Businesses preparing for Q-Day or when quantum computers become powerful enough to break some widely used forms of encryption, face a difficult task, which is improving security while keeping their services running.
The changes could affect company networks, apps, and cloud services. Businesses would also need to work with outside providers to check that their connected systems remain secure.
“The companies need to realize the threat is real, and we need to start yesterday. We are already one day late,” said Ramesh Nagarajan, head of Quantum Education at Eigensystems, during a media roundtable on the sidelines of the “Y2Q Horizon: Preparing Leaders for Post-Quantum Cryptography” forum organized by the Asian Institute of Management (AIM).
Post-quantum cryptography (PQC) aims to protect data against these future attacks. It involves new ways of securing information, including bank transactions, payments, emails, and data stored in the cloud.
Nagarajan said companies would need to spend on security upgrades while continuing to pay for the systems they use every day. The changes could involve several parts of a business and extend to services provided by other companies.
Cloud providers and business partners would also need to prepare, he said. Updating a company’s own systems would cover only part of the work because its information also passes through other organizations’ systems.
“You have to test end-to-end across partners,” Nagarajan said.
This means checking that information stays protected as it moves between a company and its partners. Nagarajan said businesses could hire new graduates to help test these connections and prepare their systems.
Companies do not need to own a quantum computer to get started, he clarified. PQC is meant to protect the computers and services they already use.
At risk are encryption methods such as RSA and elliptic curve cryptography, which help keep digital information private. A powerful enough quantum computer could break that protection and allow attackers to read sensitive data.
Nagarajan warned about “harvest now, decrypt later,” in which attackers steal encrypted information and save it until they have the tools to unlock it. This puts information that must stay private for years at risk.
When quantum computers will reach that point remains uncertain. Nagarajan said today’s quantum machines still make errors, and researchers are working to reduce them.
Business leaders also need to understand the threat well enough to decide what to fund and which skills their teams need.
“The preparation is long, therefore the warning has to be given at the earliest possible time,” said Francisco Ashley Acedillo, AIM clinical professor and academic program director of the Executive Master in Cybersecurity Management.
Acedillo said AIM teaches executives and managers enough about cybersecurity to help guide decisions by management and company boards.
Nagarajan said education would help people understand the technology and work together to prepare. He also called for training workers while creating local jobs where they could use those skills.
For companies spending on artificial intelligence (AI), he urged them to also consider the security of the cloud services their AI tools depend on.