Full Transcript for Special Edition: Quantum Security - Where to Start & What to Do Now

and 33 00:01:55,027 --> 00:01:58,977 the decisions organizations are making today will directly impact whether their 34 00:01:58,988 --> 00:02:01,967 data is secure or exposed tomorrow. 35 00:02:02,497 --> 00:02:06,027 And across our recent webinars and podcast episodes, we've unpacked what 36 00:02:06,027 --> 00:02:10,368 quantum really means, from the harvest now decrypt later threats to federal 37 00:02:10,378 --> 00:02:14,487 mitigation timelines, to also include practical steps like cryptographic 38 00:02:14,527 --> 00:02:18,667 inventorying, quantum-safe VPNs, and hybrid encryption strategies. 39 00:02:18,847 --> 00:02:21,997 The consistent message in all this is that this isn't something you 40 00:02:21,997 --> 00:02:26,147 can wait for and react to, it's something you have to plan for now. 41 00:02:26,628 --> 00:02:30,968 So in today's session, we're gonna bring all of that research together, and I'll 42 00:02:30,968 --> 00:02:34,547 be asking questions of Joey, and I'll be asking questions that many of you 43 00:02:34,547 --> 00:02:36,197 are probably already thinking about. 44 00:02:36,227 --> 00:02:38,667 What's the hype versus what's the reality? 45 00:02:38,867 --> 00:02:41,337 How urgent is this actually? 46 00:02:41,448 --> 00:02:45,467 And most importantly, what should you be doing today inside of your environment? 47 00:02:45,817 --> 00:02:49,298 So as Jason mentioned before, Joey Schwartz from ATPGov is joining me, 48 00:02:49,308 --> 00:02:52,748 and he's deeply involved in helping agencies and enterprises navigate 49 00:02:52,748 --> 00:02:54,467 this shift from theory to action. 50 00:02:54,707 --> 00:02:57,077 So Joey, I set the stage there for you. 51 00:02:57,097 --> 00:02:58,757 Let's start with the big picture. 52 00:02:58,888 --> 00:03:02,837 For the folks who still think quantum is a future problem, in air quotes, 53 00:03:03,077 --> 00:03:05,077 how real is the threat right now? 54 00:03:05,358 --> 00:03:06,587 Yeah, a good question, Erik. 55 00:03:06,727 --> 00:03:11,417 So I'm gonna back up just a tiny bit for folks who m- maybe don't have a really 56 00:03:11,418 --> 00:03:14,577 deep understanding of post-quantum cryptography and, and the sort of issue 57 00:03:14,577 --> 00:03:17,707 that we're facing, and then I'll go into, you know, the timeline issue. 58 00:03:18,167 --> 00:03:21,278 A quantum computer operates differently than a classical computer. 59 00:03:21,537 --> 00:03:26,847 It manipulates atoms instead of, uh, using electric impulses through a silicon wafer. 60 00:03:27,107 --> 00:03:30,547 The so what of that is that a quantum computer doesn't 61 00:03:30,547 --> 00:03:31,637 just give me ones and zeros. 62 00:03:31,697 --> 00:03:33,507 It gives me a one, a zero, or both. 63 00:03:33,528 --> 00:03:37,567 So now I've increased my compute power by a significant margin, to the point 64 00:03:37,867 --> 00:03:42,647 where I can actually create enough compute power that I can use what's called 65 00:03:42,648 --> 00:03:44,998 Shor's algorithm to break encryption. 66 00:03:45,338 --> 00:03:48,807 I basically don't have enough compute power on the entirety of the Earth 67 00:03:48,808 --> 00:03:50,347 right now with classical computers. 68 00:03:50,367 --> 00:03:54,488 We could go for 10,000 years and use every chip we have, and we still 69 00:03:54,488 --> 00:03:56,898 wouldn't break an AES 256 encryption. 70 00:03:57,178 --> 00:03:59,507 With quantum computers, we will have that power. 71 00:03:59,567 --> 00:04:02,158 Now, quantum computers are here today. 72 00:04:02,347 --> 00:04:05,357 The only challenge is they're new, so we're still working through some 73 00:04:05,358 --> 00:04:08,137 of the things like error rates, and they're also pretty small. 74 00:04:08,358 --> 00:04:11,587 We measure quantum compute power by something called a qubit, just like 75 00:04:11,588 --> 00:04:15,807 we do a bit for classical computing, and the largest quantum computer in 76 00:04:15,807 --> 00:04:17,877 existence right now is 120 qubits. 77 00:04:17,887 --> 00:04:19,248 So relatively small. 78 00:04:19,507 --> 00:04:22,307 You'll hear us use the phrase Q-Day several times. 79 00:04:22,687 --> 00:04:24,758 Q-Day is the day when we get a cryptographically 80 00:04:25,597 --> 00:04:27,028 relevant quantum computer. 81 00:04:27,268 --> 00:04:29,278 So essentially, that's the day when they get big enough and 82 00:04:29,278 --> 00:04:32,318 powerful enough that I can actually start breaking modern algorithms. 83 00:04:32,647 --> 00:04:34,227 So that's obviously a problem, right? 84 00:04:34,227 --> 00:04:37,357 We run everything on encryption, and the question then becomes, 85 00:04:37,357 --> 00:04:39,728 well, when does Q-Day happen, right? 86 00:04:39,728 --> 00:04:43,137 Well, Q-Day is somewhere around five to 10 years from now. 87 00:04:43,177 --> 00:04:46,946 It depends on the, who's doing the estimate This is just my opinion, but 88 00:04:46,946 --> 00:04:50,886 I think all signs point to it actually coming in at that five-year mark, and 89 00:04:50,886 --> 00:04:52,296 there's a couple reasons I say that. 90 00:04:52,356 --> 00:04:55,785 DARPA, for example, most of the research for quantum computing is 91 00:04:55,785 --> 00:04:57,645 being done by nation state actors. 92 00:04:57,646 --> 00:05:00,546 It's being funded by nations because it's, it's very expensive, and 93 00:05:00,546 --> 00:05:01,986 the United States is no exception. 94 00:05:02,226 --> 00:05:06,016 So DARPA put out big research grants in the last couple years for companies 95 00:05:06,025 --> 00:05:10,456 to develop newer and better quantum computers, and last year Microsoft, 96 00:05:10,505 --> 00:05:12,015 uh, released its Majorana One. 97 00:05:12,466 --> 00:05:15,305 In less than a year after that first quantum chip, they've 98 00:05:15,306 --> 00:05:18,175 got their second quantum chip out that has doubled the power. 99 00:05:18,455 --> 00:05:22,206 Having released Majorana

