Tips for Preparing for Quantum Technology Adoption

🔐Word o’ the Day | Year | Decade: Crypto-agility, Baby! Yesterday morning, I did a fun fireside chat with Bethany Gadfield - Netzel at the FIA, Inc. Expo in Chicago. We talked about cyber resilience, artificial intelligence, Rubik’s cubes, and that thing called quantum! A question came up at the end, “What can firms actually do today to begin transitioning to post-quantum cryptography?” So thought I would take the opportunity to share my thoughts more broadly on this important, but not super well understood, topic: 1. Don’t wait. The clock for quantum-safe cryptography is already ticking. NIST released its first set of post-quantum standards last year (https://lnkd.in/esTm8uPw) and CISA put out a “Strategy for Migrating to Automated Post-Quantum Discovery and Inventory Tools” last year as part of its broader Post Quantum Cryptography (PQC) Initiative (https://lnkd.in/evpF4umv). h/t Garfield Jones, D.Eng.! 2. Inventory & prioritize. Map all cryptographic usage: what keys, certificates, protocols, and data streams exist today? Which assets hold long-lived value and are at risk of “harvest-now, decrypt-later”? Build a migration roadmap that prioritizes highest-risk systems (e.g., financial settlement platforms, inter-bank links, legacy encryption). 3. Establish crypto-agility. Ensure your architecture supports swapping algorithms, updating certificates, & layering classical + post-quantum primitives without a full system rebuild. This kind of flexibility is key for resilience. 4. Pilot and migrate. Use the new NIST-approved algorithms; experiment first on less time-sensitive systems, validate performance and interoperability, then scale to mission-critical applications. NIST’s IR 8547 report provides a framework for this transition. 5. Vendor & supply-chain alignment. Ask your vendors & service providers: “What’s your PQC transition plan? When will you support NIST-approved post-quantum algorithms? Are your update paths crypto-agile?” If the answer isn’t clear or (as a former boss of mine used to say) they look at you like a “pig at a wristwatch,” you’ve got a potentially serious third-party risk. 6. Board and Exec engagement. Position this not as an IT problem but a fiduciary risk and resilience imperative. The transition to quantum-safe cryptography is multi-year and multi-layered—waiting until it’s urgent means it will be too late.

Deloitte Urges Organizations to Prepare for Post-Quantum Cryptography Quantum Threats to Cryptography In its annual Tech Trends report, Deloitte highlights the looming cybersecurity threat posed by quantum computers. These fast-calculating machines could soon break traditional public-key cryptography, which underpins secure communications and data protection. To safeguard against this risk, Deloitte recommends that organizations take immediate steps to inventory and update their cryptographic systems with quantum-resistant algorithms. A Y2K-Like Urgency Deloitte likens the need for proactive quantum encryption updates to the urgency of addressing the Y2K problem in the late 1990s. Similar to how companies scrambled to fix date-related programming issues to avoid catastrophic failures, today’s IT teams must preemptively tackle the vulnerabilities quantum computing may introduce. The comparison underscores the scale and urgency of the effort required to prevent future security breaches. NIST’s Post-Quantum Encryption Standards The National Institute of Standards and Technology (NIST) has already released post-quantum encryption standards to guide organizations. Tech giants such as Apple, Google, and Microsoft have begun incorporating quantum-ready encryption into their products and platforms, signaling the importance of early adoption. Deloitte’s report emphasizes that businesses must align with these standards to future-proof their cryptographic infrastructure. Tools for Cryptographic Transition To aid organizations in this transition, Deloitte points to resources such as NIST’s National Cybersecurity Center of Excellence. This center offers cryptographic discovery and inventory tools that help identify outdated encryption methods and streamline the process of upgrading to quantum-resistant systems. These tools are critical for managing the complexity of securing vast digital infrastructures. The Need for Proactive Action Deloitte stresses the importance of taking immediate, proactive measures to address this emerging challenge. Organizations should prioritize assessing their cryptographic systems, investing in quantum-resistant solutions, and adopting NIST-recommended practices. Early preparation will minimize risks and ensure a smoother transition as quantum computing capabilities evolve. Conclusion The rise of quantum computing presents a significant threat to traditional cryptographic systems, requiring organizations to adopt quantum-resistant encryption. Deloitte’s comparison to Y2K highlights the urgency and scale of this challenge. By leveraging NIST standards, adopting available tools, and taking proactive steps, businesses can mitigate risks and prepare for a quantum-driven future in cybersecurity.

