Cybersecurity Awareness Month Commentary from Keeper Security

Darren Guccione, CEO & Co-Founder, Keeper Security

Cybersecurity is national security. Since 2004, Cybersecurity Awareness Month has served as a reminder that protecting our nation’s digital infrastructure is inseparable from protecting our physical infrastructure. Nation-state adversaries and organized cybercriminals are launching more frequent and more sophisticated attacks than ever before, making agencies like the Cybersecurity and Infrastructure Security Agency (CISA) vital to our collective defense.

The majority of U.S. digital infrastructure is owned and operated by the private sector, placing businesses directly on the front lines of this battle. Public-private collaboration is no longer optional – it is essential. By sharing real-time threat intelligence, advancing zero-trust security models and implementing modern Privileged Access Management (PAM) solutions, organizations can support our government agencies in strengthening our digital borders and protecting the systems that power our society.

A unified approach – with government and private industry working side by side – is the only way to stay ahead of today’s adversaries and tomorrow’s unknown threats. By embracing this collaboration and prioritization of cybersecurity as a national security imperative, we can build a more resilient future for all.

Dr. Adam Everspaugh, Cryptography Advisor, Keeper Security, and CTO and Co-Founder of Station70

Quantum computers won’t just change technology - they will upend the digital world, and the current forms of security that protect it. Once mature, quantum computing will have the power to shatter the encryption that safeguards personal data, financial transactions, healthcare systems, cloud platforms, government operations and critical infrastructure. The immediate risk comes from a strategy called “harvest now, decrypt later,” better described as a “time-capsule attack.” Right now, cybercriminals are capturing encrypted traffic as it traverses the internet and stashing it away with the intent of unlocking it years later when quantum machines are commonplace. Any organization with sensitive information of long-term value – such as financial, health or intellectual property records – is at risk of this attack.

Cybersecurity Awareness Month poses a prime opportunity to spotlight this immediate and serious concern. All of today’s widely used public-key algorithms can be cracked using Shor’s algorithm when run on a sufficiently capable quantum computer. This includes RSA and the elliptic curve cryptographic algorithms. Symmetric cryptographic schemes like the Advanced Encryption Standard (AES) and the Secure Hash Algorithm (SHA-2 and SHA-3 family) are still secure, as are the new breed of lattice and hash-based quantum resistant cryptographic algorithms recently standardized by the US National Institute of Standards and Technology (NIST).

The timeline for realizing these quantum computers capable of breaking public-key cryptography is uncertain. Conservative estimates place it decades away, but technological progress is non-linear and notoriously difficult to predict. The recent standardization by NIST of quantum-resistant cryptographic algorithms, including Kyber, Dilithium, and Sphincs, underscores the importance to organizations of planning their transition now.

Governments are also starting to take note. Regulators are urging enterprises and public-sector bodies to inventory cryptographic systems, prepare for migration and adopt “crypto-agility” strategies. The likes of Apple, Google and Cloudflare have already begun piloting hybrid deployments for a quantum-resistant cryptography, combining classical and quantum-resistant algorithms to get the best of both worlds in the near term.

Security leaders must act decisively. There are several practical steps to prepare for quantum disruption. Start by identifying and classifying high-value, long-term sensitive data, evaluate vendor quantum-resistance and start transitioning to hybrid cryptography. This Cybersecurity Awareness Month is an opportunity to take action, as tomorrow’s resilience is built on today’s response.