How the world can prepare for quantum-computing cyber risks 

Quantum computers are a technological step-change that look like they could have had their roots in 19th-century science fiction or steampunk art, an aesthetic that blends industrial era imagery like cogs, clockwork, and machine parts with Victorian art and design, and includes futuristic elements like robotics and artificial intelligence

This could be why they are often viewed as computers of the future or part of science fantasy. However, recent advances in the technological underpinnings of quantum computing, as well the required error correction code capabilities, are slowly migrating the conversation from ‘if’ to ‘when’.

When quantum computing becomes more fully available, it will be capable of performing large numerical calculations such as the statistical modelling of chemistry, how we create materials and more accurate predictions of weather patterns.

Along with this modelling ability, quantum computing has the potential to factor large numbers. This could threaten the basis of public-key cryptography algorithms that underpin many of our daily commercial activities such as online payments, secure communications, and a myriad of trusted internet transactions.

Although we still don’t know exactly when this threat will materialize, it is prudent that organizations review their current cryptographic reliance and start to think about when they will need to migrate to post-quantum cryptography.

Post-quantum cryptography is currently being developed under the auspices of the National Institute for Standards and Technology (NIST) and there is reason to be optimistic about the future availability of tools to mitigate the threat posed to cryptography by quantum computing.

Managing cybersecurity risks

As with many types of technology disruption, getting the right messaging to every level of an organization is crucial. This helps determine that there is neither undue alarm nor complacency at either end of the spectrum.

In response, the World Economic Forum's Global Future Council on Cybersecurity (GFC on Cybersecurity) has identified several different audience personas for quantum and drawn up recommendations tailored for each audience type. These recommendations guide audiences on how to approach the cybersecurity risk aspects of quantum computing, and how to take action.

They are particularly useful for chief information security officers who assess specific risks, and for corporate leaders who must understand that risk in the broader organizational and regulatory context. The recommendations help set out the paradigm shift posed by quantum computing advances and ensure that unprepared organizations can mitigate their vulnerabilities.

Policymakers and standards organizations

Corporate leaders and boards

Chief information security officers

Cybersecurity and privacy practitioners

Data protection laws and policies need to be simplified so that end-users and consumers can understand them. This needs to happen quickly because of the paradigm shift that quantum computing could bring about.

While the GFC on Cybersecurity recommendations are likely to be generally accepted as sound practice, the projected quantum-computing paradigm shift could make unprepared organizations especially vulnerable.

Quantum computing isn’t a threat, but it may be a double-edged sword. While it will create value and may also enhance some elements of security, the less we know about it the more risk we will face. We need to start educating leaders, organizations and citizens right now. And tailoring the message to the right target audience is key.

Under the umbrella of the Quantum Computing Network, the World Economic Forum Centre for Cybersecurity is building a global multi-stakeholder initiative with a view to building a secure quantum economy.