The Next Phase of Quantum Readiness: From Visibility to Execution

Hey everyone. Welcome to another edition of "The Signal from AI to Quantum," the podcast brought to you by both Techstrong Group and our friends at DigiCert. " I'm Alan Shimel, your host, and let me introduce you to our two guests.

We have joining us, Kevin Hilscher. Let's welcome Kevin. Kevin, welcome to the show.

Great to have you on. Great to be here. Sure.

Thanks for having us and having me and, yeah, I lead the device and post-quantum cryptography team at DigiCert, so I look after our products and solutions that we deliver to customers around those two areas. I love it. Thank you, Kevin, for coming on here.

And I think our audience, DigiCert needs no introduction to our audience, but for those maybe few who aren't familiar, worldwide leader in PKI and certificates, in identity, both machine and humans and everything else in the world. And as I say, I think the overwhelming majority of you know DigiCert. Our second guest today comes to us all the way from Norway.

He didn't make it over to watch the World Cup in person, but I'm sure he's following along at home there. Jostein Stokkan, and if I mispronounce it, I apologize, but I did my best. Jostein, welcome.

Jostein is with the company Atea. But Jostein, if you wouldn't mind, introduce yourself to the audience. Absolutely.

Thank you for having me, and it's really fun to be here. I work for a large IT infrastructure organization. We supply very many customers around the Nordics and the Baltics with IT solutions on the infrastructure level, everything from laptops to data centers, to machines to software.

And I am in the division that provides services to our customers as opposed to selling them just the device, and I work with security services in this organization. Love it. Thank you for coming on here today.

We appreciate it. So guys, let's start at the beginning. Well, we're not going to start at the beginning because we'll be talking about Einstein and Planck and all of that stuff.

But let's lay a little bit of a groundwork, right? " It was always at least five years out. And then five years later, it was still at least five years out.

That tune changed about five years ago, right? Where all of a sudden it became, "Wait a second, this is now within reach. " And the most recent updates we're hearing is, look, this might be a year or two out only, or less.

There's stuff going on right now around it. So much so that here in the US, the federal government has kind of declared quantum to be a strategic initiative. It's talking about investing significant, as in billions of dollars, and designating some companies as on the level of Anthropic and OpenAI is to AI with quantum.

So this is no longer pie in the sky, it's real. For most people, unfortunately, I think, when we think of quantum computing, we think of quantum security, right? Because the threat it post quantum cryptography and the threat it poses to this whole cryptographic infrastructure we've built to protect our data and identities and so forth on the internet is on the verge of being washed over by a quantum wave, no pun intended.

Kevin, Jostein, am I exaggerating, or is this what you see where you sit as well? Yeah, you're 100% correct. So we saw lots of denial that this was even a problem, denial around it's anytime soon.

And then NIST kind of took that out of the picture when they set the dates of 2030, 2035, and that kind of took the air out of that argument, so to speak. And now we're seeing a rapid acceleration. We see qubit counts needed to break ECC and RSA falling.

Every few months, we see a new paper come out. And then we see regulators stepping in, putting in hard dates. EU Commission has got 2030.

Obviously, there's the NIST dates. And then, compound it now, organizations like Google set their own internal date to 2029, and Microsoft did the same actually a couple of weeks ago. So we see this acceleration and final recognition this is a problem, and we need to get on it and get serious about it.

Yeah. Yeah. That's very similar to what we have seen here, too.

And it's a part of my normal speech when I talk to customers that they need to be aware. I think the awareness around quantum perhaps is a bit new to many organizations in Scandinavia. But But when we see CloudFlare, Google, et cetera, being on the 2029, 2030 plan for PQC, it's important that we inform the users out there, users of cryptography, that this is coming, and so that they can make a conscious decision on whether to let it be for a while or start planning now.

And, it's important because it's going to be a huge project for most organizations to become quantum safe. Yeah. For me, the best analogy I could draw was the Y2K.

Right? For years leading up to Y2K, we heard about the potential catastrophic consequences of not updating critical systems to handle what was, in essence, a bug. Some say a feature, not a bug, but to update for the new millennium.

" Well, it wasn't necessarily overblown, it's just that we did our homework and we prepared ourselves readiness-wise so that it didn't become the problem it could've become. I think we're at the same stage here with post-quantum cryptography. We're at the stage now where now is the time to make sure that it doesn't bite us, to make sure that it's not a catastrophic occurrence for your organization.

And I think, Jostein, as you rightfully pointed out, that first step is knowing, understanding where it resides. Where are you using PQC? Right?

And also, I think we should remember that if we think back at the other disruptor, or one of the disruptors I talk about, AI, where was that one year ago, or two years ago? Right? Two years ago, we said that that's like 10 years in the future, and suddenly everybody's using it.

Yeah. What if quantum is on the same development path? No, look, as I said before, it's not five years out.

