Yet this is no time to panic, nor to procrastinate. The reasons to prepare now are simple and familiar.

In this article, we explain why acting on post-quantum cryptography today is essential: to comply with regulatory standards, to anticipate critical risks to systems and data, and to keep the cost of an inevitable migration under control. We also show how to lay the groundwork now for a successful transition, turning a complex challenge into a structured, well-managed effort.

A transition driven first and foremost by compliance

One of the major shifts in the post-quantum cryptography discussion is that the debate is no longer purely technological. For a long time, the central question was: when will a quantum computer capable of breaking today’s cryptography exist? Uncertainty about that date, known as Q-Day, has often served as a justification for postponing transition efforts.

That position is becoming increasingly untenable. Since 2024, the standards landscape has begun to stabilize. The National Institute of Standards and Technology (NIST) has published the first post-quantum algorithm standards, intended to replace the primitives in widely use today, notably RSA and elliptic-curve-based algorithms.

More importantly, these standards now come with a timeline. NIST has announced its intention to deprecate some current algorithms in 2030, and to disallow their use in most contexts by 2035. The European Union and the United Kingdom are broadly following the same trajectory, driven in particular by the European Commission and the UK’s NCSC. There are nuances, however: certain regulated sectors, such as defense and critical infrastructure, are subject to specific requirements that may partly diverge from this general framework. The deadline is therefore regulatory, to be read in light of each context, and organizations will have to migrate because their cryptographic mechanisms will simply no longer be considered compliant.

This shift brings the post-quantum challenge closer to other major transformations in cybersecurity. Much like patch or vulnerability management, what was once a one-off technical topic is gradually becoming standard operational practice. The cryptographic transition should therefore be viewed not as an exceptional project, but as a normal part of managing the cryptographic security lifecycle.

A critical risk despite uncertain likelihood

Progress in quantum computing, both theoretical and physical, has been significant, including a reduction of more than 95% between 2019 and 2026 in the estimated number of qubits needed to break RSA-2048. Even so, the probability of Q-Day occurring by any given date remains uncertain. What characterizes this risk above all is its considerable impact. A sufficiently powerful quantum computer would not compromise just one algorithm among many: it would undermine the very foundations on which digital trust rests. Authentication, electronic signatures, secure communications, key distribution: these are the mechanisms that silently underpin every digital exchange. It is this systemic reach that sets the quantum threat apart from an ordinary vulnerability.

Once the technological breakthrough has happened, it will be too late. The window for action is now.

Exposure that may already exist today

Tackling the problem now is all the more important because some organizations are already exposed to certain risks stemming from quantum computing.

The first is “harvest now, decrypt later” (HNDL): the idea that malicious actors could collect encrypted communications today to decrypt them later, once a quantum computer becomes available. This risk is real and must be assessed, particularly for data with long confidentiality lifetimes. It does not, however, necessarily warrant an alarmist approach: not all data needs to remain secret for decades, and actual exposure depends heavily on use cases and on the organization’s threat model.

A second scenario, often less discussed but potentially even more far-reaching, concerns digital signatures. The issue lies first and foremost with trust anchors: the certificate authorities that sign smart-card identity documents, those that will underpin European digital identity wallets, enterprise PKIs, and product PKIs used for code and firmware signing. Compromising one of these roots would not amount to an isolated forgery: it would make it possible to issue identities, certificates or software updates recognized as legitimate by every system that trusts that anchor. These are also the hardest assets to migrate due to their lifetimes of ten to twenty years, their massive deployment in equipments that cannot be updated remotely, and their ecosystems standardized at international level.

The same mechanism weakens signed documents downstream. Many legal and financial tools (commercial contracts, loans, regulatory agreements) rely on signatures whose validity must be guaranteed over long periods. They could be forged, and the evidential value of signatures already applied would be called into question if timestamping or countersigning had not been carried out in time.

Above all, such a situation would require a renewal effort of unprecedented scale. For the trust-anchor use case, generating new post-quantum roots would not be enough: they would have to be distributed to every trust store already deployed, the certificate chains that depend on them reissued and, for non-updatable devices, physical replacement awaited. For the document use case, organizations would have to re-sign or re-timestamp a considerable volume of archives to preserve their legal value. In document-intensive sectors such as finance, insurance and law, where retention periods can extend to several decades, the scale of this operation would be far from negligible.

