As outlined in the recent UK Finance report, harnessing quantum's potential will require proactively addressing a multitude of risks. This article highlights the key cybersecurity threats posed by quantum computing to the finance sector, based on that report.

Of particular concern are widely used cryptographic methods such as RSA and ECC that underpin various layers of the technology estates supporting most products and services across the UK's financial services sector.

This pervasiveness amplifies the urgency of addressing potential quantum vulnerabilities, with these commonly utilised cryptographic methods deeply embedded in the hardware and software technology solutions that have been developed over decades. In some instances, these are deployed by in-house teams, while others have been deployed by vendors and partners.

Compromise of RSA and ECC by cryptographically relevant quantum computers (CRQCs) could undermine critical aspects of financial operations such as data security and communication privacy.

What is a Cryptographically Relevant Quantum Computer (CRQC)? The quantum computers available in 2023 do not have the number of qubits or the quality required to run Shor's Algorithm for the large numbers used in public key cryptography. Current quantum computers are "noisy intermediate scale quantum computers," or NISQ, but the technology is improving — the number of qubits increased from 5 (in 2016) to 433 (in 2023), with quality improving alongside scale. A CRQC is one that has the potential to break current public key systems, a definition drawn from the US National Security Agency (NSA).

Recognising and understanding these vulnerabilities is paramount for UK financial institutions and underscores the necessity of adopting novel encryption methods capable of standing up to quantum threats. Proactively embracing such methods will enable the financial sector to fortify itself for a future where data remains secure, even in the face of formidable quantum computers.

1. Cryptographic Risk — The Looming Vulnerability

The most significant risk stems from the ability of powerful quantum computers to break current encryption methods like RSA and ECC that underpin critical systems across financial services. This cryptographic vulnerability could allow bad actors to:

• Decrypt stored personal and customer data that has been intercepted and stockpiled awaiting quantum decryption capabilities
• Bypass authentication in wholesale payment systems like SWIFT to enable fraudulent transactions
• Compromise interconnected systems like Open Banking APIs to access sensitive financial data
• Undermine blockchains and distributed ledgers by altering foundational blocks
• Gain privileged administrative access to core banking infrastructure
• Manipulate software updates and transaction records

The consequences could be disastrous — from mass data privacy breaches to crippling financial system failures and market instability. As quantum computing matures, migrating to quantum-resistant encryption is an imperative to protect data integrity and maintain consumer trust.

What is "Q-Day"? Shorthand for when a cryptographically relevant quantum computer is available that can break a production public key system (e.g., RSA-2048).

What is the "store now, decrypt later" threat? One risk arising from quantum technology is known as the "store now, decrypt later" scenario. The essence of this threat lies in the potential capability of a CRQC — potentially operated by state or state-backed groups — to retroactively decrypt data that has been stored with current encryption methods. This has profound implications for financial firms tasked with safeguarding their clients' confidential information, transaction records, and proprietary data — and poses significant challenges for any organisation with obligations to securely retain sensitive data, not just those in the financial services sector.

2. Spotlight on Market Stability

Beyond cryptographic risk, quantum computing also threatens market stability if not adopted equitably. Early institutional investors could gain outsized trading advantages from quantum-accelerated algorithms and high-frequency trading systems. This could trigger flash crashes, distortions, and cascading systemic risks without proper safeguards. Cross-sector collaboration to share knowledge will be crucial for more balanced adoption.

3. Talent Shortages and Skills Gaps

Highly specialised quantum skills are currently extremely scarce. Financial institutions must enhance professional development programs to "upskill" existing technology workforces. Academic partnerships and tailored curricula will also be needed to cultivate the next generation of quantum-literate talent.

4. Technological Debt — A Roadblock

Outdated legacy systems and technical debt incurred over years of iterative software development may impede seamless quantum integration. Financial firms must conduct comprehensive risk assessments to identify potential roadblocks within their digital estates.

5. Ethical and Environmental Factors

The societal implications of quantum computing should not be overlooked. Considerations around ethical AI, cryptographic sovereignty, environmental impacts, and public-private collaboration will all come into play as this powerful technology progresses.

What is "Quantum Safe"? The concept of a system, entity, organisation, or collective achieving a state where they are prepared to counter the threats posed by quantum technology.

By understanding these multifaceted risks, financial services organizations can begin formulating robust transition plans to become truly quantum-safe and cyber-resilient. Proactive cross-industry initiatives, pilot programs, and public-private partnerships will be critical enablers.

As Martha Lane Fox, President of the British Chamber of Commerce, put it in June 2023: "Never mind AI — quantum computing is the next big thing."

Financial Institutions Leading the Way in Quantum Security

Several major UK banks and financial institutions are already taking proactive steps to harness quantum computing for cybersecurity:

• HSBC has established a dedicated quantum computing research team exploring uses like fortifying encryption, detecting fraud, and optimizing portfolios. In 2022, they announced partnerships with quantum hardware firms like IonQ.
• Barclays has invested over £10 million in quantum technology initiatives. Their quantum cryptography program aims to develop quantum-safe algorithms and communications protocols.
• Goldman Sachs has filed patents for quantum encryption techniques and quantum cloud security infrastructure. They're collaborating with IBM to use quantum for risk analysis.
• J.P. Morgan partners with University of Calgary scientists on quantum key distribution research to secure data transmission channels against hacking threats.

While still early days, these initiatives demonstrate that the finance sector is proactively working to get ahead of the quantum cybersecurity curve. Continued investment, collaboration, and talent development will be critical for widespread adoption.