Secure Procurement Strategies for Quantum-Safe Technology

Quantum computing is advancing rapidly, bringing unprecedented processing power that threatens traditional encryption methods. The "collect now, decrypt later" strategy underscores the urgency of preparation, adversaries are already harvesting encrypted data with the intent to decrypt it once large-scale quantum computers become viable. Fortinet is leading the way in quantum-safe security, integrating NIST PQC algorithms, including CRYSTALS-KYBER, into FortiOS to safeguard data from future quantum-based attacks. "A recent real-world demonstration by JPMorgan Chase (JPMC) showcased quantum-safe high-speed 100 Gbps site-to-site IPsec tunnels secured using QKD. The test was conducted between two JPMC data centers in Singapore, covering over 46 km of telecom fiber, and achieved 45 days of continuous operation." "The network leveraged QKD vendor ID Quantique for the quantum key exchange, Fortinet’s FortiGate 4201F for network encryption, and FortiTester for performance measurement." This is not just a theoretical concern, organizations are already deploying quantum-safe encryption solutions. As quantum computing capabilities advance, organizations must adopt quantum-resistant security architectures and take proactive steps now to safeguard their sensitive information against future quantum-enabled attacks. These proactive methods include: -adopting hybrid cryptographic approaches, combining classical and PQC algorithms, ensuring interoperability and a phased transition -implementing crypto-agile architectures, for seamless updates to encryption mechanisms as new quantum-resistant standards emerge -leveraging PQC capable HSMs and TPMs -evaluating network security architectures, such as ZTNA models -ensuring authentication and access controls are resistant to quantum threats. -identifying mission-critical and long-lived data, that must remain secure for decades. -implementing sensitivity-based classification, determine which datasets require the highest level of post-quantum protection. -conducting risk assessments to evaluate data exposure, storage locations, and current encryption standards. -transitioning to quantum-resistant encryption algorithms recommended by NIST’s PQC standardization efforts. -establishing data-at-rest and data-in-transit encryption policies, mandate use of PQC algorithms as they become available. -strengthening key management practices -developing GRC frameworks ensuring adherence to post-quantum security. -implementing continuous cryptographic monitoring to detect and phase out vulnerable encryption methods. -enforcing regulatory compliance by aligning with emerging PQC standards. -establishing incident response plans to handle quantum-driven cryptographic threats proactively. Fortinet remains committed to pioneering quantum-safe encryption solutions, enabling organizations to stay ahead of emerging cryptographic threats. Read more from Dr. Carl Windsor, Fortinet’s CISO!

🛡️ The Quantum Clock is Ticking quietly: Is Your Financial Infrastructure Ready? The financial industry is built on a foundation of digital trust, currently secured by #cryptographic standards like RSA and ECC. However, the rise of Cryptographically Relevant Quantum Computers (CRQC) poses an existential threat to this foundation. As we navigate this transition, here are 3 key pillars from the latest Mastercard R&D white paper that every financial leader must prioritize: 1. Addressing the 'Harvest Now, Decrypt Later' (HNDL) Threat 📥 Malicious actors are already intercepting and storing sensitive #encrypted data today, intending to decrypt it once powerful quantum computers are available. Financial Use Case: Protecting long-term assets such as credit histories, investment records, and loan documents. Unlike transient transaction data (which uses dynamic cryptograms), this "shelf-life" data requires immediate risk analysis and the adoption of quantum-safe encryption for back-end systems. 2. Quantum Resource Estimation & The 10-Year Horizon ⏳ While a CRQC capable of breaking RSA-2048 in hours might be 10 to 20 years away, the migration process itself will take years. Financial Use Case: Developing Agile Cryptography Plans. Financial institutions should set "action alarms" for instance, once a quantum computer reaches 10,000 qubits, a pre-prepared 10-year migration plan must be triggered to ensure infrastructure is updated before the "meteor strike" occurs. 3. Hybrid Implementations: The Bridge to Security 🌉 The transition won't happen overnight. The paper highlights the importance of Hybrid Key Encapsulation Mechanisms (KEM), which combine classical security with PQC. Financial Use Case: Enhancing TLS 1.3 and OpenSSL 3.5 protocols. By implementing hybrid models now, banks can protect against current quantum threats (like HNDL) while maintaining compatibility with existing classical systems, ensuring a smooth and safe transition. The Bottom Line: A reactive approach is no longer an option. Early adopters who evaluate their data's "time value" and begin the migration today will be the ones to maintain resilience and protect global financial assets tomorrow. #QuantumComputing #PostQuantumCryptography #FinTech #CyberSecurity #DigitalTrust #MastercardResearch

