Quantum Readiness Calling for Future Ready Security Postures

The biggest risk and impact that quantum will pose is to render redundant cryptographic standards that secure digital transactions. It is probable that the algorithms that today’s powerful supercomputers cannot break in millions of years, can be broken by quantum computers in days if not minutes. In this scenario, organizations will need to first identify their entire crypto inventory and identify the “waves” of quantum readiness they will need to apply to these assets and thereafter navigate the journey to crypto agility. Automation and lifecycle management of crypto assets be it devices, servers, code signing software, or document signing is the first step of this multi-year journey.

The first step in this journey would be to assess asset lifespan. The transition to PQC depends on the importance, sensitivity, and expected lifespan of the data you’re seeking to safeguard. For example, a nonprofit hospital chain responsible for handling a patient’s history requires a higher overall level of security than a small catering business whose data may be limited to payment card information. The second step would be to examine your use cases. High-security use cases like signatures and key exchange mechanisms need to be updated to quantum-resistant algorithms well in advance of quantum computers becoming available.  Similarly, IoT devices can live in the field for decades and need to be secured with PQC algorithms well ahead. The third step would be to prioritize your crown jewels. In addition, you also need to have a crypto-agility strategy to automate this process of exchanging keys and certificates that can’t withstand quantum computing with those that will. The stakes are high, but with proper planning and coordination, we can ensure that our digital infrastructure remains secure in the post-quantum era.

Over the past few years, there has been a great deal of discussion about quantum computing and its implications for cyber security and digital trust. The Cloud Security Alliance estimates that a quantum computer will be capable of breaking current cybersecurity infrastructure as soon as 2030. To underscore the urgency, the organization has even set up a countdown to the Y2Q clock. The biggest challenge with post-quantum for large organizations, especially, is where to start – and how to manage this multiyear journey. The good news is that DigiCert already provides the capability for customers to manage the certificate lifecycle using NIST’s quantum-safe algorithms. We also have labs where customers can test these solutions in a sandboxed environment as well as advisory services to navigate the PQC journey.

DigiCert has been proactive in engaging with the National Institute of Standards and Technology (NIST) in their efforts to establish new cryptographic standards to address the threat quantum computers will pose to traditional encryption methods. Our involvement is twofold: contributing to the standards development process and working closely with researchers and manufacturers to gain a deeper understanding of the challenges quantum computing will present. Throughout this journey, DigiCert has collaborated with a diverse group of industry leaders like Microsoft as well as academic institutions to tackle these challenges head-on. These collaborations have been instrumental in advancing our understanding and development of quantum-resistant cryptography, ensuring that we remain at the forefront of securing the future against emerging technological threats.