Post-quantum cryptography, or PQC, is an emerging field of technology that anticipates a world where quantum computers will render modern encryption algorithms obsolete.
By developing PQC pilots, cybersecurity experts at Wells Fargo Bank & Co., Accenture PLC and DigiCert Inc. hope to prepare companies for the migration to quantum-based cybersecurity before it becomes an absolute necessity.
“Pilots are a really important way to focus when you’re looking at a PQC migration,” said Tom Patterson (pictured, middle), managing director of emerging technology security at Accenture. “It validates an approach or helps you learn about what approach would work best in your environment, but it also helps to make this real for the rest of your organization.”
Patterson and Jeff Stapleton (right), post-quantum photography researcher and architect at Wells Fargo, spoke with Jeremy Rowley (left), senior vice president of strategy at DigiCert Inc., for the DigiCert World Quantum Readiness Day event, during an encore broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed PQC migration and the risks of waiting to adapt to quantum. (* Disclosure below.)
PQC pilots prepare businesses for ‘Q day’
Industry professionals might ask why a move to PQC is necessary when RSA, the current crypto system, works, but both Patterson and Stapleton emphasize that preparing now will save companies money in the future. They point out that RSA has held up for decades, but history shows every cryptographic standard eventually needs replacement once vulnerabilities emerge or computing power advances. By anticipating that inevitability and planning early, businesses can avoid last-minute, expensive overhauls and instead phase in upgrades more strategically.
“This [PQC] is just another series of cryptographic transitions,” Stapleton said. “However, this is going to be a big one. This is going to affect the entire financial services industry. And based on that history of all those other changes … we know this is going to take a really long time.”
Part of getting clients on board is showing them PQC pilots with tangible results, according to Patterson. These demonstrations not only prove the technology works, but also help companies visualize how the changes will fit into their existing systems and long-term strategies. For example, Accenture has developed pilots that can seamlessly upgrade to new standard algorithms as they are finalized and released.
Staying abreast of evolving industry standards is a critical component of cybersecurity, especially as the quantum era approaches, Patterson and Stapleton agreed. They stressed that organizations that track standards closely — or work with partners who do — will be better positioned to adopt secure practices smoothly and ahead of looming deadlines.
“The information is not kept secret,” Patterson said. “This is a global change that’s underway and there’s a lot of great information available. Definitely recommend either focusing on the changes yourself or partnering with people that are focused on that.”
Although quantum can seem spooky and overwhelming, the experts describe it as just another cybersecurity transition — albeit a big one. The best strategy is to start looking at PQC pilots now, instead of waiting until quantum-based cyberattacks become a problem.
“We’re taking the position that nobody can be left behind,” Stapleton said. “Everybody’s going to have to upgrade. And, frankly, if you’re not ready and the Q day occurs, you’re just not going to be a vendor to us. We don’t want the risk of the financial services industry so nobody needs to be left behind.”
Stay tuned for the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the DigiCert World Quantum Readiness Day event.
(* Disclosure: TheCUBE is a paid media partner for the DigiCert World Quantum Readiness Day event. Neither DigiCert Inc., the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)
Photo: SiliconANGLE