For Government, the Race Against Q Day Should Have Already Started

There has been a lot of speculation about the impacts quantum computing will have on society at large, and especially on cybersecurity. The technology promises to shake up everything from modern cryptography to healthcare, depending on who you talk to.

But much like the Internet, the proliferation of smartphones and the full-frontal assault that has been AI, experts seem to agree that all we can control is our reaction to it.

The rapidly emerging technology was the focus of a panel of experts at the recent California Cybersecurity Education Summit* in Sacramento last week, where they tried to work through how state and local government should be managing that reaction.

The takeaways were simple: This is happening, and organizations should be shaping — or at least starting to think about shaping — their response.

Christopher Kyle, a security architect with the Franchise Tax Board, said the first thing to consider at this stage is the state’s lengthy, challenging funding process. With “Q Day” an estimated three years off and yearlong funding cycles, there’s not much time to get the funding needed for post-quantum cryptography and other necessities.

“If you're just now starting with post-quantum today, the first thing you need to do is start building that support,” Kyle said. “A lot of what we do at the state level, we're budgeting out three to five years.”

In addition to navigating budgets, Kyle added that working with procurement teams to update vendor agreements will also be a critical component to making sure the vendors that government relies on are up to the developing challenge and can keep pace.

“If post-quantum is in two or three years, have you started changing your vendor agreements to enforce post-quantum, that they need to meet post-quantum cryptography standards within the next three years, or are you potentially getting stuck with a vendor that isn't going to be ready for five to 10 years?” Kyle added.

The other critical aspect of preparedness for quantum is internal communication, Kyle said, and translating the real-world risks to executives and cybersecurity teams.

“Ultimately, if you're not telling your technology team that this risk is coming, they're not going to mobilize to do anything about it. So, it's our responsibility as cybersecurity experts to start getting them to mobilize, and then helping them discover what they need to fix first,” Kyle said.

The looming threat of Q-Day, though, was tempered by the panelists, who reminded attendees that it simply represents the public availability of the technology and not the de facto end of cybersecurity as we know it; that shift will be more gradual, said California State Transportation Agency Chief Cybersecurity Compliance Officer Tolgay Kizilelma.

“The past 20, 30 years, what we built to make sure we do what we do using the digital environment securely, safely, using the traditional cryptographic tools, methodologies — and just imagine that, not all overnight, but it's broken and no longer functions,” he explained.

One of the main threats posed by quantum computing is the ability to crush standard encryption methods. This means threat actors could harvest encrypted sensitive data now and decrypt it later.

Kyle pointed out that this dynamic will likely require organizations with sensitive data to use post-quantum encryption to secure their holdings indefinitely. The federal government, the National Institute of Standards and Technology specifically, has already released their encryption standards that organizations should be paying attention to before the technology becomes mainstream.

He urged organizations to implement, test and retest to make sure encryption and applications function.

The panel also pointed out that part of the challenge in securing organizational data is knowing where it is and where encryption is currently being used. Microsoft Field CISO Nathan Willigar noted that while the technology has changed, the fundamentals of protecting organizational data haven't.

"You really need to take a look at discovering, and take a look wherever your data is, your dependencies, your infrastructure, your network, and start doing an inventory,” Willigar said. “This is no different than anything else in asset management.”

“And then you're going to have to figure out what that migration is and prioritize. What is that greatest risk? What are your crown jewels that you're going to be looking at?” he added.

*The California Cybersecurity Education Summit was hosted by Government Technology, Industry Insider — California's sister publication.