Why It's Time To Invest In Quantum Cybersecurity Now

Brian Witten, VP/CSO of automotive technology supplier Aptiv, warns that 'While seven to 10 years may sound like a long way off, preparation for quantum threats must begin now, not once they have already materialized.'

Organizations need time to implement post-quantum cryptography (PQC) transition plans methodically — and that applies both to anyone with an IT infrastructure and to anyone building software-defined systems. 'Current encryption, such as RSA and ECC [elliptic curve cryptography], will become obsolete once quantum computing matures,' said Cigent cofounder John Benkert. 'Management often assumes cybersecurity threats are only present-day problems. But this is a future-proofing issue — especially relevant for industries dealing with sensitive, long-lifespan data, like healthcare, finance or government.' Remediation requires long-term planning. Organizations that wait until quantum computers have broken encryption to address the threat will find that it is too late.

Start by building an inventory of what needs to change, Witten recommends. (Fortunately, 'It's a matter of using newer and different chips and algorithms, not necessarily more expensive components,' he writes, also suggesting requests for proposals 'should ask vendors to include a PQC update plan.')

Firmware will also need quantum-resistant digital signatures. ('Broken authentication lets bad things happen. Someone could remotely take over a vehicle, for instance, or send malicious code for autonomous execution later, even after the vehicle has gone offline.') And remember that post-quantum key sizes are larger, requiring more storage space. 'In some cases, digitally signed messages with security information could triple in size, which could impact storage and bandwidth.'

Thanks to Esther Schindler (Slashdot reader #16,185) for sharing the article.

Read more of this story at Slashdot.