Quantum security for financial institutions - urgency is required

The rapid advances in quantum technology are presenting the financial sector with a fundamental security challenge. What was long regarded as a future scenario is increasingly becoming a real risk: powerful quantum computers could in the foreseeable future crack central encryption processes on which almost all digital financial communication is based today. The data connections between data centers and bank headquarters are particularly critical - they form the backbone of the global financial system and must be made quantum secure at an early stage.

This is the core message of the Diplomatic Council Quantum Leap (DCQL) initiative, which has set itself the task of supporting the economy in the adaptation of quantum technology. The Chairman is Harald A. Summa, who has made a significant contribution to creating a flourishing economic sector around the Internet. Eco (Association of the Internet Industry), which he founded, is now the largest Internet association in Europe.

Internet, artificial intelligence, quantum technology

Harald A. Summa assesses the impact of significant technological developments on the financial sector: «The internet has paved the way for a new generation of fintechs, which pose a massive threat to the traditional banking business, at least in part. AI has shaken up the financial services sector with robo-advisory and a new AI-driven wave of attacks - keyword myths. Quantum technology is set to bring similar fundamental changes. The end of cryptography as we know it is probably the most dramatic change in the short term.»

He adds: «So as not to be misunderstood: All of these completely different leap technologies bring a lot of positive things with them. With quantum technology, we are at the beginning of a development that is still very much research-driven in many cases, but which is already opening up a number of serious real-life application scenarios and a huge market in the medium term. However, this should not lead us to underestimate the associated risks.»

Goal: Quantum-safe IT systems

Summa considers the conversion of existing IT systems to quantum-safe standards to be one of the most urgent current tasks - and not just in the financial sector. At the heart of this is the vulnerability of established data encryption methods. Cryptographic methods that are still classified as secure today could be cracked by quantum computing in the future. Systems, databases and transmission paths would then be as accessible to cyber criminals as an open book.

Summa explains: «Methods such as RSA, Elliptic Curve Cryptography and Diffie-Hellman currently secure transactions, payment transactions, trading platforms and internal communication channels. However, advances in quantum computers threaten to break this security architecture.» He points to the Shor algorithm as an example, which can compromise precisely these processes, meaning that financial data, authentication processes and digital signatures would no longer be reliably protected.

«Harvest now, decrypt later»

There is also an attack scenario that is already relevant today: «Harvest now, decrypt later». Attackers collect encrypted data sets in order to decrypt them at a later date using more powerful technologies that are available at that time. For banks, this means that even currently secure communication can be compromised in the long term. Highly sensitive information such as transaction data, customer data, trading strategies and internal risk models are particularly affected.

Against this backdrop, the focus is shifting to securing the communication channels between data centers and bank headquarters. These connections transport enormous amounts of data every day and are essential for payment processing, liquidity management and real-time trading. A successful attack on this infrastructure risks shaking confidence in the financial system as a whole - with potentially devastating effects on entire economies.

Crypto-agility as a key concept

Florian Fröwis, Director Quantum Security at Diplomatic Council Quantum Leap, explains: «The switch to quantum-secure encryption methods is a transformation process that will take several years. Contrary to what many traditional infrastructure suppliers claim, making conventional network and communication components quantum secure will be complex and expensive. Only solutions that decouple the cryptographic change from the communication infrastructure will create the crypto-agility that plays a key role in this scenario.»

This refers to the ability of IT systems to exchange or update cryptographic procedures flexibly and without extensive intervention. This is particularly crucial in the transition to post-quantum cryptography, as standards and algorithms will continue to evolve in the coming years. Fröwis: «Financial institutions therefore need architectures that allow encryption mechanisms to be quickly adapted, combined or gradually replaced without jeopardizing ongoing operations.»

Lack of transparency about crypto infrastructure

Fröwis has observed in projects in the financial sector: «A key challenge for many financial institutions is of an organizational nature: cryptography has historically been a feature of procured products. With new regulations and the switch to quantum-safe procedures, institutions are now obliged for the first time to understand and actively shape their cryptographic architecture. In practice, a prioritized approach is therefore recommended. Particularly exposed or business-critical systems require speed and foresight at the same time.»

In addition to the introduction of new algorithms, the physical protection of data transmission is also becoming increasingly important. Technologies such as Quantum Key Distribution (QKD) make it possible to secure cryptographic keys on a physical level and immediately detect attempts at manipulation. Initial projects - for example at JP Morgan Chase or HSBC - show that such approaches are particularly suitable for critical connections between data centers and central control units.

Harald A. Summa concludes with a clear appeal: «Regulators and supervisory authorities have started to take up the issue. The timeline is crucial here: since sensitive financial data must be protected for many years, it is not enough to wait until quantum computers are ready for the market. If you don't start analyzing and modernizing your cryptographic infrastructure today, you will be under considerable time pressure tomorrow - or possibly face even worse consequences.»

Source: www.diplomatic-council.org/quantumleap

This article originally appeared on m-q.ch - https://www.m-q.ch/de/quantensicherheit-fuer-finanzinstitute-eile-ist-geboten/