Abstract Quantum computing is expected to eventually be able to break the public‐key cryptography algorithms currently used throughout information technology (IT) infrastructure, undermining foundational tools used to maintain information security across the country's critical infrastructure. As these systems converge, the security posture of operational technology (OT) systems has to adapt to a new threat landscape and adopt some of the same security controls as those used in enterprise IT, especially cryptographic controls that rely on public‐key cryptography, which are ubiquitous in enterprise IT systems. Operators and manufacturers of industrial control systems (ICSs) and OT systems will need to understand and address the unique ways in which these systems will be vulnerable to adversaries equipped with quantum computers. We assessed quantum computing–facilitated cryptographic vulnerabilities in ICSs and OT systems to identify the issues in need of the most‐urgent attention from ICS and OT owners, operators, and manufacturers. Employing a modified consequence‐driven, cyber‐informed engineering process informed by literature review and analysis, we mapped protocols using or enabling cryptographic protections across common ICS network topologies as part of an assessment of how an attacker could cause harm, especially damaging physical consequences resulting from manipulation of cyber–physical systems, through the cryptographic compromise of ICS and OT networks and components. Our evaluation of identified and ranked risks to related control systems was also informed by relevant literature on ICS risk assessment and mitigation, cyber harms, and historical attacks on critical infrastructure. Using our analysis, we assessed the overall difficulty in mitigating risk from each of the identified vulnerability archetypes. The resulting analysis identified vulnerabilities associated with code‐signing processes as the highest priority for attention when updating systems for a postquantum future. This risk was followed by vulnerabilities associated with forged certificates for identification and vulnerabilities associated with forged session keys, identified as lower priorities but still of concern. Informed by our findings, we offer recommendations related to the protection of these vulnerabilities and the improvement of ICS security in developed systems.
Abstract Quantum computing is expected to eventually be able to break the public‐key cryptography algorithms currently used throughout information technology (IT) infrastructure, undermining foundational tools used to maintain information security across the country's critical infrastructure. As these systems converge, the security posture of operational technology (OT) systems has to adapt to a new threat landscape and adopt some of the same security controls as those used in enterprise IT, especially cryptographic controls that rely on public‐key cryptography, which are ubiquitous in enterprise IT systems. Operators and manufacturers of industrial control systems (ICSs) and OT systems will need to understand and address the unique ways in which these systems will be vulnerable to adversaries equipped with quantum computers. We assessed quantum computing–facilitated cryptographic vulnerabilities in ICSs and OT systems to identify the issues in need of the most‐urgent attention from ICS and OT owners, operators, and manufacturers. Employing a modified consequence‐driven, cyber‐informed engineering process informed by literature review and analysis, we mapped protocols using or enabling cryptographic protections across common ICS network topologies as part of an assessment of how an attacker could cause harm, especially damaging physical consequences resulting from manipulation of cyber–physical systems, through the cryptographic compromise of ICS and OT networks and components. Our evaluation of identified and ranked risks to related control systems was also informed by relevant literature on ICS risk assessment and mitigation, cyber harms, and historical attacks on critical infrastructure. Using our analysis, we assessed the overall difficulty in mitigating risk from each of the identified vulnerability archetypes. The resulting analysis identified vulnerabilities associated with code‐signing processes as the highest priority for attention when updating systems for a postquantum future. This risk was followed by vulnerabilities associated with forged certificates for identification and vulnerabilities associated with forged session keys, identified as lower priorities but still of concern. Informed by our findings, we offer recommendations related to the protection of these vulnerabilities and the improvement of ICS security in developed systems.
The emergence of quantum computing is set to reshape the landscape of cybersecurity, presenting a blend of significant challenges and groundbreaking opportunities. This paper delves into the growing risks tied to quantum technologies, with a particular focus on post-quantum cryptography (PQC) and the threats posed by the possible obsolescence of traditional cryptographic methods. As quantum computing capabilities advance at a rapid pace, the need for the development of quantum-resistant security protocols has become more urgent than ever. This research investigates the vulnerabilities of current cryptographic systems, the potential dangers posed by quantum computing, and the solutions already available in the field of post-quantum cryptography. Furthermore, the paper outlines a comprehensive framework for cybersecurity solutions that are resilient to future quantum threats, emphasizing the importance of collaboration across academic, industrial, and governmental sectors. By reviewing current literature and technological developments, this paper provides a roadmap for transitioning to quantum-safe security practices, addressing the risks brought on by quantum advancements, and ensuring that critical infrastructure is well-defended against quantum-driven attacks. The findings indicate that while quantum computing introduces profound risks to traditional cybersecurity systems, a proactive, strategic adoption of PQC solutions can effectively protect vital infrastructure in the post-quantum age.
Abstract The use of quantum technologies in the modern world poses significant challenges to the security of critical information infrastructure, which underpins key sectors such as healthcare, energy, transportation, and communications. Cryptographic algorithms like RSA and ECC, long considered reliable, have lost their resilience in the face of quantum computing capabilities, making the search for modern solutions to ensure data protection a top priority. The main risks posed by quantum computers include the potential compromise of encryption algorithms, disruption of data integrity, and destabilization of critical system operations. The methodological foundation of this study is based on the analysis of 318 sources from international databases such as Scopus and Web of Science. From this body of literature, 24 publications most relevant to the topic were selected. A comparative method was employed to analyze classical and quantum threats. The aim of the study is to examine the impact of quantum attacks on the security of critical information infrastructure (CII) at the current level and propose pathways for transitioning to quantum-resilient solutions. The results emphasize the necessity of implementing innovative cryptographic approaches, such as lattice-based and code-based algorithms, as well as combined (hybrid) technologies. Successful protection of the infrastructure requires a systematic approach, including a comprehensive audit of existing systems, training of specialists, and the removal of technical and regulatory barriers. The developed step-by-step plan minimizes risks and establishes a foundation for the secure implementation of new standards.
