Intel’s Steve Orrin on Preparing for Post-Quantum Cryptography: Insights and Recommendations
In an era where technological advancements are rapidly shaping the cybersecurity landscape, the need for organizations to prepare for post-quantum cryptography has become paramount. Steve Orrin, the federal Chief Technology Officer (CTO) at Intel, shared his profound insights on the impending transformation that quantum computing will bring to the field of cryptography. His remarks underscore the urgency for Chief Information Officers (CIOs) to proactively coordinate efforts across various facets of their organizations.
Orrin emphasizes a fundamental starting point for any organization: identifying where cryptographic protections are currently in place. This discovery process should not only cover core applications but also extend to infrastructure and operational technology. By understanding the various systems that rely on cryptography, organizations can prioritize their assets based on business importance and the duration for which they require protection.
The threat posed by quantum computing extends beyond the mere interception of data. The potential decryption capabilities of future quantum systems could compromise digital signatures and erode trust relationships essential for business operations. Orrin warns that organizations must plan meticulously before the advent of what researchers refer to as "Q-Day," the day when quantum computers become capable of breaking current cryptographic norms.
"You can’t secure, you can’t fix what you don’t know," Orrin states, highlighting the importance of comprehensive knowledge regarding cryptographic applications within an organization. To aid in this knowledge-gathering process, he recommends a concerted effort to combine cryptographic discovery with existing asset and financial records. This collaborative approach allows IT teams to better identify the technology under their management, while financial departments can shed light on vendors and services that are engaged through payments.
Importantly, the inventory must extend beyond conventional assets such as laptops and servers. Organizations should document everything that could potentially utilize cryptography, including printers, badge readers, surveillance cameras, industrial machinery, and various third-party services. This thorough inventory serves as a foundational step toward assessing overall vulnerability to post-quantum threats.
Once an organization gains clarity on its current cryptographic landscape, it can move to the next step: ranking its systems based on the confidentiality and integrity requirements they must uphold. Sensitive data such as trade secrets and personal information, which may require extended protection, should take precedence in this evaluation. Additionally, financial records and digital signatures should remain reliable throughout the lifespan of a transaction. Orrin advises CIOs to initiate their focus on high-value systems and long-lived data, progressively developing a phased plan that aligns with business priorities and budgetary constraints.
In a recent video interview with ISMG, Orrin elaborated on these pivotal themes, discussing several critical areas including:
-
Post-Quantum Risk: Orrin articulated how post-quantum risk encompasses encrypted data as well as the trust relationships formed through digital signatures.
-
Mapping Cryptography: He outlined strategies for CIOs to effectively map their cryptographic resources across IT networks, operational technology, and vendor relationships.
- Initial Steps: Orrin suggested actionable priorities to tackle within the first 90 days of this transition, alongside methodologies for testing migrations in a staged manner.
Orrin’s experience and leadership at Intel, where he guides solution architecture, strategy, and technology engagements, lend significant weight to his recommendations. His prior roles include positions focused on identity protection, anti-malware strategies, and security for cloud services and virtualization, providing him with a robust background to address the complexities of the cybersecurity landscape.
In conclusion, as the landscape of data security evolves with the rise of quantum computing, organizations must take decisive steps toward understanding and strengthening their cryptographic frameworks. With careful planning and prioritization as advised by experts like Steve Orrin, organizations can navigate the impending challenges of post-quantum cryptography, safeguarding their sensitive information and maintaining the trust that underpins digital interactions. The future may pose unprecedented risks, but through diligent preparation and awareness, organizations can create resilient strategies that stand the test of time.