I've given talks about Post Quantum Cryptography the past few years and pretty much everyone has appreciated the heads up, for those that haven't made it to a talk here are the highlights of what you need to do to prepare for Quantum Computers. 1) Build organizational readiness: • Educate and align the C-suite on the urgency of quantum risk and make the business case for a multi-year investment, i.e. get budget. • Identify personnel responsible for migration execution across different teams, i.e. assign a point person for this project. 2) Discover what you have and assess if the systems are ready: • Get an inventory of you hardware and software assets to identify encryption protocols and categorize them (PQ ready, depreciated, really old). • Assess whether hardware assets have sufficient compute to support PQC algorithms (most systems will but the OS might not be ready) • Figure out which systems will require upgrades or replacements. • Identify vendors and partners that you use and discuss their PQC roadmaps, migration support capabilities. [This one is key, talk to your vendors, find out what they are doing, or not doing!] 3) Begin getting Quantum ready • Buy the hardware / software and replace or upgrade whatever does not support PQ cryptography • Test things! Run proof-of-concept deployments in controlled environments (i.e. your test environment) and use a hybrid approach that combine current and post-quantum algorithms. 4) Deploy Quantum ready solutions • Roll out your solutions / new hardware & software in phases, starting with your high priority systems (Duh). • Ensure configurations enforce quantum-safe algorithms by default and automatically block deprecated algorithms when possible (this will be harder than you might think). • Update your security policies to manage both current and quantum-safe network traffic as you transition. • For the old stuff you can't get rid of, use proxy solutions to make IoT devices (like hospitals, manufacturing, etc.) quantum-ready until they can be updated directly. Last but not least, be prepared to change encryption schemes going forward, what we call, Crypto Agility. 5) Keep patching your stuff • Now that you have a list of your hardware and software and what kind of encryption is uses, do this: • Monitor your inventory for vulnerabilities or new threats. Keep in mind that PQ standards are new and they will likely change over time. • Establish a process to replace or update vulnerable algorithms There, you've now just read my talk, but you missed all my jokes and fun stories, but you got the details / important take aways. 😃 😁 😀 If you want the Internal Control Questionnaire (#ICQ) I put together for some auditor friends, message me here and I'll send it to you.

The imperative to prepare for the transition to quantum-safe cryptography doesn't necessarily mean an immediate switch. Consider these two critical aspects: ☝ Complexity of Cryptographic Algorithm Transition: Transitioning cryptographic algorithms is a complex undertaking. A quick examination within your organization or with your service providers may reveal the use of obsolete algorithms like SHA-1 or TDEA. For example, the payment card industry still employs TDEA, despite its obsolescence was announced in 2019. It's essential to enhance your organization's cryptography management capabilities before embarking on the transition to quantum-safe cryptography. ✌ Scrutiny Required for New PQC Algorithms: The new Post-Quantum Cryptography (PQC) algorithms are relatively recent and warrant careful examination. Historically, we have deployed cryptographic algorithms on a production scale only after several years of existence, allowing comprehensive scrutiny. While PQC standardization offers some security assurances, it doesn't cover the software implementations deployed in your environment. Consider employing phased deployments and hybrid implementations to avoid compromising the existing security provided by classical cryptography. Recent news, as mentioned in this article, highlights the immaturity of implementations of new PQC algorithms. While the title might be somewhat misleading, it's crucial to recognize that occasional flaws in implementations, like those found (and solved) in various instances of Kyber, serve as reminders. As we transition to these new implementations, we must first gain control over our cryptography. Here's a suggested action plan: 🚩 Cryptography Management: Prioritize gaining control over your cryptography. 🚩 Understanding Quantum-Safe Cryptography: Familiarize yourself with the development of quantum-safe cryptography. 🚩 Transition Plan Preparation: Follow recommendations to prepare a comprehensive transition plan. Some of my favourite resources are: - Federal Office for Information Security (BSI)'s "Quantum-safe cryptography" (https://lnkd.in/dqkSAQSP) - Government of Canada CFDIR's "BEST PRACTICES AND GUIDELINES" (https://lnkd.in/d-w_Nbfj) - National Institute of Standards and Technology (NIST)'s "Migration to Post-Quantum Cryptography" (https://lnkd.in/dYMKnqBb) 🚩 Decision-Making: Make informed decisions based on the acquired knowledge. In summary, a thoughtful and phased approach is key to ensuring a smooth transition to quantum-safe cryptography. https://lnkd.in/dxAgF2ac #cryptography #quantumcomputing #security #pqc #cybersecurity

