Blog Authors:
Christiane Peters, Security Architect, Office of the CISO, Google Cloud
David Stone, Director, Office of the CISO, Google Cloud
In today's rapidly evolving threat landscape, the media, vendors, and regulators are bombarding CISOs with news about quantum computing advancements and the need to become “quantum-safe”. It's hard to tell what's genuine progress and what's just hype. At Google, our experience has taught us to disregard the distractions. We advise CISOs to redirect their attention from media buzz toward developing and deploying a resilient data security architecture, complete with a comprehensive cryptographic inventory. A forward looking data security strategy can secure your data against today's threats while simultaneously laying the foundation needed to defend against threats for today and tomorrow.
Navigating Quantum News: Separating Hype from Reality
In recent months, there have been quite a few significant announcements, including new processors like Google’s Willow chip, quantum algorithms advancements, and fresh research on the expense of quantum factoring. This has led to excited headlines questioning "Is RSA now compromised?".
Those advancements do not imply that a cryptographically relevant quantum computer (CRQC) is imminent. They indicate progress following our Google Quantum Roadmap, and new developments in resource estimation that will help run Shor’s (and other algorithms) with smaller quantum computers than previously thought. We are still quite far from being able to execute Shor's algorithm to break current public-key cryptography. However, developments like these call for focused planning, keeping in mind the NIST-recommended timeline for the migration to Post-Quantum Cryptography (PQC).
To understand quantum computing advancements, it helps to start with the basics. The fundamental building block of a quantum computer is a "qubit," the quantum equivalent of a classical bit. While the number of qubits is often cited as a measure of progress, this single number can be misleading. There are various ways to realize qubits—using superconducting circuits, trapped ions, or photons, for example—and each type has different strengths and weaknesses. This means that comparing quantum computers on qubit count alone is an oversimplification. Just as important is the quality of the qubits and the computer's ability to perform error correction. Google Quantum AI demonstrated on Willow a key breakthrough in the field: as you increase the number of qubits, you can actually decrease the error rate using quantum error correction, this is essential for almost all useful computations. This is why it's important to look beyond just the number of qubits and consider a broader set of performance benchmarks, as outlined in the roadmaps from major research groups.
While we rely on our internal specialists at Google, we also look to the broader scientific community for a complete picture. Our Quantum Threat Model, for example, incorporates insights from the Global Risk Institute's Quantum Threat Report, which compiles timeline estimates from leading researchers. Genuine breakthroughs in this field are vetted by rigorous peer review, not sensational headlines. We advise that you stay informed by following the work of quantum world experts and credible research institutions, not just the news headlines.
The Path Forward: A Focus on the Foundations
So, with a clearer picture of how to interpret quantum news, the practical question becomes: what should you do now? We argue that the most effective path forward is to focus on the foundations. Investing in a solid data security strategy and building a cryptographic inventory is a no-regrets move that pays dividends today by mitigating current risks, while also preparing you for the PQC adoption and any other cryptographic event the future might hold. This is about more than just cryptography; it’s about understanding the capabilities you need to protect your most sensitive data and the processes and technology to manage change.
Here are some immediate steps you can take:
- Develop a Data Security Strategy: Start by identifying your sensitive data and defining the capabilities you need to protect it today and in the future.
- Inventory Your Cryptographic Assets: Understanding what cryptographic assets you have, where they are, and how they are used is an essential first step. A complete inventory of your keys and their metadata creates the map you need to navigate any future migration or respond to a newly discovered flaw.
- Learn from Past Migrations: Reflect on challenges like the Heartbleed vulnerability or the SHA-1 retirement by running tabletop exercises. This helps identify gaps in your processes before a crisis hits.
- Prioritize and Protect: Use a threat model to assess which data and systems are most at risk from quantum threats and prioritize your migration efforts accordingly. You can start with a security posture review of your Google Cloud workloads.
- Stay Informed, Not Alarmed: Continue to monitor quantum developments, but rely on experts to distinguish hype from reality. When in doubt, talk with a trusted partner who has experience in this field.
By taking these steps, you can build a resilient data security foundation that will protect your organization's data. Stay alert and informed, trust the experts, but focus on the real work of building an agile and secure posture for today