Page 34 - Cyber Defense eMagazine RSAC Special Edition 2025

Consider a simple HTTPS connection between a user and a website. The secure handshake that protects
the session relies on asymmetric key exchange algorithms. These algorithms are resilient today because
brute-force attacks would take longer than the universe has existed. But a sufficiently powerful quantum
computer could, in theory, solve those same problems exponentially faster – potentially rendering much
of today’s encryption obsolete.

While quantum hardware isn’t in the hands of adversaries yet, government agencies and high-security
industries aren’t waiting. They’re already investing in post-quantum cryptography (PQC) – encryption
designed to resist quantum attacks. In fact, in 2024 the U.S. National Institute of Standards and
Technology (NIST) finalized its first group of post-quantum encryption standards, following a years-long
global vetting process. Adoption of these standards will play a vital role in future-proofing digital security.

The good news? PQC isn’t theoretical. It’s available today and relatively straightforward to implement.
Security teams can begin evaluating and testing post-quantum algorithms without needing a wholesale
overhaul of infrastructure. In most cases, PQC can be integrated at the protocol or software layer, without
visible impact to users or systems.

Still, quantum preparedness isn’t just a technology question, it’s a strategic one. Organizations must build
quantum resilience into their roadmaps now. That means staying close to evolving standards, investing
in cryptographic agility, and ensuring teams are prepared to pivot quickly as quantum capabilities mature.

For most consumers and businesses, post-quantum encryption won’t be a pressing issue – yet. But for
CISOs, CIOs, and security professionals, the time to act is before the tipping point arrives. Just as we've
seen with AI, technological inflection points can come faster than anticipated, bringing rapid shifts in
threat models and risk profiles.

Quantum computing may not be ready to rewrite the rules of cybersecurity tomorrow, but the smart move
is to start preparing today. Because when the breakthrough comes, the organizations that have already
laid the groundwork will be the ones best equipped to thrive in a post-quantum world.

About the Author

Jason Rader is the CISO of Insight Enterprises. He assumed the role
in 2021 after joining the company in 2015 to build the security consulting
group. Today, he builds upon more than 25 years of experience to
develop Insight’s end-to-end security consulting portfolio and share
Insight's transformation journey with fellow security leaders. Jason can
be reached online on LinkedIn and at our company website
www.insight.com.

34