We're one little, not even a breakthrough at this point. We're one iteration, two iterations from a quantum ChatGPT moment, if you will. But let's get back to readiness, right?

Readiness goes with discovering what assets are at stake. Where do you have certificates, keys, applications that are vulnerable to a PQC world, right? Because you can't fix, you can't def-- I was in security 25 plus years.

" Mm-mm. And so the first step to me, and I'm no rocket scientist, I get it, but the first step to me is understanding where am I vulnerable? Where are my places that I've got to update here that I've got to be aware of?

Kevin, I'm sure DigiCert's preaching this to your clients, yes? Absolutely. Yeah.

We've been talking to our customers about doing discovery and we've really seen an acceleration of that now, and interest in doing it. I'm not saying everyone's doing it yet. That's still a problem, but they recognize that's probably one of the first steps in beyond getting recognition at the board and the CISO level that this is an issue.

And we're starting to see this. gov, and now we're starting to see PQC assessment and readiness and discovery RFPs starting to show up. So governments are getting on board.

Organizations are getting on board. They know this is one of the steps that they need to do first, is get that level of visibility. But you mentioned keys, CBOMs.

There's other types of cryptographic assets that sit in the enterprise. Of course, certificates, which we can already manage, but this is a step that customers can do now as well as mitigating that harvest now decrypt later threat. These are things they can do today, so inertia is not an excuse right now.

Agreed. Jostein, with Atea, you guys are on the front lines, I imagine, right? A lot of your clients depend on your team for IT guidance, for IT leadership- Absolutely ...

for IT strategy. Absolutely. Since I work with services, we see that customers want partnerships, not just a vendor.

And we need to help them understand where things may become problematic in the future. And one way to do that is to help them understand where they have certificates, where they have encryption baked into different systems. And from my point of view as a service provider, I can cooperate with DigiCert in order to help customers figure that out in a relatively easy way, easy start, and in order to provide that visibility you were talking about.

Yeah, I want to come back to the cooperation with DigiCert piece. I'm going to come back to it in just a minute. But before we do, Kevin, I wanted to come back to you, because again, logically to me, from what I learned during Y2K, how I've seen in 30 plus years of tech You need sort of your database, your spreadsheet, that's the old way of doing things, isn't it?

You need your place where you're gathering all of your information and making your plans and your execution, and I could have a project manager work on it and make sure the team's all synced. DigiCert's creating something like that. Yeah, we did.

Tell us. Yeah, we recently launched Quantum Central because what we saw was a lot of manual scanning using open source tools, imports of spreadsheets and management of spreadsheets, and then a separate set of project management tools that some folks from IT project management were using to kind of manage this massive effort, right? And so we launched Quantum Central on July 1st in a free preview that anyone can sign up for, that blends discovery, remediation, and governance into one solution.

And so we have the ability for project managers to come in and look at tasks that have been assigned, both to their vendors, and see when their readiness roadmap is going to be done. We have the ability to assign tasks and remediate things internally within an enterprise. And then we built Quantum Central with partners like Atea and Jostein.

And, as partners are going to be a big part of this, it's not a DigiCert effort. This is a team sport, right? Enterprises, their partners, their vendors, trusted partners like Atea, all coming together and helping an enterprise move forward with this.

So we built kind of Quantum Central with that in mind. So Jostein, let me come back to you on the partnership. We've heard Kevin say that Quantum Central was built with partners like Atea in mind.

It's built with end users in mind. It's Quantum Central. But how does it play to you, Jostein?

What's your kind of impression of it, and how you, not you personally, well, you personally, but how is Atea in general using it and helping your customers? Well, we have used DigiCert tools for about six, seven years now. And, we use it in order to help customers identify what type of certificates they have where in order to ensure renewal.

And this now expands into using the same kind of tool into classifying the data we discover into this PQC readiness dashboard. And so for me, it's a way to go out for the customers and help them with the shortened validity period of certificates, along with, at the same time, the PQC bit, because it's based on the same data. And Kevin, I in fact forgot about the fourth dimension of the dashboard that I find particularly interesting, and that's the learning part.

He has built a learning module into the dashboard because this is new to everybody. You can get some ideas of how to get started, and plan for this in eatable chunks, chunks that you're able to digest here and now and get the decisions on. So, to me, it seems like a very sensible tool that will help us help the customers.

Yeah. And the primary focus here is to help. And we need to have a collective effort in order to protect against all the evil that happens out there on the Internet.

But here's the thing. In my years in tech, leading companies, founding, co-founding, tech people are notoriously procrastinators. I had a tough time even saying the word.

Don't do today what we could do tomorrow. And we still got time. We still have time.

