Quantum Cybersecurity Risk Assessment in Banking — In Practice

Hand holding a credit card with a padlock icon

Overview

Find out how a bank decided to explore its quantum cybersecurity readiness, the reasons that motivated its quantum cybersecurity journey, and how Cystel helped kick-start the quantum cybersecurity risk assessment process.

Introduction

The starting point of the bank's quantum cybersecurity journey was an awareness training session about the impact quantum computers can have on the institution's cybersecurity. Specifically, the session covered current developments in quantum technology, global efforts for quantum resilience, the dangers of using outdated cryptography, and current and upcoming quantum guidelines.

Current Developments in Quantum Technology

Chess pawn on a glowing circuit board

Quantum technology is no longer a distant concern but an urgent priority, driven in part by regulatory changes like the Quantum Computing Cybersecurity Preparedness Act. This U.S. legislation requires federal IT systems to implement quantum-resistant cryptography, setting a standard with global implications. International businesses — and those working with the U.S. — now need to adapt to evolving cybersecurity standards that account for the potential threats posed by quantum computing. Failure to do so could result in exclusion from markets adhering to these legislative mandates.

The advent of the quantum era threatens to render existing cybersecurity measures obsolete, putting sensitive data and critical infrastructure at real risk. With the rapid pace of quantum advancements, some estimates suggest current cryptographic systems could be meaningfully compromised as early as the early 2030s. This poses significant threats to financial transactions, healthcare records, and national security communications. Without strong quantum-resistant frameworks, organizations face disruptions and breaches that could seriously affect their operations. The "Harvest Now, Decrypt Later" principle underscores the urgency: data encrypted today must be resilient against future quantum attacks, making outdated systems a liability in current procurement strategies.

Global Efforts for Quantum Resilience

World map with a glowing global network overlay

In response to concerns about nations seeking technological superiority, the FBI and its Quantum Information Science Counterintelligence Protection Team (QISCPT) are strengthening collaboration across sectors to safeguard technological advancements and prevent espionage.

Worldwide, initiatives for quantum readiness are gaining momentum — highlighted by the World Economic Forum's Quantum Readiness Toolkit and the Monetary Authority of Singapore's cybersecurity circular directed at financial leaders.

These efforts reflect a global commitment to preparing for the quantum era. Achieving this goal requires a concerted effort from industry leaders to establish standards, understand legislative changes, and invest in quantum-resistant technologies to protect future operations.

The Dangers of Using Outdated Cryptography

Broken chains with glowing embers

Relying on outdated cryptographic systems exposes organizations to a range of malicious activities that could significantly disrupt operations. Cybersecurity vulnerabilities may allow attackers to manipulate documents through forged updates or fraudulent authentication, decrypt confidential historical data, and undetectably alter legal documents by counterfeiting digital signatures.

Additional risks include the creation of fake website identities and software downloads — which can deceive users and spread malware — as well as extortion attacks, where attackers threaten to disclose sensitive data unless a ransom is paid. In a worst-case scenario, it could eventually become difficult to distinguish between authentic and fake banking or retail websites.

Current and Upcoming Quantum Guidelines

The White House, through National Security Memorandum 10, has outlined specific actions for federal agencies as the United States embarks on the multi-year journey to transition vulnerable computer systems to quantum-resistant cryptography. The goal is a timely shift to interoperable quantum-resistant cryptographic systems. This process involves creating a cryptographic bill of materials (CBOM), forming working groups to facilitate adoption of quantum-resistant cryptography, and following a timeline for phasing out quantum-vulnerable cryptography by 2035, in step with new standards released by NIST. These developments aren't confined to the United States — similar efforts are underway globally.

Assessing and Improving the Quantum Cybersecurity Posture, in Practice

After the awareness training session, Cystel was contracted to pursue a four-pronged approach:

Cystel's four-pronged approach: Vulnerability Scanning, Cryptographic Asset Scanning, Cryptographic Asset Inventory, Quantum Risk Assessments

Key Findings of the Assessment

1. SSL/TLS Protocols

The usage of TLSv1.1 was identified. It was recommended to disable TLSv1.1 and transition to quantum-resistant protocols, such as those compatible with post-quantum cryptographic algorithms.

2. Weak Ciphers

Numerous weak ciphers with a key size of 128-bit were observed. Given the threat posed by quantum computers, an upgrade to 256-bit key ciphers and the adoption of quantum-resistant algorithms were recommended.

3. SSL Certificates

Immediate renewal of expired SSL certificates was highlighted as crucial.
SSL certificates nearing expiry require timely renewal, with a focus on incorporating post-quantum cryptographic standards.
The client was advised to adhere to SSL certificate best practices, considering the evolving landscape of quantum security.

Additional Observations and Recommendations

Areas of Improvement

Critically out-of-date operating systems and weak patching practices persist.
Older, vulnerable versions of SSL and TLS are present.
Missing reverse DNS lookup entry.
Server certificates with mismatches.
Ineffective tracking of certificate expiry dates.
Old vulnerabilities associated with known Common Vulnerabilities and Exposures (CVEs) are not mitigated.
Cryptographic algorithms vulnerable to quantum attacks are present.

Prioritized Recommendations

Swiftly transition to post-quantum cryptographic standards, ensuring the compatibility of SSL and TLS versions.
Mitigate vulnerabilities associated with known CVEs through patching and system upgrades, with a focus on quantum-resistant measures.
Implement a robust quantum-safe certificate management process or tool.
Ensure server certificates align with quantum-resistant cryptographic practices.
Disable session renegotiation completely, considering quantum security implications.
Increase the length of SSL server default Diffie-Hellman prime and variable numbers to quantum-resistant standards.
Review and install valid certificates signed by trusted quantum-safe certificate authorities.

Other Recommended Best Practices for Quantum Security

Stay informed about advancements in quantum-resistant cryptographic standards.
Regularly update and assess cryptographic protocols to align with quantum-safe alternatives.
Integrate quantum-safe cryptographic algorithms into the overall security strategy.
Collaborate with quantum-resistant cryptographic experts to stay ahead of evolving threats.

For questions about this case study, reach out to us at info@cystel.org.