Two, even in, it was just in the last few weeks, 100 00:05:22,526 --> 00:05:26,805 Microsoft has cut its estimate to build a scalable quantum computer in half. 101 00:05:26,905 --> 00:05:30,106 By twenty twenty-nine they expect to have a scalable quantum computer. 102 00:05:30,585 --> 00:05:31,795 There's also Chinese reports. 103 00:05:31,806 --> 00:05:35,955 Chinese researchers have done some breaking of very, very small encryption. 104 00:05:35,955 --> 00:05:37,975 I, I think it's like fifty bits or something like that. 105 00:05:38,256 --> 00:05:41,505 But the fact is they were able to power the algorithm and do it. 106 00:05:41,515 --> 00:05:45,905 So there's that, and then there's also a continual revision down. 107 00:05:46,146 --> 00:05:49,725 So there's this question of how many qubits do we need to actually 108 00:05:49,745 --> 00:05:51,965 break modern strong encryption? 109 00:05:52,315 --> 00:05:55,106 And the first estimate started at, at a million qubits 110 00:05:55,226 --> 00:05:57,166 probably two or three years ago. 111 00:05:57,345 --> 00:06:00,526 In the last couple of years, that got revised down to five hundred 112 00:06:00,526 --> 00:06:03,616 thousand, and now one estimate has it at a hundred thousand. 113 00:06:03,705 --> 00:06:05,775 We'll see where the rubber meets the road when we get there. 114 00:06:06,085 --> 00:06:09,375 All those things are indicating to me that the pace of change 115 00:06:09,535 --> 00:06:11,165 makes it sooner rather than later. 116 00:06:11,436 --> 00:06:12,636 Okay, so that's our background. 117 00:06:12,646 --> 00:06:14,525 What's the actual timing of this threat? 118 00:06:14,995 --> 00:06:19,076 Well, the timing of the threat actually is, is now, partly because of something 119 00:06:19,076 --> 00:06:20,615 called harvest now, decryption later. 120 00:06:20,866 --> 00:06:25,105 Harvest now, decrypt later, we have tons and tons of cybercrime being done 121 00:06:25,146 --> 00:06:28,745 all over the world, and there's tons of data being exfiltrated, and many 122 00:06:28,745 --> 00:06:32,615 of these cybercrime organizations are affiliated with nation state actors. 123 00:06:32,625 --> 00:06:35,356 So Salt Typhoon is sort of the gold standard there. 124 00:06:35,616 --> 00:06:39,686 Highly financed, well-resourced Chinese state organization, two hundred known 125 00:06:39,686 --> 00:06:43,825 incidents in eighty countries, and every time we go back and do a postmortem 126 00:06:43,826 --> 00:06:46,755 on a Salt Typhoon incident, we find out that they were there longer, 127 00:06:46,756 --> 00:06:48,045 they took more stuff, et cetera. 128 00:06:48,396 --> 00:06:52,665 Right now, the data they took is usually encrypted, and so it's, it's not always 129 00:06:52,705 --> 00:06:56,405 worth anything, but they don't lose anything by keeping it around, and China 130 00:06:56,405 --> 00:07:00,515 is absolutely one of the state actors that is doing tons of quantum research. 131 00:07:00,635 --> 00:07:03,835 So ultimately, that harvest now, decrypt later risk, it's here today. 132 00:07:04,105 --> 00:07:09,576 And then the other issue is, yes, Q-day is technically the day where I have to 133 00:07:09,576 --> 00:07:13,515 worry about my encryption algorithm being broken, but the problem is it's going 134 00:07:13,515 --> 00:07:15,556 to take a long time for us to adapt. 135 00:07:15,696 --> 00:07:19,955 So if I'm right, and if in five years we hit Q-day, it's too late. 136 00:07:19,976 --> 00:07:23,355 You have to start preparing for it today because it will take anywhere 137 00:07:23,355 --> 00:07:27,445 from three to five years to get a major portion of your environment moved 138 00:07:27,446 --> 00:07:29,545 over to, to post-quantum algorithms. 139 00:07:29,815 --> 00:07:33,325 It's gonna take a long time to get there, so technically the risk is now Joey, 140 00:07:33,325 --> 00:07:38,345 I love how you have taken eight months of research here at ATP and condensed 141 00:07:38,345 --> 00:07:39,905 it down into a two-minute preamble- 142 00:07:40,465 --> 00:07:41,715 so we can continue the conversation. 143 00:07:42,285 --> 00:07:46,515 That being said, in our research, you and I talk about this every day, and 144 00:07:46,515 --> 00:07:51,305 there is a lot of FUD, a lot of fear, uncertainty, and doubt in the ecosystem 145 00:07:51,305 --> 00:07:55,155 right now when people are trying to figure out how to move forward with PQC. 146 00:07:55,166 --> 00:08:00,075 So how do we balance the pressures of the 2029 and 2030 mandates 147 00:08:00,105 --> 00:08:02,005 against the actual quantum risk? 148 00:08:02,025 --> 00:08:06,296 How do we mitigate that, and how do we put into perspective the reality 149 00:08:06,305 --> 00:08:09,705 that this could actually take years but we don't wanna procrastinate? 150 00:08:10,015 --> 00:08:13,415 Yeah, I mean, I think the way that we do that is by investing in what I 151 00:08:13,415 --> 00:08:15,115 like to call a PQC backbone, right? 152 00:08:15,155 --> 00:08:18,225 And, and for me, fundamentally, the IBM tool set is what does that. 153 00:08:18,475 --> 00:08:22,666 I need to have inventory capabilities, I need to have code scanning capabilities, 154 00:08:22,706 --> 00:08:24,346 and I need to have proxy capabilities. 155 00:08:24,515 --> 00:08:26,725 The inventory, I just need to know where I'm starting. 156 00:08:26,995 --> 00:08:31,235 Code scanning, we- almost every environment has some kind of custom 157 00:08:31,236 --> 00:08:34,985 application, and they don't have an actual CBOM that I can pull from a 158 00:08:34,986 --> 00:08:39,085 scan or from a library or from a, a vendor, so I need to know, like, what my 159 00:08:39,086 --> 00:08:41,656 cryptographic risk is in that static code. 160 00:08:42,016 --> 00:08:43,155 And then I also have to have proxying. 161 00:08:44,645 --> 00:08:48,386 IBM's the only vendor with all those capabilities in the same 162 00:08:48,386 --> 00:08:51,545

portfolio, um, with all those things so tightly integrated. 163 00:08:51,845 --> 00:08:55,985 And so what I, I need to start by doing is giving myself the knowledge 164 00:08:55,985 --> 00:08:59,905 of where I'm at and then figure out, okay, what's riskiest right now? 165 00:09:00,145 --> 00:09:02,266 What do I need to deploy proxies in front of? 166 00:09:02,296 --> 00:09:05,565 Because the proxies are ultimately gonna help me with balancing that pressure. 167 00:09:05,965 --> 00:09:08,556 You would be crazy to go out and start proxying stuff right now 168 00:09:08,556 --> 00:09:09,856 without having an inventory though. 169 00:09:09,866 --> 00:09:11,235 You need to know where you're at. 170 00:09:11,605 --> 00:09:14,355 That inventory needs to be a living document, right? 171 00:09:14,355 --> 00:09:18,145 You will pull your hair out trying to do this if you don't have some sort of 172 00:09:18,175 --> 00:09:19,865 organization to how you're approaching it. 173 00:09:20,145 --> 00:09:24,215 But between the organization and then the proxying, that's gonna give us some 174 00:09:24,215 --> 00:09:27,315 time where we can start working on the actual meat and potatoes of things, 175 00:09:27,535 --> 00:09:33,065 which is if I have an application that's PQC ready, I switch it to using PQC. 176 00:09:33,425 --> 00:09:37,765 If I have something that is not PQC ready, develop that application. 