Whitehouse Report on Post Quantum Cryptography

Ensuring Critical Infrastructure Security with Quantum-Resistant Cryptography

Summary of the Whitehouse Report on Post-Quantum Cryptography

Introduction

Federal agencies and critical infrastructure must urgently prepare for the next frontier in cybersecurity: quantum-resistant cryptographic systems (PQC). The growing capabilities of quantum computing pose a significant threat to traditional public-key cryptography, which is foundational to most digital security protocols. To safeguard sensitive information, agencies must first establish a thorough cryptographic inventory. This inventory is the baseline for deploying quantum-resistant measures effectively, as mandated by Executive Order 14028 on cybersecurity improvements. Adopting a Cryptographic Bill of Materials (CBOM) is a key step in identifying vulnerabilities in existing cryptographic assets and bolstering federal defenses against quantum-driven threats.

Why Quantum-Resistant Cryptography is Essential for Federal Agencies and Critical Infrastructure

The Emerging Quantum Threat to Public-Key Cryptography

Advancements in quantum computing signal a fundamental shift in cybersecurity. While quantum computers promise breakthroughs in fields like healthcare and artificial intelligence, they also bring unprecedented risks. A cryptanalytically relevant quantum computer (CRQC) will have the capability to break today’s cryptographic systems, putting the confidentiality, integrity, and authenticity of sensitive data at risk. Public-key cryptography, critical to secure communication across government, the private sector, and critical infrastructure, could be made obsolete by a CRQC. This highlights the importance of implementing quantum-resistant public-key cryptographic systems.

Record-Now-Decrypt-Later Attacks: A Looming Threat

One of the most pressing concerns is the potential for “record-now-decrypt-later” attacks. In this scenario, an adversary intercepts and stores encrypted data, intending to decrypt it once quantum computing advances further. These attacks are not limited to internet data; even internal agency networks could be vulnerable, especially under a zero-trust model where data must be encrypted at every point. Though current encryption practices and rapid key rotation add layers of security, they are only temporary barriers against well-funded adversaries with quantum ambitions.

The Role of Executive Order 14028 in Cybersecurity

Executive Order 14028, “Improving the Nation’s Cybersecurity,” has set new standards for cybersecurity resilience in federal agencies and critical infrastructure. The order emphasizes improving software supply chain integrity through Software and Hardware Bills of Materials (SBOM and HBOM) and has introduced the concept of a Cryptographic Bill of Materials (CBOM). The CBOM offers agencies a clearer picture of their cryptographic assets, facilitating the migration to quantum-resistant measures that are robust enough to withstand CRQC threats.

The Foundation of PQC Migration: A Comprehensive Cryptographic Inventory

What is a Cryptographic Inventory?

A cryptographic inventory is a detailed catalog of cryptographic assets within an organization. This inventory enables agencies to pinpoint where cryptographic protocols are implemented, identify assets vulnerable to quantum threats, and plan the transition to PQC. Given the widespread use of public-key cryptography, agencies must adopt an exhaustive inventory process to assess the readiness of their systems against quantum threats.

Benefits of a Cryptographic Bill of Materials (CBOM)

The Cryptographic Bill of Materials (CBOM) is an essential tool that provides a high-level view of cryptographic assets across federal networks. By identifying vulnerable or outdated cryptographic protocols, CBOM helps agencies to detect weak cryptographic links that could be exploited. CBOM serves as an anchor in the PQC migration process, supporting compliance with mandates like Executive Order 14028 and aligning with best practices in cybersecurity.

Role of Automated and Manual Cryptographic Inventories

Maintaining an accurate cryptographic inventory requires both automated and manual processes. Automated tools simplify inventory tracking by scanning systems for cryptographic implementations, but they may lack the visibility to capture all cryptographic instances. As a result, agencies conduct annual manual inventories to catch any instances that automated tools miss, ensuring a complete and reliable cryptographic assessment.

Steps Toward Quantum-Resistant Infrastructure

Identifying Quantum-Vulnerable Systems and Prioritizing PQC Migration

Agencies must identify and prioritize critical systems for PQC migration to ensure that the most sensitive data and high-impact assets are protected. Key criteria include systems with high-value data, logical access controls using public-key infrastructure, and assets that must remain secure well into the 2030s. Prioritization ensures that resources are allocated to defend the most vulnerable cryptographic components.