🚨 NEW PEER-REVIEWED RESEARCH: PQC Migration Timelines Excited to share my latest paper published in MDPI Computers: "Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks." The transition to Post-Quantum Cryptography (PQC) represents a watershed moment in the history of our digital civilization. Organizations planning for a 3-5 year "upgrade" will fail. The reality is a 10-15-year systemic transformation. Key Contributions: 📊 Realistic Timeline Estimates by Enterprise Size: Small (≤500 employees): 5-7 years Medium (500-5K): 8-12 years Large (>5K): 12-15+ years ⚠️ Critical Finding: With FTQC expected 2028-2033, large enterprises face a 3-5 year vulnerability window—migration may not complete before quantum computers break RSA/ECC. 🔬 Novel Framework Analysis: Causal dependency mapping (HSM certification, partner coordination as critical paths) "Zombie algorithm" maintenance overhead quantified (20-40%) Zero Trust Architecture implications for PQC 💡 Practical Guidance: Crypto-agility frameworks and phased migration strategies for immediate action. Strategic Recommendations for Leadership: 1. Prioritize by Data Value, Not System Criticality: Invert the traditional triage model. Systems protecting long-lived data (IP, PII, Secrets) must migrate first, regardless of their operational uptime criticality, to mitigate SNDL. 2. Fund the "Invisible" Infrastructure: Budget immediately for the expansion of PKI repositories, bandwidth upgrades, and HSM replacements. These are long-lead items that cannot be rushed. 3. Establish a Crypto-Competency Center: Do not rely solely on generalist security staff. Invest in specialized training or retain dedicated PQC counsel to navigate the mathematical and implementation nuances. The talent shortage will only worsen. 4. Demand Vendor Roadmaps: Contractual language must shift. Procurement should require vendors to provide binding roadmaps for PQC support. "We are working on it" is no longer an acceptable answer for critical supply chain partners. 5. Embrace Hybridity: Accept that the future is hybrid. Design architectures that can support dual-stack cryptography indefinitely, viewing it not as a temporary bridge but as a long-term operational state. 6. Implement Automated Discovery: You cannot migrate what you cannot see. Deploy automated cryptographic discovery tools to continuously map the cryptographic posture of the estate, identifying shadow IT and legacy instances that manual surveys miss. The quantum clock is ticking. Start planning NOW. https://lnkd.in/eHZBD-5Y 📄 DOI: https://lnkd.in/ejA9YpsG #PostQuantumCryptography #Cybersecurity #QuantumComputing #PQC #InfoSec #NIST #CryptoAgility