177 00:09:37,855 --> 00:09:43,876 Start moving things like VPNs over to a quantum safe VPN, stuff like that. 178 00:09:43,876 --> 00:09:48,255 It allows me to do the actual changes and move to that native PQC footprint 179 00:09:48,455 --> 00:09:52,422 while having some immediate protection of my most critical data Yeah, and 180 00:09:52,432 --> 00:09:56,281 comically, when we think about this, the way people originally approached the 181 00:09:56,281 --> 00:09:58,492 PQC problem, it was like the Y2K bug. 182 00:09:58,502 --> 00:10:01,262 We're all running around with our hair on fire trying to figure out how to go from 183 00:10:01,262 --> 00:10:05,012 a two-digit date to a four-digit date, but we didn't have enough time to execute 184 00:10:05,012 --> 00:10:08,062 that, and we thought all the lights in the country were gonna go out as a result. 185 00:10:08,121 --> 00:10:12,081 That's really not the case with the PQC strategies that are here. 186 00:10:12,082 --> 00:10:14,281 We have time to implement them, but to your point, we have 187 00:10:14,281 --> 00:10:15,741 to do it in an organized way. 188 00:10:16,001 --> 00:10:19,461 But you hit on something really important earlier, so I wanna dig a little bit 189 00:10:19,462 --> 00:10:24,242 deeper into harvest now, decrypt later, because that also gets used as part 190 00:10:24,242 --> 00:10:27,701 of this get everybody excited about getting it done as soon as possible. 191 00:10:28,041 --> 00:10:31,331 So it is a serious threat, but how serious is it? 192 00:10:31,391 --> 00:10:33,021 And you were talking about

the proxies. 193 00:10:33,281 --> 00:10:37,091 How do those approaches help with the organizations in kind of spacing 194 00:10:37,092 --> 00:10:38,531 out the timeline on their roadmaps? 195 00:10:38,941 --> 00:10:42,492 Good point on the whole, like, Y2K sky is falling thing, because we 196 00:10:42,492 --> 00:10:43,932 don't wanna approach PQC that way. 197 00:10:44,271 --> 00:10:48,741 PQC, uh, remediation and getting to a sort of native quantum safe 198 00:10:48,791 --> 00:10:50,701 movement, it's gonna take a long time. 199 00:10:51,072 --> 00:10:53,482 As we're looking at it, what we need to do is we need to 200 00:10:53,482 --> 00:10:55,781 evaluate the value of the data. 201 00:10:55,971 --> 00:11:00,212 The risk for harvest now, decrypt later is the fact that some data is persistent. 202 00:11:00,371 --> 00:11:04,431 So, uh, medical records, insurance records, these are all actually, like, top 203 00:11:04,431 --> 00:11:07,741 targets of any cyber criminal are gonna be medical things because of the amount 204 00:11:07,741 --> 00:11:10,631 of PII they have in them, the amount of billing information they have in them. 205 00:11:10,812 --> 00:11:13,182 But you're gonna get into things like intelligence systems. 206 00:11:13,182 --> 00:11:14,751 Think of all the background check systems. 207 00:11:14,882 --> 00:11:18,461 The security clearance system got hacked, you know, what, 10, 15 years ago now. 208 00:11:18,801 --> 00:11:22,601 All these things that have some serious value, even if it takes 10 years for 209 00:11:22,601 --> 00:11:27,031 you to open the file, that's kind of where you wanna balance the focus with 210 00:11:27,202 --> 00:11:32,202 harvest now, decrypt later The main thing is just coming up with a plan sooner 211 00:11:32,222 --> 00:11:35,712 rather than later, because I want you to kind of, again, think about if it's 212 00:11:35,902 --> 00:11:40,262 already vulnerable and I don't mitigate it until five years from now, I've just 213 00:11:40,272 --> 00:11:41,642 given them five more years of data. 214 00:11:42,102 --> 00:11:45,701 So I wanna start by mitigating that very important data now. 215 00:11:46,092 --> 00:11:48,962 Eh, do I care maybe if they have all of my, you know, 216 00:11:48,981 --> 00:11:51,882 unclassified, not sensitive emails? 217 00:11:52,122 --> 00:11:55,922 Probably not, but I'm gonna care about things like research and development. 218 00:11:55,991 --> 00:11:57,382 I'm gonna care about patent data. 219 00:11:57,382 --> 00:12:02,322 I'm gonna care about medical records from the VA or troop movement at DoD or DoW. 220 00:12:02,322 --> 00:12:04,431 So it's just prioritizing that. 221 00:12:04,841 --> 00:12:06,791 And then the other thing is kinda how does that work? 222 00:12:06,791 --> 00:12:09,221 I've mentioned the proxies, but I wanna give a little color here in 223 00:12:09,221 --> 00:12:10,761 terms of what they're actually doing. 224 00:12:11,052 --> 00:12:13,202 Those proxies can sit at various

places. 225 00:12:13,202 --> 00:12:16,281 They can either be forward or reverse proxies, and they can 226 00:12:16,282 --> 00:12:18,031 sit across the enterprise, right? 227 00:12:18,032 --> 00:12:19,461 Whether it's on-prem or in the cloud. 228 00:12:19,721 --> 00:12:24,042 IBM's Quantum Safe for Mediator is the tool that creates those actual proxies, 229 00:12:24,321 --> 00:12:25,701 and it does a couple of things for me. 230 00:12:25,701 --> 00:12:31,012 The first is if I have a vulnerable application, it's not PQC ready, it 231 00:12:31,012 --> 00:12:34,592 allows me to put a proxy in there that can actually intercept that 232 00:12:34,592 --> 00:12:36,471 communication from the application. 233 00:12:36,501 --> 00:12:41,102 It's going to re-encrypt that data in a post-quantum algorithm. 234 00:12:41,361 --> 00:12:44,511 And so Salt Typhoon can have it 'cause they can't do anything with it. 235 00:12:44,751 --> 00:12:47,962 At that point, I'm just finding a way to translate that data 236 00:12:47,962 --> 00:12:49,031 into a different encryption. 237 00:12:49,552 --> 00:12:53,392 The other thing I'm doing is I'm actually also setting the stage for being able to 238 00:12:53,401 --> 00:12:57,642 make sure that everybody can play on the same backbone, because otherwise, one 239 00:12:57,642 --> 00:13:03,252 challenge I have is if I have applications talking in PQC and other applications that 240 00:13:03,252 --> 00:13:06,591 don't, then there's a communication error between them, and I wanna make sure that 241 00:13:06,592 --> 00:13:10,091 we're not creating any networking errors, we're not creating any application errors. 242 00:13:10,171 --> 00:13:13,711 A lot of this needs to go into, you know, making sure that we're not 243 00:13:13,711 --> 00:13:16,741 creating additional problems for ourself while we're trying to fix another. 244 00:13:17,052 --> 00:13:21,351 And that kind of provides a lot more space for organizations to plan and 245 00:13:21,431 --> 00:13:25,716 transition Yeah, and what you alluded to there, and you mentioned it before, 246 00:13:25,716 --> 00:13:28,856 if anybody caught it, is the discovery process and how important that is. 247 00:13:28,856 --> 00:13:31,056 And you name-dropped, you talked about IBM there for a second. 248 00:13:31,056 --> 00:13:34,296 And we're not gonna lean on any one vendor or the other because there 249 00:13:34,296 --> 00:13:38,016 are so many vendors now playing in the PQC space, as we've discovered 250 00:13:38,016 --> 00:13:39,066 over the last eight months. 251 00:13:39,086 --> 00:13:41,706 Eight months ago there were five, and now there's 150. 252 00:13:41,975 --> 00:13:44,565 But discovery is at the heart of all this, and there are some 253 00:13:44,565 --> 00:13:45,956 major players in that space. 254 00:13:45,965 --> 00:13:47,995 So let's talk about cryptographic discovery. 255 00:13:48,106 --> 00:13:50,075 That's across the networks, that's across your source code, 256 00:13:50,346 -->