Overcoming Interoperability Challenges in PQC Migration

Interoperability is a significant concern in PQC migration. If a system adopts PQC-based encryption but its counterpart does not, an encrypted connection cannot be established, potentially impacting operations. Agencies must collaborate to ensure cross-compatibility, carefully planning transitions to PQC with attention to both interoperability and fail-secure configurations that prevent data from being transmitted if encryption fails.

Early Detection of Non-Upgradeable Systems

To minimize disruption, agencies need to identify systems that cannot support PQC as early as possible. Some legacy systems may lack the capacity for PQC algorithms, making replacement essential. Modernizing these systems can be a time- and resource-intensive process but is necessary to ensure a smooth PQC migration.

SecureG’s Role in Bolstering Federal Cybersecurity with CBOM

SecureG’s Analytics Framework

SecureG has pioneered a certificate analytics framework that enhances cryptographic visibility across federal infrastructure. By scanning, cataloging, and assessing cryptographic assets, SecureG generates a comprehensive CBOM that helps agencies pinpoint vulnerabilities. This framework plays a critical role in strengthening federal cybersecurity and ensuring compliance with the standards outlined in Executive Order 14028.

How CBOM Mitigates Security Risks in Federal Infrastructure

CBOM allows agencies to take proactive measures against cybersecurity risks by identifying weak cryptography and expired certificates. This inventory-driven approach empowers agencies to stay ahead of vulnerabilities, preventing cyber threats that could compromise mission-critical communications or inject malicious code into essential systems.

Preparing for the Future of Quantum-Resistant Cryptography

NIST’s Role in Standardizing PQC Protocols

The National Institute of Standards and Technology (NIST) leads the global charge in PQC standardization. By fostering an open standard development process, NIST ensures that PQC algorithms are both secure and interoperable. Since 2016, NIST has meticulously reviewed candidate algorithms and conducted public assessments. As PQC standards are finalized, agencies will gain the tools they need to implement resilient cryptographic protocols across federal systems.

Continuous Assessment and Updating of Cryptographic Policies

The journey to quantum-resistant infrastructure is continuous, with ongoing assessment and policy updates needed to address emerging threats. Agencies must periodically update their cryptographic policies, even after full PQC migration, to respond to advancements in both quantum and classical computing. Such ongoing vigilance will be essential to maintain secure cryptographic protocols well into the future.

Conclusion

Securing federal systems and critical infrastructure in a quantum era is imperative. With advancing quantum computing capabilities, adversaries may soon possess the tools to bypass current cryptographic protections, endangering sensitive data and national security. Through comprehensive cryptographic inventories, agencies can assess and strengthen their cryptographic foundations to deploy quantum-resistant measures effectively. SecureG’s CBOM solution plays a critical role, offering a proactive approach to safeguarding cryptographic assets across federal networks. By prioritizing cryptographic resilience now, federal agencies can protect vital systems and ensure the integrity of national security for the future.

Learn more about SecureG’s cryptographic solutions and take the next step in quantum-resilient cybersecurity for federal systems.

Suspicious SBOM Construction for Secure Software Development

Open-source software has become an integral part of many organizations’ software development processes due to its cost-effectiveness and flexibility. However, a reliance on open-source can lead to security risks. In this blog post, we will explore the dangers of using outdated open-source software and ways to mitigate these risks.

One of the biggest benefits of open-source software is the ability to leverage the work of others for your own projects. This can save time and money, while also providing the flexibility to customize the software to meet your specific needs. However, the use of open-source software also brings with it the potential risk of using software components that may contain vulnerabilities. For instance, a vulnerability in the commonly used Java logging library, Log4j, forced thousands of developers to patch affected code after it was found that hackers had been actively exploiting it.

Repeat Offenders

Component exploits help attackers gain access to sensitive data and systems, which can have devastating consequences. For instance, the 2017 Equifax data breach was caused by an unpatched vulnerability in the open-source Apache Struts framework, which allowed attackers to gain access to the personal information of over 143 million people. In 2020, Solarwinds suffered a near-fatal setback when it was discovered that attackers had inserted the so-called Sunburst malware into the software build, giving attackers broad access to thousands of customers’ entire networks.