The real cost of procrastination

The third reason to act quickly is economic. The transition to post-quantum cryptography is a large-scale undertaking spanning several years, if not more than a decade.

Delaying the start of the program does not eliminate the effort: it simply compresses the timeline, which inevitably drives up costs. A rushed migration typically leads to:

• Greater dependence on vendor solutions,
• Less optimal technology choices,
• Urgent and costly mobilization of teams.

Conversely, an early program makes it possible to spread investment over time and to integrate new mechanisms progressively into the normal evolution cycles of systems. Boston Consulting Group, for instance, estimates that organizations could see migration costs double if the migration is not sufficiently anticipated.

“No-regret” work

Much of the work to be undertaken also falls under so-called “no-regret” measures: actions that improve cyber posture regardless of when a quantum computer actually arrives.

These initiatives in fact converge on a single goal: crypto-agility, meaning the ability to change the algorithms, protocols and keys in use without having to rebuild the systems that depend on them. Inventories, controlled key management, documentation of usage, isolation of cryptographic components within architectures: these are the building blocks of that capability. And that capability has value in its own right, independent of the quantum threat. Cryptographic standards evolve, algorithms once considered secure are sometimes weakened and then retired, and the post-quantum transition itself will happen in stages, with hybrid schemes at first and adjustments as agencies and standard bodies publish new guidance. For an organization that has built this agility, each of these changes becomes routine rather than a migration project to be relaunched.

Building this agility requires first gaining clear visibility: where cryptography is used, which flows and data it protects, and which components it relies on. This visibility quickly extends beyond the cryptographic scope alone. It feeds directly into data protection programs and data-flow mapping exercises, which rest on the same questions. It also surfaces the cryptographic vulnerabilities scattered across the information system (obsolete protocols and algorithms, unmaintained libraries or vulnerable versions) and provides an opportunity to fix them.

The same logic applies to Third-Party Risk Management. By identifying cryptographic dependencies in software, infrastructure and Cloud services, a PQC (Post Quantum Cryptography) program sheds light on technology dependencies that are sometimes poorly documented and enables a more structured dialogue with suppliers about their roadmaps.

In short, risk governance as a whole comes out stronger.

Laying the foundations of a program

Calls to action are not in short supply, from the G7’s recent publication to Google and various government bodies, yet operational implementation often remains unclear.

A PQC program cannot be launched without an executive sponsor: it is a major IT transformation. Beyond the budget and resources to be committed over several years, its success depends above all on the organization’s ability to mobilize stakeholders who do not necessarily work together: bringing teams into alignment, securing commitments from suppliers, and getting PQC requirements built into projects already under way. On top of this, throughout the program, there are recurring trade-offs between the level of risk the organization is willing to accept and the investment needed to reduce it. Given their scope and consequences, these decisions belong to senior management.

Once that mandate is secured, the question remains of where concretely to begin. Large organizations do not all start from the same point. Some already have partial inventories or formalized cryptographic policies; others have not yet established data classification categories. For most, it starts with launching a structured program whose immediate objective is not to migrate, but to create the conditions for migration.

The key to this approach is working top-down. Rather than starting by listing every key and certificate in the information system, an exercise that is often lengthy and not very actionable, the idea is to start from the most critical business processes and work back to the cryptographic mechanisms underpinning them: inventorying the cryptography that will need to be migrated, not all the cryptography that exists. This approach makes it possible to prioritize from the outset, assess the real impact of a compromise, and focus resources where the risk is highest.

On this basis, the structuring actions follow naturally: mapping of usage, integration into configuration management repositories, identification of third-party dependencies, and upskilling of teams.

The question is no longer if or when, but how

The transition to post-quantum cryptography is neither optional nor distant. Regulatory deadlines are becoming clearer, some risks are already present, and the scale of the effort is such that a late start will inevitably come at a price: in cost, in haste, or in exposure.

The good news: much of the work to be undertaken today is useful whatever happens. Knowing your cryptographic assets better, understanding which business processes they protect, and reducing poorly documented dependencies are structural improvements that strengthen overall security, independent of any quantum timeline.

The question, then, is not whether to act, but how to structure this transition so that it fits naturally into existing evolution cycles, rather than one day imposing itself as a poorly prepared emergency.

Cet article Post-Quantum Cryptography: The Deadline Is Becoming Regulatory est apparu en premier sur RiskInsight.