00:13:51,795 that's across your inventories. 257 00:13:51,995 --> 00:13:57,066 Why is that such a foundational keystone part of the success 258 00:13:57,066 --> 00:13:58,755 of anybody's PQC strategy? 259 00:13:59,075 --> 00:14:02,625 The biggest reason is the fact that cryptography is so ubiquitous. 260 00:14:02,676 --> 00:14:05,895 Every single thing we do has some level of cryptography in it. 261 00:14:06,216 --> 00:14:08,006 My emails are encrypted with TLS. 262 00:14:08,016 --> 00:14:10,785 Think of the signatures every time you do an electronic signature when you 263 00:14:10,786 --> 00:14:14,576 buy a house or you sign a contract or whatever, that has encryption to it. 264 00:14:14,705 --> 00:14:18,735 And there's, in fact, right now there is a executive order related specifically 265 00:14:18,766 --> 00:14:22,636 to the signing certificates for things like that sitting on the president's 266 00:14:22,636 --> 00:14:26,576 desk that says, "Hey, by the end of 2027, any signing certificate 267 00:14:26,576 --> 00:14:28,775 needs to be post-quantum algorithm." 268 00:14:28,975 --> 00:14:31,905 So it's just the fact that it extends to everywhere, and because 269 00:14:31,905 --> 00:14:36,125 it extends to everywhere, you end up having this challenge of how do 270 00:14:36,125 --> 00:14:37,445 I know where it's all at, right? 271 00:14:37,445 --> 00:14:40,486 Because I have application issues, I have key generation and key 272 00:14:40,486 --> 00:14:44,805 management issues, I have any number of places that are affected by this. 273 00:14:45,055 --> 00:14:49,085 I also wanna focus on the fact that it's more than just an initial picture, okay? 274 00:14:49,085 --> 00:14:51,755 Inventoring is not a one-and-done situation. 275 00:14:52,175 --> 00:14:55,895 Because cryptography touches everything in the environment, 276 00:14:56,295 --> 00:15:00,245 it means that as I remediate it, my picture changes continually. 277 00:15:00,485 --> 00:15:03,075 How am I gonna check my progress, you know, without an inventory? 278 00:15:03,125 --> 00:15:06,325 If, if I don't have an inventory that's being updated regularly, 279 00:15:06,326 --> 00:15:08,905 I, I just don't know where I'm at and I'm kind of flying blind. 280 00:15:09,286 --> 00:15:11,515 Another thing is how can I report to higher echelons? 281 00:15:11,536 --> 00:15:14,765 Very important, especially in the federal government where you have multiple 282 00:15:14,765 --> 00:15:16,256 layers of management and command. 283 00:15:16,515 --> 00:15:19,435 You know, how am I gonna communicate where we're at to somebody who's trying 284 00:15:19,435 --> 00:15:21,285 to do a roll-up at a higher environment? 285 00:15:21,606 --> 00:15:25,685 Good example, DOW CIO requiring that inventory currently. 286 00:15:25,975 --> 00:15:28,335 And then the other thing is how do I enforce compliance, right? 287 00:15:28,335 --> 00:15:30,745 My inventory isn't just telling me where I'm at, it's telling 288 00:15:30,745 -->

00:15:32,486 me is everybody listening. 289 00:15:32,505 --> 00:15:36,435 And so once we've made the move to certain algorithms and others have 290 00:15:36,436 --> 00:15:40,595 started to become deprecated or, or no longer considered safe, am I making 291 00:15:40,595 --> 00:15:43,055 sure that people are still doing that, still holding the standard? 292 00:15:43,335 --> 00:15:46,325 The main thing I would say is that inventorying is really critical 293 00:15:46,326 --> 00:15:49,996 because of that ubiquity, but as I said, it, it needs to be dynamic. 294 00:15:50,126 --> 00:15:53,445 It needs to be integrated with the other tools because my inventory is, 295 00:15:53,445 --> 00:15:56,766 is not just giving me a picture and then I'm doing everything manually. 296 00:15:57,085 --> 00:15:59,455 I need to be able to initiate tickets. 297 00:15:59,455 --> 00:16:02,975 I need to be able to make sure that we're automating that remediation process 298 00:16:02,975 --> 00:16:04,696 because it touches so many things. 299 00:16:04,705 --> 00:16:06,906 If we do it manually, w- we're just swimming upstream. 300 00:16:07,115 --> 00:16:08,646 And it needs to be continuously updated. 301 00:16:08,745 --> 00:16:13,435 It needs to be a living document Anytime a new technology comes to the forefront, 302 00:16:13,575 --> 00:16:17,656 technologists, strategists, practitioners, we love new buzzwords, right? 303 00:16:17,656 --> 00:16:18,746 That's our favorite thing. 304 00:16:19,376 --> 00:16:23,085 And this is rife with acronyms and new terms that people are probably 305 00:16:23,116 --> 00:16:26,866 googling as we speak, but there is a very important term, I think you 306 00:16:26,935 --> 00:16:31,035 foreshadowed here, that has surfaced as a result of the research we've been 307 00:16:31,065 --> 00:16:34,246 doing and everything we've been studying, and you kind of defined it without 308 00:16:34,246 --> 00:16:35,985 saying it, which is crypto agility. 309 00:16:36,385 --> 00:16:40,025 Crypto agility is what this is really all about, and many organizations 310 00:16:40,026 --> 00:16:43,225 are struggling, as you kind of alluded to, where to start with 311 00:16:43,225 --> 00:16:46,415 their PQC journey, and that crypto agility is at the center of that. 312 00:16:46,555 --> 00:16:50,565 It starts with discovery, it allows them to future-proof their environment 313 00:16:50,576 --> 00:16:53,516 by swapping in and out different cryptographic algorithms, whether 314 00:16:53,516 --> 00:16:55,925 those be classical or PQC or whatever. 315 00:16:56,225 --> 00:16:59,986 But we need to look at day one, and I know you've put together, with help from folks 316 00:16:59,986 --> 00:17:05,146 at ATPGov, a four-step process on what that day one and that process and that 317 00:17:05,146 --> 00:17:07,045 assessment really looks like in practice. 318 00:17:07,056 --> 00:17:08,855 You wanna share that with everybody? 