It is not uncommon for malicious actors to subtly manipulate code packages. One effective attack is to change the stated version in the header while leaving known prior vulnerabilities in the package. Unfortunately, the use of a simple Software Bill of Materials (SBOM) would not be sufficient to catch this technique.

What is needed is a ‘suspicious’ SBOM solution that scans the actual packages and categorizes them according to their true contents.

A ‘suspicious’ SBOM solution needs advanced scanning tools and machine learning algorithms that can detect anomalies in the software’s components. This way, it can identify components that have been modified, substituted or tampered with, providing a more accurate representation of the software’s reality. Also, this process can help in identifying any hidden dependencies that might not be listed in the software manifest or any potential vulnerabilities that might have been introduced through the use of outdated components. By doing so, we can ensure that software developers and users alike can trust the integrity of the SBOM, making it a valuable tool in promoting trustworthy software applications.

A ‘suspicious’ SBOM also needs a strong and trustworthy PKI to sign and validate its outputs. If you’re developing solutions for IoT devices for critical infrastructure, talk to us at SecureG about how you can have your own hosted PKI for certificates.

How SBOM Tools Can Help Mitigate Software Supply Chain Risk

A recent article on The Hill highlights the growing concern over software supply chain risk and the potential solutions available.

One of the main issues is the sheer number of software packages available, with over 200 million software repositories hosted on Github alone. It’s impossible to know what software packages are deployed inside other solutions, which is where Software Bill of Materials (SBOM) tools come in.

However, it’s important to note that SBOM tools alone are not sufficient to solve the security problem for government agencies.

As the article states, this is like thinking your house is safe because you have a new door lock sitting on the kitchen counter. SBOM tools can be easily fooled by even slightly motivated attackers, such as those who modify a software package to include a vulnerability and then publish it with the same labeling as the original package.

An even more insidious attack involves adversaries who change a package header to say that it is up-to-date when, in fact, it is an older version that contains known vulnerabilities they can later exploit. This is why we need continuous monitoring of the actual contents of any packages included in sensitive software and a measurement of the reliability of that package. SBOM solutions need to be more than just naive “software ingredients lists” to be effective.

In a sense, the Zero Trust Architecture paradigm can apply to software systems too.

Software components can be admitted to an application and be provisionally trusted, but a sophisticated SBOM system remains on guard to alert the operator whenever a component (or combination of components) becomes suspect.

At SecureG, we offer solutions for Zero Trust security, with digital identities for real and virtual devices in IoT devices, semiconductors, and 5G networks. Contact us for more information on how we can help you secure your systems against software supply chain risk.

Drones Gone Wild

The reality of drones: a good drone is one firmware update away from becoming a bad one.

Even drones that were responsibly designed to follow FAA airspace rules can become a security nightmare if their software is not properly controlled and maintained. These useful devices can be derailed by a simple hack, making them extremely vulnerable and dangerous if controlled by the wrong hands.

In a market overview performed by cybernews, the retail drone industry is projected to reach $90 billion by 2030. Whether it be on the beach or at the park, the likeliness that you will see one of these devices in public spaces is high. As of 2022, there were 300,000 commercial pilot licenses issued with over 1 million drones registered—which excludes amateur drone pilots and their aircrafts. That’s a lot of busy air space.

Their size, remote capabilities, and difficulty to trace poses serious concerns to the cybersecurity industry—as evidenced by the rising popularity of drones with both civilian and federal entities, these concerns aren’t going anywhere. The danger will only grow.

If drones are in your IoT fleet, you should be asking yourself how secure these devices are. Can you trust the device is what it says it is? Are you sure you’re the only one who can control it?

Asking once isn’t enough. The base expectation is that the device in question can prove its provenance, capabilities, and current state at all times—regardless of their ability to do so previously.

SecureG’s Zero Trust PKI technology targets these specific machine-to-machine communications. Unlike traditional PKI, which was developed for web servers and employee credentials, SecureG’s solutions are designed for machine speed and machine scale.

Drones aren’t the enemy, but hackers who predicate on vulnerable devices can change that in a blink of an eye. Contact us today to learn more about our solutions for securing your next IoT fleet. https://secureg.io/contact-hubspot/