In this episode of Cyber Security Inside What That Means, Camille dives into next generation cryptography and quantum computing with Eddy Zervigon, CEO of Quantum Xchange and Independent Board Member. The conversation covers:
The new era of cryptography due to the advancement of quantum computing.
How two-factor authentication and the idea behind it is one solution to making things more secure.
How satellites pose particular challenges but are also incredibly important to secure.
What thought leaders are doing now and where we are headed in this field.
...and more. Don’t miss it!
The views and opinions expressed are those of the guests and author and do not necessarily reflect the official policy or position of Intel Corporation.
Here are some key takeaways:
We are about to have a huge cryptographic migration due to quantum computing and advanced computing. This is because for a long time we’ve used basic math to encrypt data, and computers are now starting to be able to do the math to break the encryption.
We are entering the post-quantum era, and we will need to develop new security protocols and security measures. If we don’t adapt, there could be catastrophic losses.
There are two main approaches to solving this problem. The first is factoring a very large number into its two prime numbers using algorithms. Computers aren’t very good at that.
The second is called quantum key distribution, which uses physics and photonic delivery. This is expensive and hard to scale, but work is being done to incorporate both of these tools into security moving forward.
There are now multiple points of communication between devices. Previously, there was only one communication line, so both the data and the encryption key had to travel together. Now, with wifi, cell access, and access through many apps, there are multiple paths to send data through to make it more secure.
To protect a series of data transmissions, they are now essentially trying to use a two-factor authentication type of technology, where it is an out-of-band key.
One of the problems with satellites is that once it leaves Earth you can’t send a repairman to go fix it. Because of this, needing to future-proof satellites has become important. Especially with the increasing number of satellites being launched each year and the decreased cost to do so.
It’s important to not only protect the information coming to and from the satellites, but also to protect control of the satellites themselves. Not only to protect imaging and communication, but also to make sure the satellite stays in its orbit and in its path.
This quantum computing is also prevalent in government and financial institutions, which is why so much research is being done. There are also some real safety concerns with how much technology has been integrated into our infrastructure.
Killware is the new ransomware that is focused not on extracting money or compensation, but is focused on actually destroying the resources that are being attacked.
The new Executive Order that came out about next generation cryptography is going to strongly encourage government agencies to invest in and find out how to use this to protect data. There are not currently any penalties for not doing so, but those will come.
This is because many of what we now consider normal technology, such as two-factor authentication, were first introduced as government protections.
Bad hackers are collecting information right now, even though they can’t decrypt it, to learn from it and to potentially decrypt it in the future when they have the capability to do so. The problem is happening now, even if it hasn’t fully come to fruition yet.
Quantum threat assessment is something that is happening now, to develop a threat matrix and identify your largest vulnerabilities. Tracing where your data is and where you lose control of it is important right now. In this moment, finding people who are willing to be a leader in this area is also important, since in two to three years this will be a necessity, not a differentiator.
Of course, performance degradation is an issue as well, and plays a key role in this research and development. The cost of transmitting the key can’t be too high.
Some interesting quotes from today’s episode:
“It’s basically, let’s encrypt the data with math that’s very hard to break. And the good news is that for 45 years we’ve done a better job of encrypting than the bad guys have done with their ability to decrypt that information. So it’s been an extraordinary run, but now we’re coming to a point where computers are able to do exactly that very calculation, easily and efficiently.” - Eddy Zervigon
“Now, if you look at even your cell phone, you’ve got wifi, and you’ve got your cell access, and multiple points of carriage - through your WhatsApp account, or your signal, or your Netflix account. So there are multiple paths, so why are we not incorporating the fact that we can now deliver multiple paths to separate the key from the data and make it that much harder for an attacker to be able to successfully decrypt information?” - Eddy Zervigon
“It’s basically two-factor authentication for encryption keys. I remember five years ago two-factor authentication was really cool stuff that you would do when you were trying to send a wire for $50,000. Now you can’t even buy concert tickets without two-factor authentication.” - Eddy Zervigon
“It’s important to protect it, not only as it relates to the telemetry tracking and control… but also the data coming onto the satellite and coming off of the satellite. That’s important because you’re talking about 4,200 commercial satellites up there, and that’s growing at about 20% a year.” - Eddy Zervigon
“If you think about it, the ability to deliver an out-of-band key anywhere in the world, especially as you’re talking about military and intelligence applications, is incredibly important. Especially in light of these oncoming advancements in computing.” - Eddy Zervigon
“Energy is one that’s extremely important, because that’s where you’ll see real, what we call killware, which is the next generation of ransomware. We’ve seen with the Colonial Pipeline what we could basically call a rudimentary attack can do and the ill effects that come from it.” - Eddy Zervigon
“One thing that we’ve seen as a result of the pandemic, is that we are extending the range of what is reasonably acceptable in terms of the edge of computing, and being able to access network controls - significant, important network access controls. That’s all great, but that comes at a cost.” - Eddy Zervigon
“‘Out of band’ means over a separate channel… If I’m in my bank account on the internet and I’m trying to wire my brother $15,000, and all of the sudden I’m going to get a token on my cell phone, a completely different communication - it’s a cell communication of the token that I now have to input into that. It’s the same concept.” - Eddy Zervigon