Addressing the quantum risks to encryption - what is the balance between being aware and being afraid?

2025 is the International Year of Quantum, and so we have seen a drumbeat of stories about advances in quantum technology. In particular there have been a lot of headlines about progress towards building a “useful” quantum computer. It is generally accepted that a quantum computer that is big enough and accurate enough could threaten some forms of encryption that we rely upon to secure our networks. However, there are a range of views on the nature and imminence of the threat, from those who forecast an apocalypse to those who say it’s no big deal. As usual, the answer is somewhere in between, and this talk aims to equip information security professionals to understand the nature of the threat, including the timescales, likelihood and impacts, and to be able to plan and take appropriate action at the appropriate time.

We will do this by reviewing and assessing the latest developments over the last 12 months. This includes going behind the marketing headlines to understand what quantum computers can do today and the roadmap to them being “cryptographically relevant”. We will also look at developments of the standards to address quantum threats in the 12 months since NIST announced the first FIPS standards for quantum resistant cryptography, including further work by NIST, by other standards bodies and recommendations from government bodies including ASD. The last part of the jigsaw will be to discuss the experiences of initial implementations of upgrades, and what can be learnt from these.

The talk will conclude by bringing this together to provide practical guidance to help organisations to understand the risks, prioritise what they need to do, select appropriate solutions, and develop a pragmatic roadmap to get there.