This chapter introduces the Mosca Model, a time-based framework developed by quantum computing pioneer Michele Mosca to help organizations assess their exposure to quantum threats. By comparing three critical variables – how long data must remain secure (Y), how long it will take to migrate to quantum-safe systems (X), and how long until quantum computers can break current encryption (Z) – the model provides a simple inequality (X + Y > Z) that reframes quantum readiness as a race against time. If the sum of X and Y exceeds Z, the organization is already vulnerable, even if Q-Day has not yet arrived. The chapter walks readers through practical applications of the model across various sectors, including finance, healthcare, government, and critical infrastructure. It explores how long-lived data retention requirements and the complexity of cryptographic migration – especially for embedded systems, OT/ICS, and third-party dependencies – can significantly extend X and Y beyond safe thresholds. The discussion includes guidance on how to apply the model using established risk frameworks such as FAIR, NIST RMF, ISO 27005, and DoCRA, and highlights the strategic value of early action to avoid cascading failures in digital trust, compliance, and operational continuity.
This chapter introduces the Mosca Model, a time-based framework developed by quantum computing pioneer Michele Mosca to help organizations assess their exposure to quantum threats. By comparing three critical variables – how long data must remain secure (Y), how long it will take to migrate to quantum-safe systems (X), and how long until quantum computers can break current encryption (Z) – the model provides a simple inequality (X + Y > Z) that reframes quantum readiness as a race against time. If the sum of X and Y exceeds Z, the organization is already vulnerable, even if Q-Day has not yet arrived. The chapter walks readers through practical applications of the model across various sectors, including finance, healthcare, government, and critical infrastructure. It explores how long-lived data retention requirements and the complexity of cryptographic migration – especially for embedded systems, OT/ICS, and third-party dependencies – can significantly extend X and Y beyond safe thresholds. The discussion includes guidance on how to apply the model using established risk frameworks such as FAIR, NIST RMF, ISO 27005, and DoCRA, and highlights the strategic value of early action to avoid cascading failures in digital trust, compliance, and operational continuity.
Are you ready for the day your encryption fails silently? Quantum Ready is not just a warning; it’s a field guide for the era of quantum disruption. As quantum computing accelerates toward the threshold where today’s encryption becomes obsolete, organizations must prepare now or risk a catastrophic breakdown in digital trust. Written by one of the world’s first Field CISOs, this book delivers a strategic, vendor-neutral roadmap for CISOs, security architects, and IT leaders responsible for protecting long-term data and infrastructure. It introduces the Q-Ready Framework, a comprehensive five-phase approach to discovering, prioritizing, migrating, validating, and sustaining quantum-safe cryptography across the enterprise. In this hands-on guide, you’ll learn how to: Identify where vulnerable cryptography lives in your environment Evaluate business impact using real-world risk models like Mosca’s equation Design migration and testing plans tailored to your infrastructure Replace RSA, ECC, and other algorithms with NIST-approved quantum-safe alternatives Apply post-quantum cryptography to TLS, VPNs, code signing, and IoT Build crypto-agility into your systems, teams, and governance With practical checklists, actionable advice, and insights from hundreds of field engagements, Quantum Ready goes beyond theory and into the trenches. Whether you’re already on your migration journey or just beginning to assess the threat, this book will prepare you to lead with confidence through one of the biggest shifts in cybersecurity history. The clock is ticking. Read now, and be the reason your organization is still trusted tomorrow.
This chapter provides a comprehensive methodology for assessing quantum-related vulnerabilities across cryptographic systems, data flows, and third-party dependencies. Building on the cryptographic inventory established in prior chapters, it guides readers through evaluating algorithm-specific risks, data exposure, longevity requirements, and system-level context. Special attention is given to quantum-susceptible algorithms such as RSA, ECC, and DSA, and how tools like AQtive Guard, IBM Guardium, and ISARA can automate vulnerability scanning and prioritize remediation based on business impact. The chapter also addresses sector-specific concerns – highlighting the unique challenges in healthcare, finance, critical infrastructure, and intellectual property protection – where sensitive data must remain secure for extended periods. It introduces threat models like Harvest Now, Decrypt Later (HNDL), and presents real-world examples such as DNSSEC compromise and certificate transparency scraping. A step-by-step guide enables organizations to assign readiness labels (quantum-vulnerable, crypto-agile, post-quantum ready) and create actionable risk profiles that drive prioritization, stakeholder communication, and budget justification. Key frameworks and tools are compared, including the Mosca Model, CARAF (Crypto Agility Risk Assessment Framework), CAI Matrix (Cryptographic Agility Implementation), and the DHS/CISA Quantum Readiness Roadmap.
