Preparing financial services cybersecurity for quantum computing

Assessing the quantum cybersecurity threat

The backbone of cybersecurity is encryption: the ability to send and store sensitive data by rendering it inaccessible to unauthorized parties. This inaccessibility is achieved using complex mathematical problems that are difficult to solve, yet easy to verify. Even the most powerful classical computers would take longer than the current estimated age of the universe to crack the mathematical framework behind modern encryption, according to the National Institute of Standards and Technology (NIST).²

Quantum computing, with its ability to rapidly solve the mathematical puzzles that keep modern encryption secure, is likely to render the current encryption playbook obsolete. Unlike traditional cyberattacks that leverage coding errors, backdoors and social engineering, quantum attacks will simply bypass encryption and walk straight in, fundamentally disrupting modern cybersecurity.

The problem is immense: More than 20 billion digital devices will require updates to quantum-safe cryptography in the next two decades.³

Beating the quantum timeline

A growing number of global financial services organizations have begun to take note, hiring experts and investing in the development of quantum-resistant technologies and intellectual property. Others are still on the sidelines, not wanting to be the first to act but running the risk of falling behind in a rapidly evolving technological landscape.

Their hesitancy is understandable. Most experts estimate it will take another five to 10 years before quantum computers can break RSA, the world’s most widely used encryption system. While large state actors are expected to be the first to achieve quantum capabilities, democratization of the technology by rogue actors is anticipated to follow quickly. Despite this timeline, the moment for most financial services organizations to begin addressing their vulnerabilities to quantum threats is now, before large-scale quantum machines arrive.

A particularly urgent concern is the possibility of "harvest now, decrypt later" quantum attacks, where perpetrators intercept and store encrypted data that is currently secured by public-keys like RSA or elliptic curve cryptography. They can then wait until a large-scale quantum computer is available and quickly decrypt the stored data, granting access to proprietary systems, infrastructure and customer accounts (see figure below). This threat highlights the organizational urgency to develop and deploy post-quantum cryptographic systems that can resist attacks from both classical and quantum computers. Mitigation measures such as limiting the amount of data encrypted with a single key and using key lengths that are less vulnerable can be immediately deployed.

Shifting winds in the financial sector

Forecasts for the arrival of cryptographically relevant quantum hardware are getting shorter, and the financial services industry is starting to shift its attitude. Rapid advancements in quantum capabilities, an increasing amount of attention from government agencies and regulators, and several high-profile cyber attacks on financial institutions have highlighted the urgency for deploying more robust security measures. Major credit and debit card payment organizations have recently applied quantum-resistant technology to the next generation of payment protocols. The new enhanced-contactless (Ecos) specifications go beyond industry standards to ensure that transactions are resistant to attacks from both traditional and quantum threats. Mastercard has already introduced cards with these new specifications,⁵ giving consumers high levels of “future-proof” security for decades to come. Beginning to realize the immense security threats, the world’s largest global banks are also placing big bets on talent, intellectual property and strategic partnerships surrounding quantum security. For example, JP Morgan Chase demonstrated a first-of-its-kind, production-grade quantum key distribution (QKD) network,⁶ a mathematically proven way to defend against quantum attacks. The fact that a financial services organization led a technological effort of this magnitude underscores how paramount quantum security will be.

This preparation is sound business; the consequences of inaction are difficult to overstate. The 2014 breach of a major financial institution⁷ by foreign hackers exposed a web application vulnerability that allowed access to sensitive information belonging to 76 million households and 7 million small businesses. The affected bank spent $250 million annually on cybersecurity to remediate the breach, in addition to settling a class-action lawsuit for $80 million. Similarly, in 2019, a misconfigured firewall at a different bank resulted in the release of social security and bank account numbers of over 100 million customers. This incident cost the bank more than $200 million in remediation, including class-action lawsuit settlements and credit monitoring for affected customers.

These breaches not only resulted in significant financial harm but also damaged the organizations' reputation and customer trust. They further prompted the passage of increased regulatory oversight, including the Cybersecurity Information Sharing Act and the New York State Department of Financial Services Cybersecurity Regulation, requiring financial institutions to have a robust cybersecurity program in place, including periodic risk assessments, vulnerability testing and incident response planning. Despite these regulations and updated security methods, financial organizations are still vulnerable to new, quantum-based attack vectors, drastically increasing cyber-risk and demanding immediate attention.