After having successfully mobilized its executive committee on cybersecurity, having made a realistic and concrete assessment of the situation, you had an agreement in principle to start a remediation program!

A great victory, and the beginning of a multi-year adventure!

Defining ambitions and framing governance

The cybersecurity assessment and its benchmark have enabled us to position the organization’s current level of security. What remains now is to define the target to be reached and the means necessary to achieve it. This involves working with the cybersecurity teams, the IT department and of course the executive committee sponsor! The target can take many forms, but it must in any case respond to clear and concrete business challenges:

“To have an above-average level of security overall to avoid the most frequent attacks”, “To protect the data of large public customers”, “To ensure the resumption of factory production in less than 4 days in the event of a cyber attack”, or for more mature structures “To rationalize cyber investments by saving 20% for the same level of risk”, these are just a few examples of ambitions encountered in the field.

It is at the time of this target definition that we can adopt a risk-based approach, for example with different targets between businesses or entities; a regulatory approach with different levels depending on business constraints or a global approach.

Each target will be the subject of performance or risk indicators (KPI/KRI) to specify how progress will be measured. These ambitions are then translated into a concrete positioning on a cybersecurity benchmark, by theme and by scope. The easiest way to do this is to use the results of the previous benchmark, but it is possible to use another benchmark. Be careful, however, it will be used throughout the program to monitor progress and guide the various teams and entities, so plan on a lifespan of at least 2 years! The definition of the repository and the indicators is a key step in the success of the program, so plan to devote time to it. It is best not to immediately launch a whole series of technical projects without the necessary consistency.

To manage this program, the CISO must know how to surround themselves with people. The IS (Information Security) departments rarely have the experience to carry out such a transformation and budgetary requirements at this level. A good practice is to identify an experienced program director within the organization, who is used to the workings of the organization, and who can work closely with the CISO. The skills of the two profiles will naturally complement each other, on the one hand with security expertise, and on the other with large-scale management expertise. The choice of the binomial is also an important key factor of success, do not hesitate to spend time on it!

Build budgets on clear axes and know how to commit expenses

Once the agreement in principle has been received, the next step is to clearly structure the budgetary commitment. Once again, the major challenge in the relationship with the executive committee will be to make a clear and precise proposal: Acronyms, project codes and other abstruse terms should be avoided. The structure of a simple strategy; “Protecting the digital work environment”, “Encrypting and avoiding critical data leaks”, “Detecting attacks on our key assets” are some examples of terms used successfully.

The structuring of a program should be kept to around 4 or 5 axes and to group about 30 projects  maximum is something to keep in mind. Beyond that, reporting and monitoring will become too complex.

It should be noted that it will be necessary to break with the budgetary exercise obviously on the construction actions (“build”) but also on the additional operating costs (“run”) without that, the beautiful remediation will not last long… The identification also of the HR elements (number of recruitments/mobilities, trainings to be envisaged, salary evolution, evolution of the hierarchical relations in the entities or the subsidiaries…) are key elements to be created in the program to ensure its durability in time. This is clearly the right time to create a real cyber department within the organization and have it managed by a “Chief Operating Officer” like any other major department.

The preparation of these different budgetary elements will also have to consider the difficulty observed for several years now to commit the budgets obtained. The market is in dire need of cyber expertise and many projects have to be postponed. It is a good idea to take some leeway in the planning process to consider this situation, which will continue. The classic program timeline of, year 1 scoping, year 2 implementation, year 3 control, should be reviewed and instead be based on waves of smaller projects that are initiated as they come along. In short, it is better to have 5 waves of 5 projects that come to fruition than to launch 25 scopes simultaneously!

It should also be noted that these budgets and priorities will have to be reviewed annually, as the cyber threat is very dynamic, it is important to keep flexible budget lines to adapt to an unprecedented evolution of threats – as we have experienced in recent years.

Show progress to the executive committee!

Once the program has been launched, the challenge will be to show the executive committee the progress and the effects on risk levels. On a quarterly or even a semi-annual basis there are key points that need to be established: clear reporting, using simple terms that are linked to the reference system used, adding a vision on the progress of the projects and the progression of the risk level.To directly demonstrate the transition to regular reporting mode, it may be useful to add operational indicators linked to the level of security. In the long term, the challenge is to maintain an exchange with the executive committee at least every six months in order to maintain the level of attention on the cyber subject. These long-term exchanges can be structured around two annual meetings, one on risks (evolution of the threat and risks weighing on the organization), the other on investments (effects of projects, budgetary and HR issues for the following year).

