New research from ISACA’s global Quantum Computing Pulse Poll highlights a growing concern – the rapid rise of quantum computing poses a serious risk to cybersecurity and business stability, yet most enterprises remain unprepared. While 62 percent of technology and cybersecurity professionals fear that quantum computing could break current internet encryption standards, only five percent consider it a high priority in the near term, while five percent say their organizations have a defined strategy to address it.
More than 2,600 global professionals in digital trust, cybersecurity, IT audit, governance and risk were surveyed in this inaugural ISACA poll on the perceptions and preparations around quantum computing, which is believed will revolutionize global industry with its immense computational power and, more specifically, break the algorithms that secure nearly all online transactions, including digital signatures, web sites, utilities and medical records.
Quantum computing has revolutionary potential; however, there are also clear concerns about the risks it presents. Nearly half (48 percent) are very or somewhat optimistic about quantum computing’s impact in their sector/industry, 63 percent believe it will speed up computational tasks or data analysis significantly, and 46 percent say it will create revolutionary innovations.
However, many of the anticipated outcomes of quantum computing will require significant preparation. According to the survey, 63 percent of respondents believe quantum computing will increase or shift cybersecurity risks, while 57 percent say it will introduce new business risks. Further, 52 percent anticipate it will change the skills businesses need to succeed, and 50 percent expect it will pose new regulatory and compliance challenges.
Poll respondents (62 percent) are worried about quantum computing breaking today’s internet encryption before browsers and websites fully implement the new post-quantum cryptography algorithms approved by the National Institute of Standards and Technology (NIST). They are also focused on the potential for cybercriminals to start collecting encrypted data now and decrypt it once quantum computing becomes viable, with 56 percent citing the practice, known as ‘harvest now, decrypt later,’ as a concern.
“Many organizations underestimate the rapid advancement of quantum computing and its potential to break existing encryption,” said Jamie Norton, ISACA board director and partner, McGrathNicol. “They need to start examining whether they have the expertise to implement post-quantum cryptography solutions now, to ensure they are able to effectively mitigate its impacts.”
Rob Clyde, chairman, Crypto Quantique, and past ISACA board chair, notes that digital trust professionals should educate stakeholders about quantum computing risks and the urgent need for post-quantum solutions.
“Start by 1) identifying where encrypted data are stored and devices that use encryption, 2) developing a plan to transition to post-quantum cryptography prioritizing critical data and systems, and 3) continuously monitoring for updated software and firmware with post-quantum cryptography,” said Clyde, who is presenting on this topic at the ISACA North America Conference in May. “Waiting until quantum computing is here is too late, especially given today’s harvest-now, decrypt-later threat.”
Despite concerns about its potential impacts, it appears many organizations have not yet mobilized to prepare for these coming changes. Forty percent are not aware of their company’s plans, and 41 percent say they do not plan to address quantum computing at this time, even though 25 percent believe that the transformative potential of quantum computing will be realized on an industry-wide scale within the next five years, and 39 percent feel it will happen in six to 10 years.
When asked about how their organization views quantum computing within its current technology or innovation strategy, the survey detailed that 5 percent consider it a high priority for near-term planning, 15 percent say it is on their long-term roadmap but not a near-term priority, and 19 percent say they have discussed it but not made any formal plans. Additionally, 37 percent have not discussed quantum computing at all, and 24 percent don’t know.
Additionally, the ISACA poll disclosed that only seven percent of the poll respondents say they have a strong understanding of the new NIST standards, even though NIST has been working on them for more than 10 years. Forty-four percent admit they have never heard of them.
Clyde added in a blog post that there is much work to be done to prepare for what is often referred to as ‘Q-Day,’ the unknown date when quantum computers will be able to crack current internet encryption, and it needs to happen quickly.
“Organizations should work now to re-encrypt their data. If they don’t have the infrastructure to do that or have not properly inventoried which data needs to be encrypted, that is a major problem,” he added. “Another pressing challenge is upgrading IoT devices, which are harder to transition to post-quantum cryptographic algorithms. This can leave IoT systems that manage our sensors, cameras, factory devices, devices used by utility enterprises and more, in peril.”
Clyde added that “We also need to implement browsers and websites that support new NIST-approved algorithms for post-quantum cryptography. There are Federal Information Processing Standard (FIPS) standards available for both digital signatures and encryption that will implement cryptography that quantum computers will not break. We’re in a race to implement that across our browsers and websites and switch over to safe, post-quantum cryptography before quantum computers can break them.”
He further highlighted that the current technological issue that designers of quantum computers need to solve is not just scaling the size of the quantum computer but also improving the error rate. “Today the error rate is so high that we are still several years off from building a powerful enough quantum computer to break today’s encryption. The quantum computing industry is seeking a breakthrough to solve this error rate problem.”
In March, the NIST released a status report on the fourth round of its post-quantum cryptography standardization process that aims to establish cryptographic standards that can withstand the potential threats posed by quantum computers, which are expected to have the capability to break many of the cryptographic systems currently in use. The agency also detailed a new algorithm for post-quantum encryption called HQC, which will serve as a backup for ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism, the main algorithm for general encryption.