The arrival of cryptographically relevant quantum computers (CRQCs) represents an existential threat to the public-key cryptographic infrastructure underpinning global enterprise operations. Enterprise security today relies on RSA and elliptic-curve cryptography (ECC) for TLS, VPNs, PKI, code signing, and identity systems—all of which are fundamentally broken by Shor's algorithm on a sufficiently powerful quantum computer. The defining risk is time-shifted compromise: adversaries can harvest encrypted traffic today and decrypt it once CRQCs exist, a threat already underway according to U.S. intelligence assessments. NIST finalized three post-quantum cryptographic (PQC) standards in August 2024 (FIPS 203/204/205) and mandates deprecation of quantum-vulnerable algorithms by 2035. Yet only 5% of organizations have implemented quantum-safe encryption and 95% lack formal quantum transition plans. This paper provides a comprehensive, threat-driven analysis across seven dimensions: quantum algorithm impact, harvest-now-decrypt-later (HNDL) threat models, enterprise asset risks (PKI, TLS, VPNs, code signing, cloud, IoT, identity, blockchain, supply chain), sector-specific vulnerabilities (financial services, healthcare, critical infrastructure), cryptographic primitive analysis, migration standards and roadmaps, and enterprise readiness gaps. The convergence of HNDL attacks already underway, multi-decade data sensitivity windows, and 12–15 year enterprise migration timelines means the migration deadline has, for most sectors, already passed.
As quantum computers advance, they will fundamentally change the ways the information systems that currently secure communications, financial systems, healthcare records, government databases and critical infrastructure are protected. Although quantum technologies offer great promise for future scientific endeavors and processing power, they also present new dangers for cybersecurity. This paper explores the threats that are emerging as a result of Quantum Computing, focusing on the vulnerability of popular public-key cryptographic methods like RSA, Diffie–Hellman and Elliptic Curve Cryptography. The study also delves into the consequences of "harvest now, decrypt later": Information encrypted today could be made available when sufficiently strong quantum computers are ready. The research adopts a qualitative approach with a thorough literature survey of scholarly works on quantum-safe security standards, international cybersecurity frameworks, and recent advancements in the field. It evaluates the readiness of organizations, governments and technology vendors to deal with the changing threats of quantum computing. The study also highlights emerging counter measures, such as post quantum cryptography, quantum key distribution, cryptographic agility, zero trust security architectures, and risk-based migration strategies to build long-term cyber resilience. The results indicate that while large-scale quantum computers are still being developed which could compromise current encryption systems, it is important to plan ahead and implement quantum-resistant technologies to mitigate future security risks. To achieve quantum-safe cybersecurity, a concerted effort is needed, involving a collaboration between policymakers, researchers, industry players and standardization organizations, to provide secure digital ecosystems. In the end, the paper argues that a blend of quantum-resistant cryptographic solutions and adaptive cybersecurity governance and continuous innovation will be a critical enabler in protecting information assets in the quantum era. The study will contribute to the existing body of work on quantum cybersecurity and provide insights into the challenges and opportunities of creating secure and future-proof cybersecurity systems.
As quantum computing technology continues to advance towards a cryptographically relevant scale, cybersecurity for critical infrastructure such as electrical power systems must prepare for an existential threat. A crucial step to mitigating the potential damage a quantum computer-aided attack may cause is identifying quantum-vulnerable algorithms that are currently used in the standards for the security of power system control centres and communication networks. The IEC 62351 is a series of standards for protecting data in power automation systems and includes several quantum-vulnerable cryptographic primitives. Parts 7, 8, and 9 of the IEC 62351 are dedicated to network and system management, role-based access control, and key management. In this work, we conduct a comprehensive vulnerability assessment of the cryptographic algorithms selected in these parts of IEC 62351.
The machinery of industrial environments was connected to the Internet years ago with the scope of increasing their performance. However, this change made such environments vulnerable against cyber-attacks that can compromise their correct functioning resulting in economic or social problems. Moreover, implementing cryptosystems in the communications between operational technology (OT) devices is a more challenging task than for information technology (IT) environments since the OT networks are generally composed of legacy elements, characterized by low-computational capabilities. Consequently, implementing cryptosystems in industrial communication networks faces a tradeoff between the security of the communications and the amortization of the industrial infrastructure. Critical infrastructure (CI) refers to the industries which provide key resources for the daily social and economical development, e.g., electricity. Furthermore, a new threat to cybersecurity has arisen with the theoretical proposal of quantum computers, due to their potential ability of breaking state-of-the-art cryptography protocols, such as RSA or elliptic curve cryptography. Many global agents have become aware that transitioning their secure communications to a quantum secure paradigm is a priority that should be established before the arrival of fault-tolerance. In this article, we aim to describe the problematic of implementing post-quantum cryptography (PQC) to CI environments. For doing so, we describe the requirements for these scenarios and how they differ against IT. We also introduce classical cryptography and how quantum computers pose a threat to such security protocols. Furthermore, we introduce state-of-the-art proposals of PQC protocols and present their characteristics. We conclude by discussing the problematic of integrating PQC in industrial environments.