Quantum computing is moving from "science fiction" to "business reality" faster than most predicted. Two recent papers have fundamentally shifted the timeline for when we need to care about Quantum-Safe security: 1️⃣ The "10,000 Qubits" Milestone: New research shows that we can execute Shor’s algorithm—the math that breaks today’s encryption—with far fewer resources than previously thought. By using reconfigurable atomic qubits, the hardware requirements for cracking RSA-2048 have dropped by nearly 20x. 2️⃣ The "9-Minute" Crypto Warning: Google’s latest whitepaper highlights a terrifying reality for digital assets. Under advanced quantum scenarios, the encryption protecting a cryptocurrency wallet could be cracked in under 10 minutes. This puts billions in "dormant" assets at immediate risk of "at-rest" attacks. The Bottom Line: The "Q-Day" window is shrinking. It’s no longer about if a quantum computer can break your encryption, but when your current migration timeline will run out. How do we respond? We can't just flip a switch on "Q-Day." For many organizations, becoming quantum safe is a multi-year journey. This is where Palo Alto Networks Quantum-Safe Security comes in. Instead of a manual, multi-year overhaul, we provide a path to Agentic Resilience: - Continuous Discovery: It automatically maps your "cryptographic bill of materials" (CBOM), identifying exactly where vulnerable RSA and ECC algorithms are hiding in your network. - Risk Prioritization: It correlates your encryption strength with business criticality, telling you exactly which high-value assets need to move to Post-Quantum Cryptography (PQC) first. - Real-Time Remediation: For legacy systems that can’t be easily upgraded, a "Quantum-Safe Proxy" re-encrypts vulnerable traffic into post-quantum algorithms (like ML-KEM) at the network edge. The transition to a quantum-safe future is a marathon, but the starting gun has already fired. Learn how to take your first steps at the link in the comments.

🔐Europol PRIORITISING POST-QUANTUM CRYPTOGRAPHY MIGRATION ACTIVITIES IN FINANCIAL SERVICES ⚛️As post-quantum cryptography (PQC) becomes integrated into mainstream information technology (IT) products and services, financial services institutions must begin to execute their transition strategies. This document provides actionable guidelines to incorporate quantum safety into existing risk management frameworks by assessing the ‘Migration Priority’ based on the ‘Quantum Risk’ and ‘Migration Time’ of business use cases and highlighting opportunities for immediate execution. ⚛️A critical first step is to inventory all business use cases that rely on public key cryptography. This inventory enables the creation of a prioritised transition roadmap by assessing the Quantum Risk of each use case based on three parameters: 🟣 Shelf Life of Protected Data: How long the data remains sensitive. 🟣 Exposure: The extent to which data is accessible to potential attackers. 🟣 Severity: The business impact of a potential compromise. ⚛️When the Quantum Risk is assessed, organisations can prioritise actions based on each use case’s Migration Time, i.e., the complexity and timeline required to achieve Quantum Safety for a use case. As part of this activity, organisations will identify, for instance, actions that can be launched immediately and the use cases that require coordination with long-term asset lifecycles. 🟣 Solution Availability: Maturity of PQC standards, and their general availability in products and services. 🟣Execution Cost: The effort, cost, and complexity of implementing the quantum-safe solutions within the organisation. 🟣 External Dependencies: Execution complexity due to coordination required with third parties and their transition roadmaps (standardisation bodies, vendors, peers, regulators, and customers). ⚛️Examples of use cases that financial organisations can begin implementing today include: 🟣 Integration of post-quantum requirements into the long-term roadmap for hardware-intensive use cases aligned with financial asset lifecycles. 🟣 Enhancement of confidentiality protection for transactional websites. 🟣Identification and elimination of cryptographic antipatterns to reduce future technical debt. ⚛️These are examples of how financial institutions can take timely, structured steps toward an efficient and forward-looking transition to post-quantum cryptography. https://lnkd.in/d4qiS6X9

By 2035, quantum computers could break today’s RSA/ECC, threatening everything from over-the-air updates to payments, V2X, charging, telematics, and dealer systems. And “harvest-now, decrypt-later” means data we encrypt today may be readable tomorrow. Thankfully, there’s a path forward with Post-Quantum Cryptography (PQC). So here's what we’re doing (and what I recommend): 1️⃣ Prioritize what matters: Classify apps/data by sensitivity & lifespan (vehicles, keys, firmware, contracts). Tackle the critical 10% first. 2️⃣ Start pilots now: Stand up PQC for key exchange and signatures (NIST picks: CRYSTALS-Kyber, Dilithium, plus FALCON/SPHINCS+ where appropriate). Wrap legacy with interim controls where upgrades aren’t yet feasible. 3️⃣ Engineer for the edge/IoT: Plan for constrained ECUs and long service lives; align PQC with model year cycles and sunset plans to avoid hardware rip-and-replace. 4️⃣ Educate & govern: A cross-functional council (CISO, engineering, legal, procurement) to drive roadmap, metrics, and auditability. Quantum risk isn’t a future storm; it’s a countdown. Organizations that move now will secure their platforms and earn customer trust in the next digital economy. #Cybersecurity #PQC #RiskManagement 📸: BCG