Finally, the most advanced structures and those whose core business is based on digital technology can consider using their cybersecurity investments as business differentiators! Today, the cybersecurity requirements of customers, both large public and professional, are increasing rapidly. It is possible, and even desirable, to enhance the value of investments made to show that the subject of cybersecurity is a priority for the organization! For some organizations, cybersecurity may even become a profit centre, which will clearly change the discussions with the executive committee.

Cet article Creating a relationship of trust with your executive committee: step 3, make the transformation a reality! est apparu en premier sur RiskInsight.

Cet article CERT-W Newsletter January 2021 est apparu en premier sur RiskInsight.

One fundamental theme won’t change: the threat – the starting point for all thinking about cybersecurity. In our view, unsurprisingly, ransomware will remain the major threat facing businesses. Since the end of 2019, and the exploits of Maze, Sodinokibi, and, more recently Egregor, these destructive attacks have been paired with massive data exfiltration – adding a new dimension to criminal blackmail operations. All types of organizations are affected: from local authorities, through SMEs, to large international groups – wherever they are in the world.

In addition, as we recently discussed in Le Monde, cybercriminal operations have become highly professionalized, ensuring the perpetrators reap a return on their considerable investments. These investments will enable them to mount increasingly deep, and technically sophisticated, attacks in the future – attacks that will have no qualms about targeting activities that are core to business functions (such as industrial networks, payment systems, etc.). In 2021, the stakes in the tug of war over the payment of ransoms are likely to be raised – with a determined effort by criminal groups to achieve higher profile attacks. We saw some early signs this year with the use of sophisticated procedures: from an attack being announced via Facebook advertisements, through direct negotiation with patients in healthcare-sector attacks, to the printing of ransom demands via in-store cash registers… There will be a need to anticipate such situations to the maximum extent possible, either by simulating them in crisis exercises or by tailoring specific, well-thought-out responses in advance.

In addition to the many-headed beast of ransomware, our teams out in the field anticipate strong growth in two other threat areas in 2021. First, indirect attacks, using third-party services: cybercriminals are heavily focused on circumventing the security arrangements of major players by exploiting vulnerabilities in their less-protected partners or targeting their IT service providers. In addition, attacks that target cloud-based systems are expected to accelerate and manifest new types of compromise. Exploiting vulnerabilities in identity and access management (IAM), in particular via supplier APIs to compromise ever more critical areas of business, will be one of the hallmarks of incidents in 2021. Today, this area represents a real challenge for IT teams, who are still much too unfamiliar with the fast-developing particularities of these platforms.

Faced with such a range of threats, CISOs will need to be both agile and robust, especially in their mastery of security fundamentals (in particular, the Active Directory, the application of patches, and multi-factor authentication) and in solidly demonstrating their cyber-resilience capabilities (with ever-more demanding commitments in terms of reconstruction times and the ability of business functions to be resilient without IT capacity).

In parallel, there are several areas that will be central to developments in IT departments, and CISOs can turn them into opportunities to improve cybersecurity within their organizations. In particular, we have in mind “Digital Workplace” projects – and the work to optimize available security measures, which will have to be done against the current backdrop of constrained budgets. Previous years’ investments in cybersecurity have often added new functionalities that are little known or used, especially when it comes to the cloud. Looking to these may offer a way to improve cybersecurity at lower cost.

From a regulatory perspective, 2021 will see another increase in issues linked to cyber borders or even cyber-protectionism. It will mean considering demanding isolation and protection requirements, and also the issue of the interconnection of new and little-known systems (for example, Alibaba in China, Yandex in Russia, etc.) with organizational networks.

In terms of technological developments to keep in mind, we have identified three trends: Zero-trust, Confidential Computing, and Quantum Computing. We discuss these in more detail below and set out the minimum level of monitoring that you should plan for.

Threats are becoming more complex and resources increasingly limited… CISOs will need to demonstrate their agility in 2021, by addressing a range of issues while still maintaining a clear strategic direction: they’ll need to be able to protect their organizations against cyber criminals while supporting, or even developing, new digital uses.

