not now, it’s not tomorrow, but it’s coming, and we’re going to have to do something about it to get the similar level of business buy-in for the investment.

Transactional system integrity, private information in government and healthcare—basically the underpinnings of modern security and privacy.

First off, we have to understand exactly where and how deeply the encryption logic is embedded up, down and across our stack. And that’s something that’s just not easily known. Finding out where the potential affected systems and libraries and networks and data are? It’s prevalent, but we have to be precise. So, get a sense of what changes are going to be required. There are different techniques depending on the level of the stack. But it’s like Y2K, where it’s going to require some pretty invasive remediation into infrastructure, data network, application, integration, layers and more.

Is there a tool that helps with inventory, or is it a manual effort?

Our clients are the biggest organizations in the world. There’s no easy approach to go and get a handle on the entirety of your technology footprint. There are tools to make it so it’s not completely manual, and we’re trying to make it even more AI driven and automated, but the workload is significant.

How to start using post-quantum encryption

Why Deloitte recommends updating encryption like it’s 1999

Deloitte’s Tech Trends report recommends orgs prep for “Y2Q.”

Tom McKay

Academics, security pros, and policymakers recently swarmed Washington, DC, for the first-ever Quantum World Congress, a mass gathering of quantum computing experts. Among the biggest topics of discussion, 

, was the “quantum encryption apocalypse.”

That’s the concept that some of the most widespread encryption algorithms in use today are 

 by next-generation computers operating on principles of quantum mechanics. The biggest unknown might not be when this threat arrives, but what cybersecurity pros can do to prepare for it.

Traditional computers use bits, a logical state with two possible values: 1 or 0. Quantum computers rely on qubits, which can be both 1 or 0 simultaneously. In theory, qubits can generate solutions to problems in hours or days that would take classical computers exponential amounts of time—say, 

 to be of use solving practical problems. Yet that could rapidly change if or when certain engineering problems like noise mitigation 

One concern is not only that techniques like RSA will become useless against quantum-equipped adversaries, but that nation states may already be archiving data to 

“In terms of script kiddies, and small hacker groups, they don’t really have access to this stuff,” David Mahdi, chief strategy officer and CISO advisor at Sectigo, told IT Brew. “At least today, nation states are probably the thing to worry about at the moment, because I would predict that they’re going to be the first to have these capabilities.”

Scott Crowder, the VP of IBM Quantum, told IT Brew that certain cryptographic methods can already be future-proofed, and mathematicians have developed replacement algorithms for those that can’t. The hard part, he said, will be upgrading.

“It takes a long time to make this kind of transformation of your IT systems,” Crowder said. “So, the good news is that researchers, like at IBM Research, have come up with cryptographic methods [where] both quantum computers and classical computers suck at the math of doing it.”

Public-key (asymmetric) encryption is known to be quantum vulnerable, but private-key (symmetric) encryption can be shored up just by making the keys larger, said Crowder. Earlier this year, the US National Institute of Standards and Technology 

 of four quantum-resistant algorithms (and four other candidates) designed to fill the gaps.

Crowder said research has shown those replacement algorithms, which run on classical computers, to be efficient, commercially viable, and more practical than solutions like quantum key distribution.

“We’ve done the math part,” Crowder said. “The hard part now is, how do I inventory all the stuff that I’m getting out there, figure out which of the things that I gotta go fix first? And how do I set up a process to make it easy for me to go fix them and prove that it’s fixed and keep them updated?”

. Crowder pointed to the arduous tasks of identifying weak points and ensuring they can not only be fixed but made stronger over time—across their entire supply chains. IBM has proposed a model called a 

“It’s kind of like Y2K, but it’s even more complex than that,” Crowder said. “Transforming basically our entire digital economy to something that is quantum safe is a non-trivial human exercise.”

Billy Hurley contributed reporting to this story.

Quantum

Former CISA executive worries about the impact of staff reductions

What is TLS 1.3 (and why one security pro says it’s not quantum-safe)

Why Deloitte recommends updating encryption like it’s 1999

The ‘quantum encryption apocalypse’ might just be Y2K 2.0

Top insights for IT pros