By 2029, the encryption protecting India's banks, hospitals, power grid, and defence networks may no longer work. We have 36 months. And we are still debating algorithms when we should be writing policy. India has a Quantum Mission. India does not yet have a Quantum Policy. Here is what that policy must contain — in six moves, not sixty: → A National Quantum Security Directive under Section 70B of the IT Act — giving CERT-In and NCIIPC statutory teeth. → Sectoral PQC mandates from RBI, SEBI, IRDAI, TRAI, CEA, and NHA. One directive each. This fiscal year. → "No New Classical-Only" procurement, codified in the General Financial Rules and flagged on GeM. Every rupee earns a Cryptographic Bill of Materials. → DPDP rules protecting long-life data — Aadhaar, UPI, ABDM — with hard re-encryption timelines by 2028. → A National QKD Backbone anchored by C-DoT fiber and ISRO satellites. The 1,000 km milestone is the floor, not the ceiling. → A Quantum Security Coordinator in the PMO — because ownership is the single biggest gap today. A roadmap is not a regulation. A laboratory is not a standard. A mission is not a market. Adversaries are already running Harvest-Now-Decrypt-Later against critical infrastructure in India. Every day without a statutory quantum-safe policy is another day of encrypted Indian data being archived for the year the quantum era arrives. Ministries. Regulators. CISOs. Where does your cryptographic inventory stand? #QuantumPolicy #QDay2029 #PostQuantum #CyberSecurity #DigitalIndia #WDC

Quantum computing will shred RSA and ECC like tissue paper, yet many are still treating the migration to Post-Quantum Cryptography as a "later" problem. ⬇️ On August 13, 2024, NIST finalized the first three PQC standards, signaling that the era of "Harvest Now, Decrypt Later" has met its match. Whether you are managing service account sprawl or securing cloud ecosystems, these standards are ready for immediate use to prevent your digital keys from shattering. The New Standards Framework NIST has provided three primary tools to secure our infrastructure against quantum threats: ➡️ FIPS 203 (ML-KEM): Derived from CRYSTALS-Kyber, this is the primary standard for general encryption. It is built for speed and uses small encryption keys that are easy to exchange. ➡️ FIPS 204 (ML-DSA): Based on CRYSTALS-Dilithium, this serves as the primary standard for digital signatures. ➡️ FIPS 205 (SLH-DSA): Utilizing the Sphincs+ algorithm, this acts as a stateless hash-based backup for digital signatures in case lattice-based methods prove vulnerable. A Practical Migration Path Migrating isn't just a technical swap; it's a strategic shift toward "antifragile" identity. You can begin strengthening your enterprise posture today by following these steps: ✔️ Inventory Your Endpoints: Identify where legacy RSA and ECC are buried in your stack. ✔️ Test in Hybrid Mode: Use a combination of classical and PQC algorithms to ensure stability. ✔️ Update Your Stack: Leverage tools like liboqs or OpenQuantumSafe to update your TLS 1.3 implementations. We often delay security updates because we fear downtime or "friction," but quantum doesn't negotiate. Adopting these standards now is how we stay one step ahead of state actors and safeguard the future of our data.