319 00:17:09,356 --> 00:17:09,665 Yeah. 320 00:17:09,665 --> 00:17:12,735 So the process is gonna start with that assessing and inventorying 321 00:17:12,735 --> 00:17:15,346 phase, and I'm gonna go back to the IBM portfolio here just 'cause it 322 00:17:15,356 --> 00:17:17,896 has so many features in that process. 323 00:17:17,905 --> 00:17:21,675 So day one, I'm gonna install Guardian Cryptography Manager, 324 00:17:21,695 --> 00:17:23,185 IBM's inventorying product. 325 00:17:23,546 --> 00:17:25,796 And what I'm gonna do is I'm not reinventing the wheel there. 326 00:17:25,805 --> 00:17:28,036 I'm not going out and doing all new scans on my own. 327 00:17:28,106 --> 00:17:32,315 I do have an Nmap scanner as part of that, that I can go out and do, but I 328 00:17:32,315 --> 00:17:35,806 have tons of scanners and tons of crypto objects already in my environment. 329 00:17:36,116 --> 00:17:39,296 The only difference is each of them is looking at different things, so I don't 330 00:17:39,296 --> 00:17:40,865 wanna have to go to, like, 10 interfaces. 331 00:17:40,885 --> 00:17:44,706 I want one crypto-specific tool that I'm gonna be able to manage that from. 332 00:17:44,945 --> 00:17:47,366 So I'm just gonna pull stuff I already have, and that's gonna 333 00:17:47,375 --> 00:17:50,505 happen in a relatively rapid fashion, a couple of days. 334 00:17:50,675 --> 00:17:53,655 We're gonna run that through policy engine, we're gonna build dashboarding, 335 00:17:54,025 --> 00:17:56,355 and that's gonna sort of be that step one. 336 00:17:56,576 --> 00:18:00,985 That step two, I'm gonna start pulling in additional integrations for that 337 00:18:00,985 --> 00:18:02,645 Guardian Cryptography Manager tool. 338 00:18:02,955 --> 00:18:06,475 So I'm gonna start pulling in, for example, my HSMs, integrating 339 00:18:06,475 --> 00:18:07,835 that into the platform. 340 00:18:08,106 --> 00:18:10,885 I'm gonna be pulling in transparent database encryption, doing all of 341 00:18:10,905 --> 00:18:13,795 my key management stuff, making sure I have all of that stuff 342 00:18:14,005 --> 00:18:16,225 viewable from a single central area. 343 00:18:16,435 --> 00:18:20,255 And then I'm gonna start integrating into other tools like ticketing systems, 344 00:18:20,306 --> 00:18:24,985 CMDBs, ServiceNow, Jira, all of the sort of big names I can put bidirectional 345 00:18:24,985 --> 00:18:28,615 integration in place so that I can run my operations through that. 346 00:18:29,075 --> 00:18:32,385 From there, I'm, I'm also gonna be installing the Quantum Safe Explorer. 347 00:18:32,425 --> 00:18:36,076 I'm gonna be scanning my static code, and all of that, again, gets 348 00:18:36,086 --> 00:18:37,926 put back into the same platform. 349 00:18:38,286 --> 00:18:40,946 It gets integrated into, into Jira, so I'm using that 350 00:18:40,946 --> 00:18:42,975 information in my CI/CD pipeline. 351 00:18:43,295 --> 00:18:46,375 And then I'm gonna move on to sort of that final phase where… 352 00:18:46,675 --> 00:18:49,355 I say final phase,

it's, it's iterative over years, but that sort 353 00:18:49,355 --> 00:18:52,665 of final four-step installation is putting remediation in place. 354 00:18:52,946 --> 00:18:56,445 I've identified what's most risky, what's most relevant to protect, 355 00:18:56,715 --> 00:18:58,255 and I've got my proxies in place. 356 00:18:58,315 --> 00:19:03,002 And at that point, then we're kicking off the marathon And there's a very 357 00:19:03,002 --> 00:19:07,182 important deliverable that gets created in that four-step process, and that's 358 00:19:07,182 --> 00:19:08,812 the cryptographic bill of materials. 359 00:19:08,842 --> 00:19:13,401 And the reason I wanna hone in on that is because as we know, this particular 360 00:19:13,402 --> 00:19:17,742 PQC journey involves not just one team running a scan and generating 361 00:19:17,742 --> 00:19:22,162 a report, it involves the network team, the IT infrastructure team, 362 00:19:22,172 --> 00:19:24,411 the OT teams, the DevSecOps teams. 363 00:19:24,412 --> 00:19:28,152 They all have to run their own cryptographic algorithm discoveries, 364 00:19:28,211 --> 00:19:31,912 produce a cryptographic bill of materials, and then hand that off to the 365 00:19:31,912 --> 00:19:36,011 ISOs and ISMs and the proud folks over on the security team to assess that. 366 00:19:36,012 --> 00:19:38,562 This is much like doing your cat ones, your cat twos, your 367 00:19:38,562 --> 00:19:40,811 cat threes for your ATO process. 368 00:19:40,821 --> 00:19:43,981 You've gotta go back and assure that all of these libraries have been 369 00:19:43,981 --> 00:19:46,551 changed out, that they're up to speed, they meet the mandates, et cetera. 370 00:19:46,801 --> 00:19:51,541 That's a huge amount of additional pressure now, but the key is that CBOM. 371 00:19:51,562 --> 00:19:56,621 So how should the business logic change with respect to this new 372 00:19:56,631 --> 00:20:00,792 variable that we have to pile on top of all the other mission criticalities 373 00:20:00,941 --> 00:20:03,761 that influence, you know, our day-to-day life in federal space? 374 00:20:04,291 --> 00:20:07,021 Yeah, I mean, I think there's gonna be a lot of, um, what I would call 375 00:20:07,021 --> 00:20:08,941 business process decision-making, right? 376 00:20:09,101 --> 00:20:12,921 You- you're gonna get that prioritized output from the cryptography manager 377 00:20:12,991 --> 00:20:15,802 interface, but you're gonna have to go through and ask some, some 378 00:20:15,802 --> 00:20:17,551 questions that are business-focused. 379 00:20:17,561 --> 00:20:18,792 They won't give you the easy answer. 380 00:20:18,991 --> 00:20:20,251 What's my lowest hanging fruit? 381 00:20:20,262 --> 00:20:22,821 You mentioned updating libraries, crypto agility. 382 00:20:22,931 --> 00:20:25,862 I might have applications that run on crypto libraries and 383 00:20:25,862 --> 00:20:27,182 the crypto's not hard-coded. 384 00:20:27,591 --> 00:20:30,672 I can swap those out, and we