Cet article CISO, between post-COVID world and persistent threats, what are the priorities for 2021? est apparu en premier sur RiskInsight.

Identification and mapping of key processes

Let’s start with a definition from the regulator: the European Central Bank defines cyber-resilience as the ability to protect oneself and to quickly resume activities in the event of a successful cyber-attack. This definition has led many companies to adopt a 360° vision on the topic (prevention, crisis management, reconstruction, business continuity, etc.) through the prism of a concrete cyber-attack on key business processes. The novelty lies above all in the fact that all the analysis is focused on critical business chains, even though it is still necessary to know them. Identifying and mapping key processes is often the most complex part of a Cyber Resilience Program. Unfortunately, there is no systematic method: a list drawn up by the Risk Department, a decision by the Director of Operations, recycling of business impact analyses (BIA), criteria established during regulatory audits, etc. One thing is certain, this list cannot be drawn up by the cybersecurity team in its own corner and requires the involvement of the business lines as early as possible in the process.

Analyzing the cyber-resilience of a business chain: the A.R.M. method

The cyber-resilience of a business chain can be improved by acting on several parameters: 1/ avoidance of the attack, 2/ rapid reconstruction, 3/ maintenance of business activity during the attack. As a result, many companies have structured their Cyber Resilience Program around 3 indicators: A (AVOID), R (RECOVER) and M (MAINTAIN), making it possible to target one threat at a time. Of course, most current initiatives are working on Ransomware scenarios (Ryuk, Maze, Sodinokibi, etc.).

A – AVOID

The first step is to assess the level of resistance of business chains to the feared cyber threats. The ATT&CK Framework is increasingly used here and this indicator can simply correspond to the percentage of techniques used by the attacker against which the business chain is protected (for example, the chain is protected against 60% of the attack techniques used by the ransomware groups of the moment). The level of assurance required differs from one company to another: even if most companies still work via self-declaration, it is possible to integrate a review of evidence or Redteam audits into the approach to make the results more reliable.

R – RECOVER

The second step requires assessing the reconstruction time of the business chain in the event of an attack (for example, the chain can be reassembled in 9 hours after a ransomware attack). This time can obviously be different from one attack to another: destruction often restricted to Microsoft systems, possibility to use backups or not, integrity checks necessary after reconstruction, etc. This requires a detailed analysis of the impacts of each attack studied. Be careful, when mapping, it is necessary to consider the reconstruction of ALL the assets impacted by the attack. It is often observed that a few specific assets can double or triple the overall reconstruction time. Here again, the level of insurance required differs from one company to another: it is possible to work on paper, but the real reconstruction test is clearly the best option for reassurance.

R – MAINTAIN

The last step requires assessing the ability of the business lines to work in a degraded mode before returning to normal. This is a purely business indicator, which obviously differs from one sector and chain to another: it can be a question of transactions, reception of parcels or number of passengers depending on the sector and the chosen chain. To calculate it, it is necessary to work with the business on the assumption of long-term unavailability of the critical chain and to evaluate the percentage of the activity that can be delivered in another way. To understand the approach in a theoretical, and deliberately provocative way: does a business process vulnerable to a cyberattack, but whose activity can be maintained without an IS for a few days, really need to increase investments in cybersecurity? This is the type of topic that a Cyber Resilience Program must be able to arbitrate.

Most Cyber Resilience Strategies and Programs on the market obviously embrace this recurring assessment phase, adding over the years cyber threats and business chains to be analyzed. At the same time, they are managing a series of cybersecurity, IT and business projects to increase the level of resilience. The most mature Programs also maintain catalogs of solutions to speed up the process and improve the scoring of the various business lines (data safes, standardized backups, market partnerships, shared business fallback solutions, etc.).

As we have seen, a cyber-resilience strategy involves multiple skills: the cybersecurity department to select threats and assess the robustness of chains, the business lines to select critical chains and work on business continuity, IT and the Business Continuity Plan (BCP) for crisis management and assessment of reconstruction capacities. The best solution is to host this type of Program directly at the Operations Department level, in order to influence all these channels. However, these Programs are currently structured at the level of the CISO or the Risk Management Department. The key in this case is to deploy effective governance that allows all stakeholders to remain within their area of expertise.

Cet article Cyber-resilience, an opportunity to bring cybersecurity and business closer together est apparu en premier sur RiskInsight.