Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Philip George, Executive Technical Strategist, InfoSec Global Federal
Around this time last year, the main takeaway regarding Post-Quantum Cryptography (PQC) was that organizations should begin preparations as soon as possible, in anticipation of NIST publishing its first set of PQC standards. These preparation activities focused on creating an integrated quantum planning and implementation team, and to complete inventory and discovery exercises so they have a complete map of cryptographic dependencies. Now, NIST has published its first set of encryption algorithms that can withstand attacks from a quantum computer, and these tools are ready for immediate use. Those who did not heed the advice from experts last year will find themselves behind the eight ball, as now the next phase of work should begin.
Starting Your PQC Migration Journey
A critical goal for all organizations in 2025 – whether government agencies or in the private sector – should be to understand how these three algorithms apply to different data sets and systems within their organization, and complete initial migrations and modernization efforts as appropriate. The three standards announced earlier this year are designed for two essential encryption tasks: general encryption, which is used to protect information exchanged across a public network; and digital signatures, which is used for identity authentication. Any teams that have not completed their inventory and mapping of cryptographic dependencies must do so quickly, so that they understand which new standard will work best for their various assets. This inventory is critical to creating detailed migration plans that prioritize the most sensitive and critical assets, ensuring they are first in line for upgrades to PQC standards.
Before any migration takes place, there are a few steps quantum planning and implementation teams need to take first, including ensuring that all new systems and software are compatible with these standards. Additionally, many organizations will find that their current systems are not modern and agile enough to meet the future cadence of change in standards and specific algorithms. In the era of PQC, encryption algorithms may only be viable for one to three years, as opposed to five to ten years as it is today. Security and IT teams need to ensure that agility is built into every aspect of their environment, from network devices to software and applications. This first migration to the three standards published by NIST will be a monumental task – there is no getting around that reality. But if teams plan properly and take the time now to build agility into their environment, they can ensure that each time new standards need to be adopted, it’s a much less burdensome task. For example, install remote management tools at each individual system today so you don’t have to revisit each individual system in the future. If done correctly, adopting each new set of algorithms – whether they come every three years or every 12 months – can be more of a plug-and-play experience.
Updating the Shared Responsibility Model to Account for Cryptographic Posture Management
On a related note, a key prediction I have for 2025 is that the cloud service providers (CSPs) who are able to adapt quickly to this new world reality of PQC standards will have an enormous leg up on the competition. This is because PQC will have a huge impact on how CSPs operate, and changes to common practices, policies and service level agreements (SLAs) are essential. Although this issue applies to all organizations, let’s look at the relationship with federal government customers in particular, since these groups will be the first required to adhere to the new guidelines regarding PQC standards. Imagine a government agency is conducting its assessments and mapping its cryptographic exposure and discovers an issue related to how its data is stored in a FedRAMP authorized public cloud. Who is responsible for this remediation?
Similarly, we have never before required from CSPs such granular and detailed information on the type of encryption in use, but customers (government and non-government customers alike) will require this level of detail to ensure their encryption standards are being met. The CSPs that figure out how to offer this detailed view securely and consistently to customers will be highly appealing to customers in both the public and private sector.
In the age of PQC, cloud service providers may introduce policies and procedures that some customers will find inadequate in terms of their cryptographic posture management. In that situation, what recourse does the customer have? Can they bring their own encryption? If so, how does the CSP allow for that enhanced protection mechanism without passing off a large portion of the cost to that one customer or raising all customers’ rates regardless of if they require higher standards? What we’re looking at essentially is an updated shared responsibility model, the terms of which will need to be hammered out in 2025 to ensure a smooth transition to PQC standards for all.
AI’s Role in Assessing and Creating New Quantum-Safe Algorithms
An immense amount of time, effort and checking and double-checking complex math went into creating the first three encryption algorithms published by NIST. Those involved in the project are eager to improve and expedite the process going forward. In an age when everyone is considering how AI can play a role in improving various processes, of course the question has come up for quantum-safe algorithms as well. However, there is a long way to go before this will be put into practice at any level. Checks and balances for AI must be determined before we can assume that AI has adequately tested a new algorithm, or has created an algorithm that is mathematically sound not just in theory but in practice as well. More discussion around this topic will take place in 2025 and likely some experimenting, but undoubtedly at some point in the future we will see AI take a more active role in developing and accessing new sets of quantum-safe algorithms.
##
ABOUT THE AUTHOR
Philip George has led federal initiatives in mitigating the post-quantum cryptographic (PQC) threat for national security systems, as well as supporting software code assessments and the establishment of verifiable software bill of materials artifacts. He continues this effort with InfoSec Global Federal to ensure other government agencies understand the need for cryptographic visualization and vulnerability management. He actively works with government PQC POCs, the NIST NCCOE, and their partners to promote the establishment of enforceable cryptographic policies that incorporate agility into zero trust modernization efforts.