may be okay to use that, and so I 385 00:20:30,672 --> 00:20:33,591 might have some low-hanging fruit I can take care of right away. 386 00:20:33,942 --> 00:20:36,742 You know, how difficult is it to remediate these things 387 00:20:36,742 --> 00:20:37,911 from a development standpoint? 388 00:20:37,911 --> 00:20:42,251 I think one way this is very different from regular sort of zero trust operations 389 00:20:42,251 --> 00:20:47,411 is that many of my zero trust remediations are patches or updates, things like that. 390 00:20:47,971 --> 00:20:52,891 This is primarily, not entirely, but a huge chunk of this is development-based. 391 00:20:52,902 --> 00:20:54,041 It's application-based. 392 00:20:54,052 --> 00:20:56,211 So it's, it's a little bit heavier lift. 393 00:20:56,512 --> 00:20:59,302 And then you really have to think about staff and stakeholder. 394 00:20:59,531 --> 00:21:02,261 Yes, I might have a tool that's very, very easy for me to make 395 00:21:02,281 --> 00:21:05,761 PQC ready, but how many different stakeholders have to go through it? 396 00:21:05,861 --> 00:21:08,091 And so ultimately I think there's a number of different things 397 00:21:08,091 --> 00:21:11,381 you have to take from that CBOM, and it's not just plug and play. 398 00:21:11,382 --> 00:21:13,291 You gotta go through that business context. 399 00:21:13,541 --> 00:21:16,652 You stumbled backwards into zero trust, one of the hot ticket 400 00:21:16,662 --> 00:21:20,521 items in the technological zodiac calendar from a couple years ago. 401 00:21:22,614 --> 00:21:26,904 But we've been able to actually take all the different vendors and products and 402 00:21:26,914 --> 00:21:31,554 offerings that exist in the PQC world today, starting from when we were looking 403 00:21:31,554 --> 00:21:36,304 at this early summer last year into the fall when there were very few vendors, 404 00:21:36,304 --> 00:21:39,304 to now where we're, you know, 150-plus vendors, and we were able to actually 405 00:21:39,304 --> 00:21:43,953 take them and overlay them on top of the DoD seven pillars of the zero trust, and 406 00:21:43,953 --> 00:21:47,973 there's actually vendors that can satisfy those requirements as we align them. 407 00:21:48,303 --> 00:21:51,353 Maybe not naming names, you've mentioned some tools already. 408 00:21:51,543 --> 00:21:55,913 What I'm getting at here is what couple of tools, 'cause I don't think you can 409 00:21:55,914 --> 00:21:57,633 solve this problem with just one tool. 410 00:21:57,634 --> 00:21:59,884 There's no silver bullet, just like there is no silver bullet- 411 00:21:59,893 --> 00:22:01,003 Yeah … for solving zero trust. 412 00:22:01,283 --> 00:22:06,563 What tools help organizations go from awareness to actionable remediation? 413 00:22:06,563 --> 00:22:07,894 What do they need in their toolkit? 414 00:22:08,123 --> 00:22:10,374 And I'm, I'm banging the drum pretty hard on IBM. 415 00:22:10,374 --> 00:22:11,873 I'll mention some other things as well. 416 00:22:12,133 --> 00:22:16,463 But IBM overall is gonna have that sort of big programmatic spine for me, right? 417 00:22:16,814 --> 00:22:20,814 So Guardian Cryptography Manager is gonna give me prioritized recommendations. 418 00:22:20,994 --> 00:22:23,864 It's gonna keep me informed with progress, and it's gonna prevent 419 00:22:23,884 --> 00:22:25,504 backsliding, enforcing compliance. 420 00:22:25,514 --> 00:22:28,024 So I'm not just looking at a list of things. 421 00:22:28,364 --> 00:22:31,973 This is, "Hey, how do we actually move the program along?" Quantum Safe 422 00:22:31,974 --> 00:22:35,913 Explorer, we're going to be integrating into an existing CI/CD pipeline. 423 00:22:35,914 --> 00:22:37,364 We don't have to reinvent the wheel. 424 00:22:37,724 --> 00:22:40,603 But even more than that, Quantum Safe Explorer is not just telling me 425 00:22:40,603 --> 00:22:44,324 something's vulnerable, it's telling me where in the code it's vulnerable, and 426 00:22:44,324 --> 00:22:46,544 I can use that as part of my next steps. 427 00:22:46,554 --> 00:22:49,783 So I can dump it into Jira and say, "Hey, fix this. Here's what needs to 428 00:22:49,783 --> 00:22:52,064 go get fixed," to my development team. 429 00:22:52,384 --> 00:22:55,674 But I can also use it in conjunction with, with new code tools, so I 430 00:22:55,674 --> 00:22:59,314 can integrate this with Claude, I can integrate this with IBM Bob. 431 00:22:59,573 --> 00:23:03,634 Pretty much any AI code tool will be able to use these results to help 432 00:23:03,654 --> 00:23:05,453 you with the coding remediation. 433 00:23:05,713 --> 00:23:08,964 So I'm getting the instructions from an automatic scanner, and I'm 434 00:23:08,974 --> 00:23:10,683 dumping them into an automatic coder. 435 00:23:10,983 --> 00:23:14,294 And yes, as the human, I'm gonna be in the loop, but it's really 436 00:23:14,294 --> 00:23:15,904 moving to actionable remediation. 437 00:23:16,064 --> 00:23:20,643 Quantum Safe Remediator, yeah, it's giving me immediate protection via proxies, but 438 00:23:20,643 --> 00:23:22,454 I also have a test harness in there too. 439 00:23:22,753 --> 00:23:26,803 It's pointless if I solve one problem, uh, by getting the PQC right, but 440 00:23:26,803 --> 00:23:28,183 the application doesn't work well. 441 00:23:28,193 --> 00:23:30,053 I need to make sure the applications are working well, 442 00:23:30,064 --> 00:23:31,373 I'm not creating new problems. 443 00:23:31,534 --> 00:23:34,424 But then there's a number of different things that you'll be able to, to move 444 00:23:34,424 --> 00:23:36,234 on to as you get this information. 445 00:23:36,443 --> 00:23:39,564 Yes, I'm gonna be working on applications, but I'm also gonna be looking at, 446 00:23:39,733 --> 00:23:44,543 okay, uh, does my key manager have the ability to work through PQC algorithms? 447 00:23:44,863 --> 00:23:45,834 Do I have enough hardware? 448 00:23:45,834 --> 00:23:48,054 So for example, do I

have big enough TPM cards? 449 00:23:48,054 --> 00:23:52,103 Do I have HSMs that are capable of much larger algorithms? 450 00:23:52,384 --> 00:23:56,183 Do I have any sort of good entropy, right? 451 00:23:56,233 --> 00:23:57,393 I need good entropy. 452 00:23:57,393 --> 00:24:00,913 I need good real quantum random number generation if I'm gonna 453 00:24:00,924 --> 00:24:02,054 strengthen my algorithms. 454 00:24:02,054 --> 00:24:04,983 And, and that'll strengthen not just my existing or my PQC 455 00:24:04,983 --> 00:24:07,713 algorithms, it'll strengthen my classical algorithms as well. 456 00:24:08,134 --> 00:24:12,333 The tools are sort of a starting point, and they feed into the ones I've 457 00:24:12,333 --> 00:24:13,663 talked about, you know, mostly today. 458 00:24:13,663 --> 00:24:17,244 They feed into everything else, and they allow us to start saying, "Okay, I 459 00:24:17,244 --> 00:24:19,474 know where my OT security is right now. 460 00:24:19,693 --> 00:24:24,253 Let me go ahead and put something like BlastWave in front of my OT tools," and 461 00:24:24,253 --> 00:24:28,303 that can use PQC algorithms, and all that information's gonna flow up into that 462 00:24:28,303 --> 00:24:33,460 centralized system Yeah, and there's so many interoperation points involved in 463 00:24:33,460 --> 00:24:37,710 this because we are dealing at such a low level on a lot of different technology. 464 00:24:37,710 --> 00:24:40,720 Some of those are open source, some of those are closed, where we have to wait 465 00:24:40,720 --> 00:24:42,270 for the manufacturers to get involved. 