The Three Biggest Post-Quantum Threats to Small Businesses
Cyberattacks on small businesses have been on the rise in recent years, and the results are devastating. It could take a small business 24 hours or longer to recover from a cyberattack and cost an average of $ 21,659.
IT leaders must be aware of the most common types of post-quantum cyberattacks that could impact small businesses.
- Data compromise: Cybercriminals could compromise company data by gaining access to business plans, user credentials, employee records, bank statements, earnings reports, intellectual property, clients’ personal information and more.
- Digital signature compromise: Public key cryptography enables digital signature capabilities so a cybercriminal can forge digital signatures on sensitive organizational correspondence and documents such as emails, memorandums, paychecks, contracts, purchase orders, financial transactions, audit records, legal documents and more.
- Harvest now, decrypt later: To the untrained professional, post-quantum cyberattacks may appear to be a tomorrow problem. However, post-quantum cyberattacks are in fact an urgent problem today due to a concept called harvest now, decrypt later. For example, if cybercriminals steal sensitive company data today, they could store the data until they acquire a quantum computer strong enough to decrypt it, even if that takes several years.
UP NEXT: What are the security implications of quantum computing?
Take these Steps to Mitigate Quantum Risk
Mitigating quantum risk will not be a fast (or easy) process. It may take several years to put all the necessary physical, operational, administrative and technical measures in place. That’s precisely why businesses should start the PQC migration process without delay.
Below are four steps to get you started:
1. Get leadership on board
Let’s face it, very little can happen without leadership support. And whether you want to admit it or not, teams need leadership assistance and influence to be successful. Not only can they provide the funds, personnel and policies required to complete the migration, but they can set the company vision for the migration, get other departments involved and deal with any change management issues that arises. Having executive buy-in is crucial and will make the effort much easier.
2. Run a risk analysis and determine your network security posture
Before implementing PQC, IT leaders should identify the network’s strengths and weaknesses. One of the best ways to do this is by performing a risk analysis.
Typically, a formal risk analysis includes:
- Identifying and prioritizing the risks
- Analyzing the risks to determine their qualitative and quantitative impact on your business
- Determining the best risk mitigation strategies to strengthen your network security posture
Other factors worth considering are: the encryption algorithms your systems currently use (AES, RSA, ECC, hybrid, etc.) and their characteristics; the kinds of data stored on your systems and how you will prioritize them (by sensitivity and/or importance), where your data is located and stored (servers, hard drives, remote, cloud, etc.); the amount of time and effort it will take to replace your current encryption algorithms with PQC algorithms (i.e., determining your “crypto agility”). IT leaders may also consider hybrid models that integrate both contemporary cryptography and PQC; the regulatory updates you must make once the migration is complete.
3. Calculate the cost of a PQC migration
Small businesses have tight budgets and must be targeted with their tech spending. So, calculate the PQC migration cost carefully. The greatest expense will be replacing and updating legacy systems that do not support PQC algorithms. Depending on the size and knowledge of the IT department, you may also include costs for hiring a PQC consultant, training IT employees or even hiring new IT employees. Remember, PQC is new, and you may not have a solid idea of the total cost until you become familiar with the intricacies of PQC migration, so take it one step at a time.
4. Establish a governance committee
A governance committee, typically made up of leaders and experts from various departments, can guide the migration process to the finish line. You will need an IT leader to serve as the committee’s CTO. That person will set the agenda for the migration process and make sure all the departments meet agreed upon deadlines. You don’t need a large business to establish a governance committee, it only takes a few leaders to be successful.
Don’t Wait to Establish Defenses Against Quantum Computing
To date, quantum computers are not scalable enough to defeat modern encryption algorithms; however, the quantum community is steadily making progress. The current consensus is that the quantum threat won’t be fully realized until at least the mid-2030s. Between now and then, small businesses have an opportunity to reinforce their networks before post-quantum cyberattacks become a reality.
By migrating to PQC and following these cybersecurity practices, small businesses can withstand the threats of the post-quantum era.