Most quantum boardroom conversations end without an agenda. They end with a posture — "we're monitoring quantum developments," "we're taking it seriously". Neither statement produces a plan. The distinction matters because quantum creates three problem classes, each with a different urgency and a different cost of inaction. A generic posture misaddresses all three at once. The right response, for most leadership teams, has three parts. The first is to defend now. Post-quantum cryptography belongs on the enterprise risk agenda as a current priority. That means building visibility into cryptographic dependencies across the enterprise, identifying migration priorities, and mapping third-party exposure. This is the part of the quantum agenda that cannot wait. The second is to explore selectively. Most leadership teams do not need a wide portfolio of quantum pilots. They need a small number of focused efforts on high-value problems where the workload aligns with quantum's actual strengths — evaluated against the strongest available classical alternative. Each effort should be a targeted test: one specific problem, one clear classical benchmark, one honest evaluation. The third is to build options. For companies in simulation-relevant sectors — pharmaceuticals, advanced materials, energy — the right posture is modest investment in partnerships and early hardware collaborations. The goal is R&D workflows that are ready to integrate quantum subroutines when the technology matures. The companies that benefit most will not necessarily be those spending the most today. They will be the ones best positioned to move when the moment arrives. The most common failure on quantum is conflating the urgency of the three classes — treating all three as equally distant or equally immediate, when each has a different clock running. The organizations that get this right understand early which problem classes matter to their business, which ones to set aside, and what the distinction demands of them starting Monday morning. https://lnkd.in/gkymW7Xm

Always‑excellent Cyber Security Agency of Singapore (CSA) has published two drafts for public consultation on getting quantum‑ready. Great, pragmatic start: • Quantum‑Safe Migration Handbook (draft): practical guidance for planning the migration to post‑quantum cryptography, especially for CII owners and government, structured across five domains (Risk Assessment, Governance, Technology, Training & Capability, External Engagement). Strong “no‑regrets” steps without rushing first‑mover risks.  • Quantum Readiness Index (QRI) (draft): a self‑assessment that translates awareness into action. It gauges readiness across the same five domains, pairs levels (adapted from CMMI/ISACA) with recommended next steps, and aligns to the WEF Quantum Readiness Toolkit principles. Designed to facilitate board‑level discussions and prioritisation. Consultation window: 23 Oct – 31 Dec 2025. As a Singapore‑headquartered firm, Applied Quantum is compiling our comments. Consider adding your perspective (policy, crypto agility, vendor selection, migration road‑mapping). These documents are a very good start for the region. https://lnkd.in/gGJ2xRk3 #QuantumSafe #PQC #Cybersecurity #Singapore #QuantumReadiness #QuantumSecurity