" But I wanted to just, Kevin, if you don't mind, lean on some recent research from DigiCert's May 26th Quantum Trust Pulse survey. And this was over 1,000 decision makers, IT decision makers, leadership. And when I looked it over before today, what rang clear to me is that maybe the tiger's changed their stripes.

Maybe we're not procrastinating as much because people certainly are realizing this is real, this is something we got to get ahead of right now. Some of the key findings, Kevin, it was a DigiCert survey, so I'm going to ask you maybe to take the lead, but Jostein, feel free to jump in. What were some of the key findings that I think we should share with our audience?

Yeah, a couple major themes. We see now there's broad recognition this is a problem. So, the denial phase that this is even a thing that we need to migrate and govern cryptography in the future, that's behind us now, largely now.

So now we're in the area of some enterprises are starting their work and they're focusing on discovery and then mitigation of harvest now, decrypt later. 3 and hybrid key exchange with ML-KEM. Unfortunately, we don't see enough of that yet.

We'd rather see that accelerating now because there's nothing stopping. There's no more standards we're waiting on. It's broad support across hardware devices, operating systems, AppSec for this.

So that's the big trends. We're still seeing an unfortunate trend where the migration to quantum safe algorithms isn't necessarily the priority. A lot of A lot of enterprises are still struggling with evergreen projects and app upgrades, and new hardware refreshes and things like that.

So we'd love to see it still move up in terms of the priority, because we think at some point, it'll become an emergency, a three-alarm fire. And- Yeah. It's the- Yeah ...

it's the procrastinators. Exactly. Yeah.

So I think the regulators are stepping in. We see good leadership from the hyperscalers in this area. So hopefully we're going to see some of those trends rebalance a little bit going forward.

So that's kind of what we're seeing through our survey results, our trust summits, and our upcoming World Quantum Readiness Day. We try to touch upon some of these themes, so stay tuned for registration information on that. That's what we run every September.

And we're going to try to help enterprises and our customers move from the, "Okay, we recognize it's a problem," to, "We need to get it prioritized now and actually start on this journey," because it's not simple and fast. Fair enough. Jostein, is this similar to-- Look, my rule of thumb is, when you got more than 75% of the people saying the same thing, that's critical mass.

Absolutely. But I think the market or the organizations around the US and some of the other countries, this survey is a bit different than the organizations we see in Scandinavia. And I think perhaps the quantum bit is a bit foreign to many of the organizations, but therefore, it's also very important that we go out there and talk about this to these organizations.

And the threat here also has a different dimension than perhaps if you're not fulfilling a regular GDPR-type regulation or something, because if you don't do the right things within the appropriate time, you will lose communication with your systems. They will just go down. Right?

Like for instance, if a certificate expires, and it's that type of data that we use into the quantum. And if you're a, call it a war-type manufacturer of equipment or weapons or whatever, can you take a chance on that information being stolen? You can't.

So you have to really start to plan for this now so that you're able to move to the PQC state in a relatively short amount of time. Yeah. So that brings up something, Jostein, that I think bears bringing home here, and that is, a lot of people out here will say, "Okay, we'll go discover.

We'll figure out where we have exposure. " Right? As Kevin said before, till the house is on fire.

I think the thing to remember is a couple of things that both of you hit on. Number one, visibility, understanding where your exposure lies is the start, not the end of this process, right? That's where we begin.

Secondly, Kevin, you mentioned it before. This is not a sprint. " This is a marathon.

First of all, things are still evolving, right? When will Q-Day be here? None of us could say for sure.

We may not know till well after the fact. But it's coming, right? And so this is a marathon.

And so, Jostein, I'd like to come to you first on this, because this is exactly the kind of project where they need an Atea to really give you that long-term vision, that long-term expertise on how do we manage not just the beginning, but taking this to its end. Yeah, and the way we see it is that if we can help the customers with a combination of tools, great tools, and processes for how to use those tools with the appropriate way or appropriate competencies, et cetera, then we can provide customers with an easy step into the first visibility situation where you can actually identify a gap between what you have and where you should be in a certain amount of time. And so we hope to help that first step by combining what we do together with the tools that Kevin at Digicert provides.

And it's a way to get into something in an easy way. You rent the functionality that you need for a certain amount of time or in a longer partnership, as opposed to having to go out and spend capital on capital expenditures and depreciable assets and all of that stuff. So it's making it easy for the customers to get that visibility.

And as you mentioned before or earlier in the podcast here, there is a gap between what organizations think they have and what they actually have when you start doing the scanning using the tools. We've seen that many times over the years when we start setting up tools to help the customers. Jostein, you mentioned Quantum Central and some of the other DigiCert tools.

So is part of the Attia go-to-market having your clients actually register and use Quantum Central as a guide, as a central place to launch their post-quantum cryptography efforts? That's what I would like to see. As you know, the tool is brand new, so we haven't really had the chance to expose customers to it, but I think it will be very easy to make this a relevant topic when we already do the topic of certificate visibility and inventory and with regards to the shortened certificate length.

