Digital Identity,
Encryption & Key Management,
Identity Security
Applied Quantum’s Marin Ivezic on Why Forged Signatures Beat Stolen Data as a Risk
In the evolving landscape of cybersecurity, the need for robust digital signatures is becoming more important than ever. According to Marin Ivezic, CEO of Applied Quantum, every action taken by digital systems—ranging from software updates to financial transactions—is underpinned by these cryptographic signatures. However, with the advent of cryptographically powerful quantum computing, there looms a significant threat: the potential for forging these very signatures without detection, a concern that many security teams have yet to address comprehensively.
During a recent interview, Ivezic emphasized that it is likely that attackers will initially focus their efforts on information technology (IT) systems, given that the pathway to financial gain is more apparent. However, he cautioned that operational technology (OT) systems pose an even greater risk. Unlike IT systems, OT systems often rely on hard-coded firmware signatures, making them particularly vulnerable. The implications of a forged signature in these environments could be catastrophic, potentially enabling attackers to assume control over critical physical infrastructure and safety systems, thus posing risks to both operations and public safety.
“The moment a forged signature comes to light, it undermines the entire foundation of trust across all digital signatures within an organization,” Ivezic remarked. He elaborated that this erosion of trust extends from device firmware to legally binding documents. The ramifications of this could lead to widespread confusion and insecurity within digital ecosystems, where distinguishing between valid and malicious signatures becomes virtually impossible.
In the discussion, Ivezic outlined several proactive measures that security teams should consider implementing in the near term to prepare for the imminent challenges presented by post-quantum risks. One critical step is conducting a thorough inventory of signing keys to better understand vulnerabilities. Additionally, enabling hybrid key exchange mechanisms can add layers of security, aiding organizations in mitigating risks associated with the potential exploitation of forged signatures.
Furthermore, Ivezic pointed out the organizational challenges related to signature security migration. Most enterprises are characterized by a lack of centralized ownership, leading to disjointed efforts in addressing signature vulnerabilities. This fragmentation complicates the overall strategy for securing signatures, as multiple stakeholders across an organization may have varying levels of commitment and resources allocated to this crucial aspect of cybersecurity.
To add another layer of complexity, Ivezic engaged in a dialogue about incident response protocols that organizations must adopt when faced with the daunting task of distinguishing between genuine and forged signatures. This situation is critical, as the inability to differentiate between the two could result in serious operational setbacks and compromises to security integrity.
Ivezic, who possesses over 30 years of extensive experience in cybersecurity and advanced technologies, shared his insights based on his leadership roles at major firms like Accenture, IBM, and various Big Four advisors, in addition to his hands-on experience as an enterprise Chief Information Security Officer (CISO) and Chief Technology Officer (CTO). Previously he also spearheaded initiatives at Boston Photonics and PQDefense, focusing on the burgeoning sector of quantum risk management. His extensive background enables him to provide valuable guidance to both governments and enterprises, aiding them in navigating the complexities associated with quantum technology risks.
As the landscape of cybersecurity evolves in tandem with technological innovations, the significance of securing digital signatures cannot be overstated. With quantum computing on the horizon, organizations must readily implement protective measures to protect their foundational trust in digital systems.