EY’s perspective on securing against #quantum #risks emphasizes that quantum #computing is rapidly evolving from a theoretical concern into a material cybersecurity threat that requires immediate strategic action. The core issue lies in the vulnerability of widely used cryptographic algorithms, such as RSA and elliptic curve cryptography, which could be broken by sufficiently advanced quantum computers. This creates a systemic risk to sensitive data, including financial information, intellectual property, and personal records. A central concept highlighted is the “harvest now, decrypt later” threat model, in which adversaries collect encrypted data today with the intention of decrypting it in the future as quantum capabilities mature. This makes quantum risk a present-day problem, particularly for data requiring long-term confidentiality. EY stresses that organizations must adopt a proactive and structured approach to quantum readiness. A foundational step is to conduct a comprehensive cryptographic inventory, identify sensitive #data, and map existing #encryption methods. This enables organizations to assess which systems are most exposed and prioritize remediation efforts. Transitioning to post-quantum cryptography (PQC) is a complex, multi-year transformation that requires careful planning, integration into existing #technology roadmaps, and alignment with emerging standards. Organizations are encouraged to build crypto-agility, allowing them to adapt encryption methods as technologies and standards evolve. EY also highlights the importance of #governance, #compliance, and #workforce readiness. Quantum resilience requires enterprise-wide coordination, including policy development, regulatory alignment, continuous monitoring, and personnel training. EY frames quantum cybersecurity not just as a technical upgrade but as a strategic #transformation initiative. Organizations that act early can strengthen resilience, improve cyber maturity, and gain a competitive advantage, while those that delay risk long-term exposure to data breaches, regulatory challenges, and erosion of #digital #trust.

𝗗𝗮𝘆 𝟴: 𝗗𝗮𝘁𝗮 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗣𝗼𝘀𝘁 𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀 In today’s hyper-connected world, data is the new currency and the perimeter, and it is essential to safeguard them from Cyber criminals. The average cost of a data breach reached an all-time high of $4.88 million in 2024, a 10% increase from 2023. Advances in 𝗾𝘂𝗮𝗻𝘁𝘂𝗺 𝗰𝗼𝗺𝗽𝘂𝘁𝗶𝗻𝗴 further threaten traditional cryptographic systems by potentially rendering widely used algorithms like public key cryptography insecure. Even before large-scale quantum computers become practical, adversaries can harvest encrypted data today and store it for future decryption. Sensitive data encrypted with traditional algorithms may be vulnerable to retrospective attacks once quantum computers are available. As quantum technology evolves, the need for stronger data protection grows. Google Quantum AI recently demonstrated advancements with its Willow processors, which 𝗲𝗻𝗵𝗮𝗻𝗰𝗲𝘀 𝗲𝗿𝗿𝗼𝗿 𝗰𝗼𝗿𝗿𝗲𝗰𝘁𝗶𝗼𝗻 𝘂𝘀𝗶𝗻𝗴 𝘁𝗵𝗲 𝘀𝘂𝗿𝗳𝗮𝗰𝗲 𝗰𝗼𝗱𝗲. These breakthroughs underscore the growing efficiency and scalability of quantum computers. To address these threats, Enterprises are turning to 𝗮𝗴𝗶𝗹𝗲 𝗰𝗿𝘆𝗽𝘁𝗼𝗴𝗿𝗮𝗽𝗵𝘆 to prepare for Post Quantum era. Proactive Measures for Agile Cryptography and Quantum Resistance: 1. 𝗔𝗱𝗼𝗽𝘁 𝗣𝗼𝘀𝘁-𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗔𝗹𝗴𝗼𝗿𝗶𝘁𝗵𝗺𝘀 Transition to NIST-approved PQC standards like CRYSTALS-Kyber, CRYSTALS-Dilithium, Sphincs+. Use hybrid cryptography that combines classical and quantum-resistant methods for a smoother transition. 2. 𝗗𝗲𝘀𝗶𝗴𝗻 𝗳𝗼𝗿 𝗔𝗴𝗶𝗹𝗶𝘁𝘆 Avoid hardcoding cryptographic algorithms. Implement abstraction layers and modular cryptographic libraries to enable easy updates, algorithm swaps, and seamless key rotation. 3. 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗲 𝗞𝗲𝘆 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 Use Hardware Security Modules (HSMs) and Key Management Systems (KMS) to automate secure key lifecycle management, including zero-downtime rotation. 4. 𝗣𝗿𝗼𝘁𝗲𝗰𝘁 𝗗𝗮𝘁𝗮 𝗘𝘃𝗲𝗿𝘆𝘄𝗵𝗲𝗿𝗲 Encrypt data at rest, in transit, and in use with quantum resistant standards and protocols. For unstructured data, use format-preserving encryption and deploy data-loss prevention (DLP) tools to detect and secure unprotected files. Replace sensitive information with unique tokens that have no exploitable value outside a secure tokenization system. 5. 𝗣𝗹𝗮𝗻 𝗔𝗵𝗲𝗮𝗱 Develop a quantum-readiness strategy, audit systems, prioritize sensitive data, and train teams on agile cryptography and PQC best practices. Agile cryptography and advanced data devaluation techniques are essential for protecting sensitive data as cyber threats evolve. Planning ahead for the post-quantum era can reduce migration costs to PQC algorithms and strengthen cryptographic resilience. Embrace agile cryptography. Devalue sensitive data. Secure your future. #VISA #PaymentSecurity #Cybersecurity #12DaysofCyberSecurityChristmas #PostQuantumCrypto