And it's two sides of the same issue, the way I see it. Certificates are- Well, you bring up the shortened certificates, the 47-day certificates and all this stuff. Look, in some ways, it's a tremendous help for the post-quantum because that's a great opportunity to move from old certificates and old cryptography to newer product that has post-quantum or quantum-proof algorithms built into it.

Kevin, that's something we haven't mentioned before today. Mm-hmm. But how do you guys view that?

Is that an opportunity not to be lost here? Yeah. So what the 47-day has done, the requirement to go down, is force automation.

And automation means you need to discover the endpoints that you need to manage and automate, right? So that has forced companies that haven't adopted certificate lifecycle management to adopt that. Now, there's the side benefit of that is that brings that full certificate inventory into the CLM solution, like DigiCert Trust Lifecycle Manager.

And Quantum Central pulls that whole inventory from that CLM solution and brings that and starts looking at which certificates and endpoints are quantum safe, which ones are not. And then, because you've automated, now you can remediate. Discover and then remediate.

And the remediation is exactly as you mentioned. In some cases, you'll have an endpoint that is updated, it's a newer version of operating system or Apache, and it can support one of these new MLDSA certificates. So now let's replace that certificate in internal web app or something like that with an MLDSA certificate.

And again, through that same certificate lifecycle management solution, that can be done. So now you're reaping the benefits of automation, but also accelerating your adoption of post-quantum solutions. Guys, we've got a few minutes left.

I wanted to bring up another, not a cautionary tale, but a message to everyone watching this. We're not here to sell FUD. As I mentioned before, I've been in security 25 years.

I've seen enough FUD being sold. We're not here to scare you into doing this or sow uncertainty and doubt. What we are telling you, though, is that a stitch in time saves nine, or an ounce of prevention's worth a pound of cure, or whatever your little fable story you want to use, use it.

But one of the things I've learned as I've gotten older is if you don't use it, you lose it. And becoming, let's call it agile, not agile development, agile nimble. Being agile around what your exposure is, where your exposure is, what are the things you could do.

Understanding the problem, understanding the solutions. Even if you can't solve it all right now or in the next quarter, that's okay. No one's here putting guns to anyone's head.

But now, I want to end where we began, which is now is the time to really start thinking about these things, start putting plans in place, start understanding tool sets, understanding what needs to be done. I don't know a better way to say it, but I'll throw it at both of you. Kevin, Jostein.

What have we missed? Have we hit the right chords here? I don't know what else to tell people to get them to do something.

I think we need to go out and let customers or organizations know so that we know that they become conscious about the issues. Then it's up to them whether they want to wait 10 years or start planning now. 10 years is, I think, wait.

If you're waiting 10 years, you're in trouble. Yeah. That was just- Right?

Yeah. It's just- No, I just say, if they want to wait, I think Kevin said it right. If you want to wait till the house is on fire and you got to run out of a burning house, so be it.

But it doesn't have to go that way. And again, not trying to scare anyone. But I know human nature.

Kevin, I'm going to give you the last word on that one. Yeah. Again, not scaring, not trying to scare customers to action, but there is an urgency around this, and there are some very practical things that customers can do today.

We've talked about many of those. But there's other things, like most enterprises have an annual evergreen program for laptops, servers, things like that. Well, start putting your post-quantum cryptography requirements into those evergreen programs, so when the enterprise goes out and RFPs and brings in new hardware and software, it's already ready.

Okay? So these are things that can be done today that are practical. We have lots of solutions now in market that help do discovery, like Quantum Central.

We have great partners, ecosystems like Atea. So, the excuses for inertia are rapidly diminishing, and so we encourage everyone just to start on it, and there's creative ways to get it going without asking for a big budget from your CISO on day zero. Right?

So, that's what I would do. Fair. I agree.

Hey, you know what we didn't mention? For people who aren't lucky enough to have an Atea as a partner, if they want to go to Quantum Central direct, is there a URL for that, Kevin? Yes, absolutely.

It's just off our DigiCert website under Products, and you can sign up for Quantum Central today and start using it and giving us feedback. We've got an exciting roadmap of features that we're adding throughout the summer, and we're very open to feedback and ideas. Kevin, Jostein, I want to thank you both for coming on today's show.

Appreciate it. I hope our audiences appreciated it. com, and you can go from there to Quantum Central and everything else.

Jostein, for people who maybe are in the Scandinavia region and say, "Hey, this Atea sounds like a company I want to partner with," what's the website there? no, N-O for Norway, and start there. no.

Check it out. All right. Hey, I hope you've enjoyed this episode.

This is Alan Shimel. Catch us on our next one. But in the meantime, now's a great place to start putting your post-quantum cryptography plans together at a place like Quantum Central.

We'll see you soon.