This chapter introduces the Q-Ready Framework, a structured and practical model for guiding organizations through their post-quantum cryptography (PQC) transition. Developed in alignment with National Security Memorandum-10 (NSM-10), NIST SP 1800-38, FIPS 203–206, and CISA guidance, the framework translates federal directives and industry best practices into an actionable strategy tailored for enterprise security leaders. The framework includes five key phases – Discovery, Planning, Implementation, Validation, and Maintenance – each with three steps designed to help organizations inventory cryptographic assets, prioritize risk, deploy quantum-safe algorithms, and sustain long-term readiness. The Q-Ready Framework addresses the real-world challenges of cryptographic migration, including fragmented inventories, legacy infrastructure, complex supply chains, and regulatory mandates. It integrates with established cybersecurity governance models such as the NIST Cybersecurity Framework (CSF) and Risk Management Framework (RMF), ensuring audit and compliance alignment. The chapter also outlines how the rest of the book is organized around this framework, allowing readers to access field-tested advice, tooling guidance, success metrics, and organizational strategies based on their current phase in the quantum readiness journey.
Chapter 20 concludes the Quantum Ready journey by synthesizing the key takeaways from the Q-Ready Framework and preparing readers for the ongoing evolution of post-quantum cryptography (PQC). This chapter reinforces the notion that Q-Day – the moment when quantum computers can break today's encryption – is not an endpoint but a turning point. It emphasizes that successful migration to quantum-safe systems is not merely a technical upgrade but a fundamental business transformation requiring strategic planning, crypto-agility, and cultural change. Core insights from earlier chapters are revisited, including cryptographic inventory, stakeholder alignment, governance, and the Mosca Model for quantifying quantum risk. Looking ahead, the chapter explores how quantum computing will reshape foundational technologies, from blockchain and AI to the metaverse, decentralized identity, and bioinformatics. It examines how emerging applications such as digital twins, autonomous agents, and quantum-enhanced optimization will depend on quantum-resilient cryptographic foundations. The text highlights urgent threats to systems that rely on classical encryption, including cryptocurrency wallets, smart contracts, and sensitive health data repositories. It underscores the importance of hybrid algorithms, crypto-agile infrastructure, and verifiable model provenance in future-proofing enterprise architecture.
This introductory chapter offers a strategic executive summary of the post-quantum cryptography (PQC) challenge, providing cybersecurity leaders, board members, and C-suite executives with a high-level, business-focused overview of the quantum computing threat. It explains how quantum computers will eventually break the public key cryptography that secures digital trust and emphasizes why organizations must begin preparing now – before adversaries can exploit these vulnerabilities at scale. The chapter defines Q-Day, explains the “Harvest Now, Decrypt Later” threat model, and reframes quantum risk in terms of enterprise revenue, cost, and regulatory exposure. Designed as a standalone executive briefing, the chapter outlines the Q-Ready Framework: a five-phase operational roadmap for quantum readiness encompassing discovery, planning, implementation, validation, and maintenance. It highlights critical actions such as cryptographic inventory, migration planning, crypto-agility, vendor risk assessment, and executive governance. The chapter also includes communication templates, boardroom messaging, key performance indicators, and frequently asked questions to help CISOs engage stakeholders and secure organizational buy-in.
The rise of large-scale quantum computing poses a significant threat to traditional cryptographic security measures. Quantum attacks, particularly targeting the mathematical foundations of current asymmetric cryptographic algorithms, render them ineffective. Even standard symmetric key cryptography is susceptible, albeit to a lesser extent, with potential security enhancements through longer keys or extended hash function outputs. Consequently, the cryptographic solutions currently employed to safeguard data will be inadequately secure and vulnerable to emerging quantum technology threats. In response to this impending quantum menace, organizations must chart a course towards quantum-safe environments, demanding robust business continuity plans and meticulous risk management throughout the migration process. This study provides an in-depth exploration of the challenges associated with migrating from a non-quantum-safe cryptographic state to one resilient against quantum threats. We introduce a comprehensive security risk assessment framework that scrutinizes vulnerabilities across algorithmic, certificate, and protocol layers, covering the entire migration journey, including pre-migration, through-migration, and post-migration stages. Our methodology links identified vulnerabilities to the well-established STRIDE threat model, establishing precise criteria for evaluating their potential impact and likelihood throughout the migration process. Moving beyond theoretical analysis, we address vulnerabilities practically, especially within critical components like cryptographic algorithms, public key infrastructures, and network protocols. Our study not only identifies potential attacks and vulnerabilities at each layer and migration stage but also suggests possible countermeasures and alternatives to enhance system resilience, empowering organizations to construct a secure infrastructure for the quantum era. Through these efforts, we establish the foundation for enduring security in networked systems amid the challenges of the quantum era.