466 00:24:42,270 --> 00:24:45,639 I mean, if we just talk about operating systems alone, we know that Red 467 00:24:45,649 --> 00:24:49,500 Hat is working on making the later versions of Red Hat all PQC ready. 468 00:24:49,739 --> 00:24:51,769 You know, Microsoft is trailing behind, things like that. 469 00:24:51,769 --> 00:24:53,159 There's a lot of moving parts. 470 00:24:53,300 --> 00:24:56,349 So that is to say, this is not a smooth road. 471 00:24:56,349 --> 00:24:57,379 It's full of cobbles. 472 00:24:57,639 --> 00:25:00,970 And I wanted to ask you, from your opinion, looking at everything we've 473 00:25:00,970 --> 00:25:04,809 looked at over the last eight months plus, what's the biggest operational 474 00:25:04,829 --> 00:25:08,289 challenge that agencies are facing when trying to fix these types 475 00:25:08,289 --> 00:25:10,069 of cryptographic issues at scale? 476 00:25:10,070 --> 00:25:12,729 I mean, this is unlike anything we've ever done before. 477 00:25:12,849 --> 00:25:16,159 And from the tools that you've been suggesting, how does their automation 478 00:25:16,239 --> 00:25:20,180 help, or are there some drawbacks where, like you said, the human still 479 00:25:20,180 --> 00:25:23,529 has to be involved to make sure it goes over as smoothly as possible? 480 00:25:23,739 --> 00:25:26,549 The biggest challenge with deployment is just the breadth of 481 00:25:26,550 --> 00:25:28,179 things that cryptography touches. 482 00:25:28,460 --> 00:25:31,199 The fact that so much of this is application-based. 483 00:25:31,230 --> 00:25:34,329 I mean, I can't just go… And beware if anybody comes to you and tells you, 484 00:25:34,340 --> 00:25:38,009 "Our new hardware tool is gonna solve your PQC challenges." It's not true. 485 00:25:38,380 --> 00:25:41,889 That hardware tool may have a card that can handle the additional 486 00:25:41,889 --> 00:25:43,779 strain of quantum algorithms. 487 00:25:43,959 --> 00:25:47,079 It may be beefier, it may be compatible to do those things, 488 00:25:47,389 --> 00:25:48,939 but PQC touches everything. 489 00:25:48,939 --> 00:25:50,679 It's a program, it's not one tool. 490 00:25:50,969 --> 00:25:55,310 And so that breadth of what it touches is truly the biggest challenge. 491 00:25:55,660 --> 00:25:58,420 My biggest advice for that challenge is, it's human advice, 492 00:25:58,469 --> 00:25:59,669 not necessarily tool advice. 493 00:25:59,950 --> 00:26:01,789 View it as, you know, years long journey. 494 00:26:01,789 --> 00:26:04,949 You're gonna take two or three years to even get, get a bunch 495 00:26:04,950 --> 00:26:06,130 of this remediation done. 496 00:26:06,139 --> 00:26:09,399 You can get to immediate protection in a few months, but it's gonna take 497 00:26:09,410 --> 00:26:10,779 a while to start moving through that. 498 00:26:10,779 --> 00:26:14,289 So view it as an iterative process, and just put it as part of one of 499 00:26:14,289 --> 00:26:16,060 those continuous improvement cycles. 500 00:26:16,259 --> 00:26:18,679 But that's kind of why the automation is so important. 501 00:26:18,770 --> 00:26:22,659 I'm glad to see that entities, um, like IBM have built in so much 502 00:26:22,669 --> 00:26:24,339 integration, so much automation. 503 00:26:24,349 --> 00:26:27,829 The point is that I don't want to go from platform to platform. 504 00:26:28,120 --> 00:26:31,719 I want to be able to create messaging, to be able to open tickets, to be 505 00:26:31,719 --> 00:26:36,009 able to run things between these platforms because it touches so much. 506 00:26:36,239 --> 00:26:39,446 If we create more manual steps, we're just gonna be behind Yeah, and I think 507 00:26:39,446 --> 00:26:45,196 you underscored a very important point is that manufacturers like IBM, Palo Alto, 508 00:26:45,196 --> 00:26:48,856 and others, even Red Hat, the operating system manufacturers, they're building 509 00:26:48,856 --> 00:26:51,706 platforms and not point solutions. 510 00:26:51,806 --> 00:26:55,845 And if I look back over my 20-plus years in the technology space, it's always 511 00:26:55,846 --> 00:26:58,155 been, you know, something like zero trust, where I'm gonna create this little 512 00:26:58,156 --> 00:26:59,785 tool that does this fun little function. 513 00:27:00,005 --> 00:27:03,775 This is so comprehensive and so expansive that the big investment 514 00:27:03,795 -->

00:27:07,665 is building these comprehensive platforms that can attack this at every 515 00:27:07,666 --> 00:27:08,995 level, which I think is really cool. 516 00:27:09,005 --> 00:27:10,676 We haven't seen this in a long time. 517 00:27:10,885 --> 00:27:14,066 So that's something to keep in mind is when you're investing in these 518 00:27:14,075 --> 00:27:17,575 products, you're investing in a platform and not just a Band-Aid solution. 519 00:27:17,876 --> 00:27:22,586 But to that end, let's talk about the future a little bit, because this is 520 00:27:22,595 --> 00:27:24,936 a shifting sands type of environment. 521 00:27:24,936 --> 00:27:25,995 It's constantly evolving. 522 00:27:25,995 --> 00:27:29,795 Like I said, over the last eight months, we've gone from five products to 150-plus 523 00:27:29,795 --> 00:27:31,865 products, and it continues to grow. 524 00:27:32,165 --> 00:27:35,726 Let's reframe that, 'cause I don't wanna focus just on the vendors, 525 00:27:35,755 --> 00:27:40,175 but let's talk about what does true crypto agility look like in a federal 526 00:27:40,176 --> 00:27:44,305 organization, and how should our leadership measure progress toward 527 00:27:44,345 --> 00:27:46,645 quantum resilience in the next few years? 528 00:27:47,408 --> 00:27:48,068 Yeah, great question. 529 00:27:48,328 --> 00:27:51,318 To make sure I define the term, too, I don't remember if I did an actual 530 00:27:51,318 --> 00:27:55,498 definition or not, but for folks listening, crypto agility is basically 531 00:27:55,498 --> 00:27:57,428 our ability to swap out algorithms. 532 00:27:57,507 --> 00:28:01,487 Right now, many applications are written with their cryptographic 533 00:28:01,487 --> 00:28:04,197 frameworks actually hard-coded in the, in the application code. 534 00:28:04,558 --> 00:28:07,928 So if I wanna change my algorithms, I have to go actually redevelop 535 00:28:07,928 --> 00:28:10,987 my application, and that's not where we wanna be from here on. 536 00:28:11,247 --> 00:28:14,348 Twenty years ago it was fine, but the landscape is changing now. 537 00:28:14,467 --> 00:28:18,678 So what I want is I wanna be able to have a cryptographic library that is actually 538 00:28:18,858 --> 00:28:24,578 attached to that application so that if I need to change my algorithms, I just pull 539 00:28:24,578 --> 00:28:29,027 the library out and I insert a new library in, and that gives me crypto agility. 