The rapid advancements in quantum computing are pushing businesses to rethink data protection, requiring swift adaptation to new encryption techniques and infrastructure to stay secure in an increasingly vulnerable digital landscape. Quantum computing, utilizing qubits, can perform computations far faster than traditional computers, presenting challenges for standard cryptographic systems like RSA and ECC, which are vulnerable to quantum attacks. Businesses must assess risks, update their infrastructure with post-quantum cryptography, and train personnel accordingly. Adopting a hybrid strategy combining traditional and quantum-resistant cryptography ensures smoother transitions. Continuous monitoring of technological advancements and compliance with updated regulations is essential for safeguarding sensitive data in the quantum era. #QuantumComputing #cryptography #DataProtection

IS YOUR ENTERPRISE READY FOR "Q-DAY"? "Q-day" (or Quantum Day) is the point in time when quantum computers become powerful enough to break the public-key encryption (like RSA or ECC) that currently secures global digital, financial, and government infrastructure. Our current best estimates is that Q-Day will happen by 2029! Huge thanks to Dr. Rob Campbell, FBBA. , IBM Global Quantum-Safe Executive and IBM Quantum Ambassador, for guest lecturing to our University of Arkansas ­- Sam M. Walton College of Business EMBA students. His insights into the "Quantum-Safe" transition provided a crucial roadmap for how leadership must navigate the next few years of cybersecurity. Here's what we learned: Adversaries are currently collecting encrypted data to store and decrypt once quantum computers are powerful enough to calculate private keys—a strategy known as "Harvest now, decrypt Later". Because enterprise cryptographic migrations can take 5 to 15+ years, many large organizations will still be in transition when quantum computers become capable of breaking current encryption. What enterprises can do NOW: Dr. Campbell emphasized that Post-Quantum Cryptography (PQC) is a leadership issue, not just a technical one. To preserve trust and resilience, leaders should authorize these "low-regret" actions immediately: - Inventory cryptographic dependencies: identify what you have before you plan what to change. - Prioritize high-value data: Focus on data with the longest confidentiality horizons, not just the most "critical" systems. - Invest in crypto-agility: Design systems for the permanent ability to swap algorithms without rebuilding the entire architecture. - Pilot PQC today in non-mission critical systems: PQC standards were finalized by NIST in 2024 and are ready for deployment on classical computers now. Enterprises can learn in these lower risk systems. - Communicate metrics to boards in non-technical jargon. Dr. Campbell noted, the question is whether we manage this change deliberately now or inherit it under pressure later. He stressed the importance of wide-spread education. To that end, Professor Daniel Conway will be offering the Walton College's first Quantum Computing class this fall! Adam Stoverink, Ph.D.; Shaila Miranda; Brian Fugate; Brent D. Williams; James Allen Regenor, Col USAF(ret) #QuantumSafe #PQC #CyberSecurity #Leadership #EMBA #DigitalTransformation #RiskManagement