Quantum Threats - Defense Responses Are Fragmented

The Threat

Quantum threats are no longer a distant concern; they are actively impacting organizations today. One of the most pressing threats is harvest-now-decrypt-later (HNDL), where attackers collect encrypted data now with plans to decrypt it when quantum computing becomes powerful enough. This method exploits vulnerabilities in existing public key cryptosystems like RSA and ECC. As quantum technology advances, the risk to sensitive data increases significantly.

Dr. Tan Teik Guan, CEO of pQCee, emphasizes that financial institutions, healthcare providers, and government organizations are particularly vulnerable. For financial institutions, the breach of transaction data can lead to severe privacy and reputational damage. In healthcare, exposed patient records pose serious privacy risks. Government agencies face threats to classified information, which can undermine public trust and economic stability. The urgency for organizations to adopt quantum-safe measures is clear, as HNDL represents just the beginning of a new wave of quantum threats.

Who's Behind It

The fragmented defense response to quantum threats highlights a significant gap in preparedness across industries. Many organizations have adopted the label of crypto-agility but lack the necessary capabilities to implement it effectively. Dr. Tan argues that true crypto-agility requires more than just supporting multiple algorithms; it necessitates a comprehensive approach to cryptographic defenses that is timely, cost-effective, and minimally disruptive.

Organizations need to develop layered defense architectures that can maintain a quantum-safe state. This includes integrating new cryptographic standards and ensuring that all components of their infrastructure are aligned with post-quantum strategies. The challenge lies in the uneven pace at which enterprises are moving toward these solutions, leaving many exposed to potential attacks.

What Data Is at Risk

As organizations begin to address quantum threats, they must prioritize high-risk systems and data. Dr. Tan suggests focusing first on internet-facing data and applying layered defenses such as end-to-end post-quantum encryption and post-quantum TLS 1.3. This approach makes it significantly more difficult for adversaries to execute HNDL attacks.

A complete inventory of cryptographic assets is often recommended, but Dr. Tan cautions that this can quickly become outdated. Instead, organizations should identify critical areas where their data is most vulnerable and implement robust defenses there first. The goal is to create a proactive security posture that anticipates future quantum challenges while addressing current risks.

Recommended Actions

To effectively combat quantum threats, organizations should adopt a multi-faceted approach. This includes engaging with vendors to understand their post-quantum product roadmaps and requiring them to provide a cryptographic bill of materials (CBOM). Such transparency helps organizations assess whether their vendors are progressing in line with their own timelines.

Additionally, relying solely on cloud providers for quantum-safe solutions can leave significant gaps in security. While cloud providers like AWS and Azure are expanding their offerings, organizations must ensure that their overall security posture includes defenses beyond what cloud services provide. By implementing a comprehensive strategy that combines cloud capabilities with robust internal defenses, organizations can better prepare for the quantum future.