540 00:28:29,028 --> 00:28:31,877 It gives me the ability to change my crypto kind of as needed. 541 00:28:32,127 --> 00:28:34,187 Why is that really that important? 542 00:28:34,307 --> 00:28:36,217 'Cause, you know, we're just changing this one time, right? 543 00:28:36,318 --> 00:28:36,857 I don't know. 544 00:28:36,888 --> 00:28:37,658 I don't think so. 545 00:28:37,877 --> 00:28:41,407 When we finally hit Q-day, it might be that one of the quantum-resistant 546 00:28:41,407 --> 00:28:43,967 algorithms has some sort of problem that we don't know about. 547 00:28:43,987 --> 00:28:46,947 As of now, we believe that they're quantum-safe, and we'll see kind of 548 00:28:46,947 --> 00:28:50,758 how they hold up because, you know, this is just like any other zero trust. 549 00:28:50,767 --> 00:28:53,508 There's always somebody trying to find that weakness in the armor. 550 00:28:53,757 --> 00:28:58,547 So for me, the way I think about how we would, you know, measure crypto 551 00:28:58,548 --> 00:29:01,907 agility is gonna be kind of actually through a series of questions. 552 00:29:02,118 --> 00:29:04,537 Can I answer yes to these questions honestly? 553 00:29:04,698 --> 00:29:08,757 So does my organization have a dynamic, integrated, and 554 00:29:08,777 --> 00:29:10,517 automatically updated posture tool? 555 00:29:10,698 --> 00:29:13,577 If I don't have that, I think I've already failed at crypto agility 556 00:29:13,597 --> 00:29:14,697 'cause I don't know what I'm doing. 557 00:29:14,978 --> 00:29:19,507 Now, do I have a team with eyes on the crypto problem, or is this just something 558 00:29:19,507 --> 00:29:20,917 we're responding to sporadically? 559 00:29:21,298 --> 00:29:23,867 There has to be a team, whether they're, they're full-time or they're 560 00:29:23,868 --> 00:29:27,648 sort of tasked with extra duty, but do I have a team that's dedicated 561 00:29:27,648 --> 00:29:30,018 to continuous iterative improvement? 562 00:29:30,018 --> 00:29:31,558 'Cause it's not gonna happen in one sprint. 563 00:29:31,857 --> 00:29:35,817 Can I say, within a few hours of research, what our next steps 564 00:29:35,908 --> 00:29:39,598 should be based on business value, risk conditions, et cetera? 565 00:29:39,827 --> 00:29:41,957 And maybe it's a couple days, maybe it's a couple hours. 566 00:29:41,957 --> 00:29:45,777 It's gonna depend a little bit on the, the complexity, but the point is, do 567 00:29:45,777 --> 00:29:49,347 I have the ability to come up in a short period of time with what the 568 00:29:49,347 --> 00:29:51,527 next step in that iterative process is? 569 00:29:51,537 --> 00:29:54,697 If we get to the end of the step we're on and then we just feel like we're in the 570 00:29:54,697 --> 00:29:59,553 dark again, that's not gonna be sufficient to address this threat Can I convey my 571 00:29:59,553 --> 00:30:01,464 posture and risk to higher echelons? 572 00:30:01,464 --> 00:30:02,343 They're gonna wanna know it. 573 00:30:02,533 --> 00:30:04,504 I don't wanna be hand jamming spreadsheets. 574 00:30:04,543 --> 00:30:07,043 People are doing that right now with the DOW mandate. 575 00:30:07,224 --> 00:30:10,624 We don't wanna hand jam spreadsheets of CBOMS to try and report that higher. 576 00:30:10,953 --> 00:30:15,444 And then, kind of the final question to me is, is my process, is all 577 00:30:15,444 --> 00:30:18,803 of this stuff we've just talked about integrated and automated? 578 00:30:18,813 --> 00:30:20,093 I don't want silos. 579 00:30:20,323 --> 00:30:23,614 I don't want

any more manual processes than I need to, 'cause there's already 580 00:30:23,614 --> 00:30:26,904 gonna be a lot of human-centric processes as part of this movement. 581 00:30:26,914 --> 00:30:30,633 So we wanna make sure we're not creating ex- extra problems for ourselves. 582 00:30:30,833 --> 00:30:34,783 And I would say that the tools that we have available, PQC tools, 583 00:30:34,783 --> 00:30:36,043 they're ready for primetime, okay? 584 00:30:36,043 --> 00:30:39,343 I know there's some, some worry about whether the tools are ready. 585 00:30:39,533 --> 00:30:41,633 Am, am I gonna spend millions of dollars on vaporware? 586 00:30:41,863 --> 00:30:43,543 No, like, that's not where the market is. 587 00:30:43,763 --> 00:30:47,293 You need to be smart about what you're starting with, because some things are 588 00:30:47,293 --> 00:30:49,143 niche and some things are enterprise. 589 00:30:49,254 --> 00:30:50,354 So you gotta be smart that way. 590 00:30:50,423 --> 00:30:55,013 But overall, PQC's ready, it's here, and we can help de-risk it at ATP. 591 00:30:55,383 --> 00:30:59,143 We can actually give you a good sense of, what am I actually going 592 00:30:59,144 --> 00:31:00,884 to get by investing this money? 593 00:31:01,193 --> 00:31:04,683 Well, Joey, I can't thank you enough for bringing us up to speed. 594 00:31:04,693 --> 00:31:08,143 I've had so much fun working on this with you since last summer. 595 00:31:08,153 --> 00:31:11,263 I'm really looking forward to seeing where the PQC journey is 596 00:31:11,274 --> 00:31:13,324 going and continuing this research. 597 00:31:13,494 --> 00:31:16,404 And with that said, I wanna remind everybody that's listening that they 598 00:31:16,404 --> 00:31:21,043 can stay on the pulse of our PQC and quantum computing research by following 599 00:31:21,043 --> 00:31:24,573 our podcast, The Bottom Line Up Front, everywhere you download, stream or 600 00:31:24,573 --> 00:31:28,713 listen to podcasts, and be sure to visit our website atpgov.com for 601 00:31:28,713 --> 00:31:31,223 the latest articles related to PQC. 602 00:31:31,234 --> 00:31:37,593 You can email any of us at info@atpgov.com or reach out via social media on LinkedIn. 603 00:31:37,963 --> 00:31:38,393 Awesome. 604 00:31:38,793 --> 00:31:39,423 Fantastic. 605 00:31:39,454 --> 00:31:41,413 Thank you again to everyone who joined us today. 606 00:31:41,423 --> 00:31:43,483 Appreciate your time and participation. 607 00:31:43,673 --> 00:31:44,553 Have a great afternoon. 608 00:31:45,013 --> 00:31:52,713 Be sure to reach out to ATP Gov today at www.atpgov.com or email info@atpgov.com or 609 00:31:52,713 --> 00:31:54,973 check us out on social media on LinkedIn. 610 00:31:55,213 --> 00:31:58,113 Thanks for listening, and be sure to subscribe to The Bottom Line Up 611 00:31:58,113 --> 00:31:59,484 Front wherever you get your podcasts. 612 00:31:59,804 --> 00:32:02,713 And stay tuned for more distilled insights from the front lines 613 00:32:02,713 --> 00:32:04,544 of tech and national security. 614 00:32:04,594 --> 00:32:07,733 So until next time, stay secure, stay mission ready.