IS YOUR ENTERPRISE READY FOR "Q-DAY"? "Q-day" (or Quantum Day) is the point in time when quantum computers become powerful enough to break the public-key encryption (like RSA or ECC) that currently secures global digital, financial, and government infrastructure. Our current best estimates is that Q-Day will happen by 2029! Huge thanks to Dr. Rob Campbell, FBBA. , IBM Global Quantum-Safe Executive and IBM Quantum Ambassador, for guest lecturing to our University of Arkansas ­- Sam M. Walton College of Business EMBA students. His insights into the "Quantum-Safe" transition provided a crucial roadmap for how leadership must navigate the next few years of cybersecurity. Here's what we learned: Adversaries are currently collecting encrypted data to store and decrypt once quantum computers are powerful enough to calculate private keys—a strategy known as "Harvest now, decrypt Later". Because enterprise cryptographic migrations can take 5 to 15+ years, many large organizations will still be in transition when quantum computers become capable of breaking current encryption. What enterprises can do NOW: Dr. Campbell emphasized that Post-Quantum Cryptography (PQC) is a leadership issue, not just a technical one. To preserve trust and resilience, leaders should authorize these "low-regret" actions immediately: - Inventory cryptographic dependencies: identify what you have before you plan what to change. - Prioritize high-value data: Focus on data with the longest confidentiality horizons, not just the most "critical" systems. - Invest in crypto-agility: Design systems for the permanent ability to swap algorithms without rebuilding the entire architecture. - Pilot PQC today in non-mission critical systems: PQC standards were finalized by NIST in 2024 and are ready for deployment on classical computers now. Enterprises can learn in these lower risk systems. - Communicate metrics to boards in non-technical jargon. Dr. Campbell noted, the question is whether we manage this change deliberately now or inherit it under pressure later. He stressed the importance of wide-spread education. To that end, Professor Daniel Conway will be offering the Walton College's first Quantum Computing class this fall! Adam Stoverink, Ph.D.; Shaila Miranda; Brian Fugate; Brent D. Williams; James Allen Regenor, Col USAF(ret) #QuantumSafe #PQC #CyberSecurity #Leadership #EMBA #DigitalTransformation #RiskManagement

📌The financial sector has now moved from quantum awareness to quantum execution. Europol , FS-ISAC , and the Quantum Safe Financial Forum (QSFF), together with major financial institutions, published: “Prioritising Post-Quantum Cryptography Migration Activities in Financial Services” ; a practical migration framework designed specifically for financial institutions. What makes this report particularly relevant for #boards, #regulators, and #CISOs? It introduces a structured prioritisation methodology based on two measurable dimensions: 1️⃣ Quantum Risk Score Derived from: • Shelf life of protected data • Exposure • Severity of compromise 2️⃣ Migration Time Score Derived from: • Solution availability • Execution cost and time • External dependencies Migration Priority is determined by combining both scores into a risk–time matrix (see pages 8–10) of the Report below ⬇️ . ♨️ This shifts the conversation from “When will Q-Day happen?” to “Which business use cases require action now, and which require long-term orchestration?” Two examples in the report illustrate this distinction: 🔹 Points of Sale (#PoS) Medium quantum risk but high migration complexity due to hardware lifecycles, ecosystem coordination, and standardisation uncertainty (pages 12–15) . ⛔️Early planning is essential to avoid costly out-of-cycle replacements. 🔹 Public Websites (#TLS_confidentiality) Medium quantum risk but low migration time due to hybrid schemes such as X25519MLKEM768 already supported by major browsers and CDNs (pages 16–19) . ⛔️This is one of the earliest practical deployment opportunities for quantum-safe protection in production environments. Another important contribution of the report is its focus on cryptographic antipatterns (pages 21–24) . Before large-scale PQC migration, institutions can implement no-regret actions: • Automate TLS certificate lifecycle management • Standardise TLS configurations (TLS 1.3 baseline) • Eliminate legacy cipher dependencies • Remove hard-coded credentials • Strengthen key management governance This approach aligns closely with supervisory expectations: #quantum_readiness must integrate into existing risk frameworks, asset lifecycle planning, and vendor coordination. For financial institutions, the message is clear: ❌Quantum safety is not a single migration event. ❌It is a prioritised, staged governance programme that integrates cryptography, procurement, architecture, and regulatory alignment. Full publication: Europol (2026), Prioritising Post-Quantum Cryptography Migration Activities in Financial Services Available via Europol Publications Office: https://lnkd.in/d2bgsVKm #PostQuantumCryptography #PQC #QuantumRisk #FinancialServices #CybersecurityGovernance #DigitalResilience #CryptoAgility #QuantumTransition #FinancialStability