Intel Exec Outlines Practical Steps for Post-Quantum Readiness
Intel's federal CTO, Steve Orrin, provides a roadmap for organizations to prepare for the post-quantum era, emphasizing discovery, prioritization, and phased migration.
Organizations must proactively prepare for the advent of cryptographically relevant quantum computers, a future event often referred to as Q-Day. Steve Orrin, federal chief technology officer at Intel, advises a practical, phased approach starting with a comprehensive discovery of all cryptographic uses across an organization's IT, operational technology (OT), and vendor systems. "You can't secure, you can't fix what you don't know," Orrin stated, highlighting the critical first step of inventorying all cryptographic assets.
This discovery process should extend beyond traditional IT assets like servers and laptops to include all connected devices and systems, such as printers, badge readers, cameras, and industrial control equipment. Orrin suggests integrating cryptographic discovery efforts with existing asset management and financial records. By cross-referencing IT inventories with finance department data on services and vendors, organizations can gain a more complete picture of their cryptographic footprint.
Once the scope of cryptographic usage is understood, the next crucial step is prioritization. Orrin recommends ranking systems and data based on their business importance and the duration for which protection is required. Data requiring long-term confidentiality, such as trade secrets or personal information, needs a different protection strategy than financial ledgers or digital signatures that must remain trustworthy over the life of a transaction.
The risks associated with post-quantum cryptography extend beyond the potential decryption of currently encrypted data. Orrin points out that digital signatures and other trust relationships, which are fundamental to secure communication and transactions, could also be compromised by quantum computers. This broadens the scope of preparation beyond simple encryption algorithms.
Developing a phased migration plan is essential, especially considering the complexity of upgrading embedded systems and connected devices. Orrin advises focusing initial efforts on high-value systems and long-lived data, gradually building out the plan based on business priorities and available resources. This approach allows organizations to test and refine their migration strategies in stages before Q-Day arrives.
Orrin also emphasized the importance of testing migrations in stages. This iterative process allows organizations to identify and resolve potential issues with new cryptographic algorithms and their implementation in complex environments before a full-scale rollout. The goal is to ensure a smooth transition without disrupting critical business operations.
Preparing for post-quantum cryptography is not solely an IT challenge; it requires coordination across applications, infrastructure, vendors, and operational technology. By following Orrin's guidance on discovery, prioritization, and phased migration, organizations can build a robust strategy to navigate the transition to a post-quantum world and safeguard their critical assets.