Managing risk is nothing new to utilities. Providing the safe utility services like electricity, water, sewer, and wastewater management that everyone relies upon is hard work. Critical infrastructure assets are prime targets for bad actors looking to use cyberattacks to cause high-impact disruptions. As utilities adopt software-centric, data-driven operations, they will continue to work diligently to protect assets from threats by hacktivists, cyber criminals, and other motivated adversaries.
But life is about to get even tougher for utilities because a far more advanced cyber threat is heading their way. The rapid evolution of quantum computing means that a cryptographically relevant quantum computer (CRQC) will benefit utilities but also benefit the bad actors looking for attention. With a CRQC and the right algorithm, a threat actor could crack or weaken the cryptography algorithms that electric utilities use to safeguard their critical operational communications.
Utilities have some time before the day CRQC becomes commonplace—better known as Q-Day—but the time to consider their impact is before they are an active threat. That time is now. A bad actor that can defeat encryption schemes would have free rein to eavesdrop on asset communications, carry out man-in-the-middle (MITM) attacks and launch targeted denial-of-service (DoS) attacks to create havoc in the safe delivery of services.
Why the Quantum Threat Is a Big Deal
Quantum computers symbolize the next great generation in computing technology. Instead of using binary bits to represent states as zeroes or ones, quantum computers use qubits that can exist in multiple states at the same time. This allows them to perform many highly complex calculations in parallel and complete exponentially more operations than today’s computers in the same amount of time. Picture a situation where the quantum computer will determine all possible outcomes at once rather than evaluating one answer at a time as a current computer handles algorithms.
These capabilities will surely bring transformative advancements to many industries. However, the risk is that they will also empower threat actors to use published quantum algorithms to make widely used encryption technologies obsolete and launch damaging attacks on utility assets.
For example, a hacker with a CRQC could use the prime factorization capabilities of mathematician Peter Shor’s algorithm to overcome asymmetric cryptography systems such as the Rivest–Shamir–Adleman (RSA) public key algorithm. The quadratic acceleration capabilities of Grover’s algorithm could allow the same hacker to cut the protection provided by symmetric encryption keys in half. By running these algorithms on a powerful enough CRQC, a threat actor could reduce the order of magnitude to seconds rather than years.
Why It’s Time for Utilities to Act
While utilities may not have to deal with a quantum attack for some time, they’re already facing a serious quantum threat. Bad actors could use fiber-tapping techniques with advanced storage technologies to harvest huge amounts of encrypted data on grid assets, systems, and operations. When they gain access to a CRQC, they will be able to decrypt this data and use it to compromise the utility assets they identify.
These harvest now, decrypt later (HNDL) threats could have major consequences for utilities and their customers. Successful decryption would allow threat actors to analyze asset communications, so they can use a MITM attack to disrupt critical inter-asset communications or even take control of assets. They could spoof commands to manipulate critical intelligent electronic devices (IEDs) or overwhelm core asset management servers with DoS attacks.
Government agencies recognize this threat and are urging critical industries to address it. Utilities can’t play a waiting game with HNDL attacks—quantum-safe networks need to be considered and built now.
How to Make Grid Communications Quantum-Safe
A robust defense-in-depth security framework is a must for guarding against quantum attacks on utility assets. Fortunately, there is a proven blueprint for building a framework that will secure critical utility communications against current and future quantum threats. Better still, it uses standards-based encryption protocols that utilities are familiar with.
Utilities don’t need to wait for international organizations to standardize post-quantum cryptography (PQC) that will take public key algorithms to a quantum-safe level. The first step is to determine where, within the utility, asymmetric encryption is deployed to protect assets. That asset inventory will help prioritize the migration to a quantum-safe network. Utilities can make their asset communications quantum-safe today by deploying symmetric key encryption technologies. These technologies use a key length of 256 bits or more at various network layers, including OTNsec for the optical layer and MACsec for the data-link layer.
These technologies use AES-256 encryption, which can’t be cracked by Shor’s algorithm and has long enough keys to resist brute-force attacks based on Grover’s algorithm. They will protect critical assets today and continue to do so even after PQC algorithms are incorporated into utility applications, providing a multilayer defense.
Utilities will get the most from quantum-resistant encryption technologies by combining them with a random key generator that creates session keys with sufficient entropy. Capabilities such as firewalls, access control lists, and network segmentation will complete the quantum-safe security framework.
Many industry experts are advocating that utilities have a long time before this threat becomes viable, think about spans up to 30 years. However, the truth is that we don’t know. Given new chip designs for artificial intelligence and other technologies many experts concede that the time horizon is more likely just several years. By taking steps to implement quantum-safe encryption now, utilities will be able to protect their data from HNDL threats today and be ready for CRQC-based attacks on Q-Day and beyond. Since utilities are experts at managing risks to their assets, acting now seems like the best investment to evaluate potential risk from quantum devices.
—Ken Rabedeau is Nokia Head of Energy Segment-North America, and Bell Labs-Distinguished Member of Technical Staff.