Skip Sanzeri is the founder, board chair and COO of QuSecure, a top post-quantum cybersecurity company.
These days, major debates are happening around artificial intelligence (AI) and the future of the human race. Whether you believe that advanced AI will better humanity or force us off the planet, I would propose that we have a more pressing problem.
For those who have followed my Forbes columns, you’ll know that I’ve written a lot about the quantum threat to the internet’s encryption (also called public key infrastructure, or PKI), which protects the world’s internet traffic. Additionally, I’ve written about how AI is creating new cyberattack vectors. Since it is widely understood that powerful quantum computers could break the internet’s encryption and AI and machine learning (ML) are already causing global cyber issues, could AI/ML also be used for defense?
The short answer is, yes. The idea is to fight technology fire with technology fire. Using AI/ML with post-quantum cryptography (PQC) creates an adaptive cybersecurity environment that can better defend against a wide range of cyber threats, including those posed by both AI and quantum computing.
Background
Since we know that quantum computers will have the capability to crack existing internet and network encryption globally, organizations need to address the upgrade to post-quantum cybersecurity (PQC). Cybersecurity experts and government leaders have known about this threat for several years, and in December 2022, President Biden signed into law the Quantum Cybersecurity Preparedness Act, which now mandates that all federal government agencies begin the upgrade process to PQC.
Along with this, we see commercial enterprises testing PQC with the help of companies like Accenture. The reason they are moving now is that the upgrade process will take years. Even if a federal government agency or commercial organization started the upgrade process today, they will need to add post-quantum encryption to all their communications to complete a full upgrade. Just as important, data is being stolen every day. If this data lacks quantum protection, then it is subject to being decrypted in the future with the powerful quantum computer.
Even as organizations continue to work with companies that aid in the transition to post-quantum cybersecurity, it won’t be enough just to think in terms of PQC since we can be sure that our adversaries are going to use AI/ML with quantum computers for attack and disruption. So, we also need to add AI/ML combined with PQC to ensure that we have the best possible defense in place.
Benefits Of AI/ML With PQC
There are a variety of benefits to combining AI/ML that can bolster enterprise cybersecurity. First, AI/ML can develop and optimize quantum-resistant cryptographic algorithms. It can also help detect anomalies in network traffic, system logs and user behavior to trigger responses. Models establish normal behavior baselines to identify suspicious activities, adapting to new attack techniques and zero-day vulnerabilities.
Additionally, AI/ML improves user authentication by continuously monitoring and verifying behavior, making it challenging for attackers to impersonate legitimate users. It analyzes large cyber threat datasets, aids informed decisions, and efficiently manages quantum-safe cryptographic keys for secure distribution and storage.
Further benefits include phishing detection, zero-day exploit detection and post-intrusion analysis. As AI/ML and quantum-resistant algorithms progress, we anticipate discovering more effective defense combinations.
Steps Toward Integrating Post-Quantum Cybersecurity
To combat how AI/ML could be used for harm, commercial enterprises and government agencies must understand how AI/ML can be used for defense. It is important to start considering how to integrate PQC/AI/ML into the enterprise cyber psyche so the organization has the best chance of future-proofing its networks from AI and quantum attacks. Let's review a few of the steps that can be taken:
1. Cybersecurity Objectives And Goals: Clearly define your organization's cybersecurity objectives and goals for implementing PQC/AI/ML.
2. Reviewing Data Sources: Identify the sources of data that will be used to train and feed AI/ML models. This may include network logs, system logs, user behavior data, threat intelligence feeds and more.
3. Data Privacy And Compliance: Ensure that you adhere to data privacy regulations and industry compliance standards, like GDPR, HIPAA or others when handling sensitive data.
4. Expertise: Invest in cybersecurity talent with a focus on PQC/AI/ML or provide training for existing team members to acquire the necessary skills.
5. Selecting Suitable AI/ML Models: For your specific cybersecurity use cases, such as anomaly detection, threat hunting or malware analysis, choose appropriate AI/ML algorithms and models.
6. Test, Test, Test: Find vendors who will start with small-scale PQC/AI/ML projects to validate the effectiveness of PQC/AI/ML models for your organization's needs.
7. Continuous Learning And Improvement: Both PQC and AI/ML are rapidly developing technologies, and it is important to implement continuous learning processes to keep your PQC/AI/ML systems up to date with the latest threats and trends in cybersecurity.
While this isn't an exhaustive list of ways to prepare for AI and quantum attacks, following these steps can help effectively prepare for the integration of PQC/AI/ML into your cybersecurity defense strategies.
Summary
Quantum computing and AI/ML have the potential to provide amazing benefits for humanity. At the same time, as with many new technologies, quantum and AI/ML will be used for power, control disruption, and theft and could cause devastating effects that, according to the World Economic Forum, could deliver the “Next Global Shock.”
With the internet’s encryption changing to PQC, the upgrade to PQC stands to be the largest in history. I believe that to ensure the best possibility of securing our future, the time to act is now.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
