Quantum Computing and Information Security: What Does This Mean for Financial Institutions?
Information security in the financial sector isn't getting any easier. Recently I read I an an article* from Bank for International Settlements (BIS) on Qquantum Computing and the financial sector. In this regard, the BIS warns of the scenario harvest now, decrypt later. Wait until quantum computers can crack everything is not an option—that is my argument. I’ve described below why that’s the case and what you can do right now:
Harvest Now
It literally means: “Collect now, decrypt later.” It’s a pretty scary idea that cybercriminals are already collecting data so they can crack financial and privacy-sensitive information as soon as quantum technology becomes available for that purpose. It happens behind the scenes, without being visible, and can suddenly manifest itself. The combination of large-scale AI-driven attacks, following a successful hack using quantum technology, doesn’t put my mind at ease.
Using current data
An attack in the future
Consider, for example, a bank that today sends sensitive information about a customer, a major corporate acquisition, or a financial transaction in encrypted form. An attacker can already intercept and store that data, even if they cannot read it at this time. If quantum computers become powerful enough in the future to break certain current forms of encryption, that same attacker could still decrypt the stored data. Information that seems well-protected today could then end up in the public domain after all.
Know what you need to protect
Don’t wait until quantum computers are powerful enough. The BIS is also clear on this point: the transition to quantum-secure protection must begin today. A first step, therefore, is to identify what sensitive information your organization stores, which data must remain confidential over the long term, and where cryptography is used within the organization. Cryptography, by the way, is the technique used to encrypt and secure information so that only authorized individuals or systems can read or use it.
Show where you're vulnerable
Next, it is important to identify which systems and applications rely on current forms of encryption. The BIS describes such a cryptographic inventory as a key foundation for the transition to quantum-secure protection. So it doesn’t start immediately with replacing systems, but with asking the right questions: Where is our sensitive information located, how is it protected, and how long must that protection last?
Don't wait for the quantum computer
After that, you can work toward so-called post-quantum cryptography step by step: new cryptographic techniques developed to withstand attacks from powerful quantum computers. The BIS emphasizes that this is not simply a matter of replacing a single algorithm. A phased approach, in which organizations start with the most critical systems and sensitive information, is more appropriate. Testing new solutions is also important.
Make sure you can keep moving
Perhaps the most important thing is to ensure that cryptography can be replaced relatively easily in the future. The BIS refers to this as “cryptographic agility”: the ability to adapt when new security standards or threats require it. This prevents an organization from facing a massive technical undertaking in a few years’ time. Thinking about that flexibility now can save a lot of time and reduce risk later on. In this context, the following question is sometimes important to consider:
Just how agile are the systems we rely on today?
Many financial organizations still rely on legacy systems that have been expanded and modified over the years. How easy will it be to implement new cryptography in those systems down the road? If a security mechanism is deeply intertwined with old software, interfaces, or infrastructure, replacing it can be much more complex than initially anticipated. That is precisely why it is wise to identify now where such dependencies exist in systems that are difficult to adapt.
The threat won't wait for technology
Quantum readiness is therefore not just about when the first powerful quantum computer will be available. It’s primarily about whether your organization will be ready by that time to continue effectively protecting its information. As the BIS aptly puts it: the risks of quantum computing are “more imminent than their development horizon.” I interpret that roughly as follows: the quantum computer may still be a long way off, but the risks associated with it certainly are not. The technology may still be under development, but the data being collected today certainly can’t wait for the future.
You can get started today without waiting for a powerful quantum computer to become available. First, make sure you know what information you need to protect, where that information is located, what cryptography is being used, and who or what has access. Next, identify which systems rely on cryptography that will need to be replaced in the future. By gaining insight now and taking cryptographic agility—the ability to replace cryptography relatively easily—into account, you can prevent a future transition from becoming an uncontrolled technical operation.
It starts with a cryptographic assessment. This involves identifying where cryptography is used within your organization—for example, in databases, applications, connections, certificates, and data exchange. Next, you determine which information must remain confidential over the long term and which systems are difficult to modify. Without such an overview, it is difficult to determine where to begin with quantum readiness.
You don’t have to replace all existing encryption right away. The first step is to gain an understanding of where and how you use cryptography. Therefore, identify what sensitive information your organization processes, which systems depend on it, and which cryptographic techniques are being used. Then you can determine which systems are a priority and where a transition to post-quantum cryptography (PQC) is necessary. NIST has now established several standards for post-quantum cryptography. If you’d like to learn more about this, please consult this NIST resource.
"Harvest now, decrypt later" means that an attacker intercepts and stores encrypted information today with the intention of possibly decrypting it in the future. Therefore, the information does not need to be crackable today. The risk arises when quantum computers eventually become powerful enough to break the cryptography used. This makes data with a long confidentiality period particularly relevant—but also particularly vulnerable.
In the future, quantum computing could pose a threat to some of the cryptographic methods currently used to protect financial information. Certain public-key cryptographic techniques, in particular, could become vulnerable once quantum computers are powerful enough. This poses an additional challenge for financial organizations because sensitive data often must remain confidential for many years.
Want to start a conversation?
Taking a proactive approach to information security, data quality, cybersecurity, authorization, and compliance has been our hallmark for many years. Please contact us if you’d like to discuss this further.