DTCC identifies security risks around quantum computing

Quantum computing may offer new possibilities to solve problems that are currently unsolvable, but also has the potential to disrupt entire industries and create significant new risks by making even the most highly-protected computer systems vulnerable to hacking. 

The Depository Trust & Clearing Corporation (DTCC), the premier post-trade market infrastructure for the global financial services industry, has issued a white paper that brings this risk into focus, while identifying initial steps organisations can take to protect themselves.

In a white paper, Post-Quantum Security Considerations for the Financial Industry, DTCC explains that, as safekeepers of investments, public assets, pensions and retirement accounts, financial institutions are responsible for securing personal information, accounts, holdings, and financial transactions, often using traditional encryption methods. However, DTCC cites experts in its paper who say quantum-based computers will one day have the power to break the industry’s existing cryptography codes in seconds.

“We recognise that the quantum technology threat is coming. With some experts estimating that the industry’s protected data could become vulnerable within the next decade, the time to act is now,” said Ajoy Kumar, DTCC MD and Chief Information Security Officer. 

“DTCC is already taking proactive steps to protect our data.”

DTCC suggests that firms begin to assess and respond to this security threat by:

- Sizing up the effort by identifying systems and encryption mechanisms in scope for remediation.

- Strengthening cryptography practices by centralising the management of keys and certificates, instilling standards for encryption mechanisms, and implementing change management for new encryption solutions. 

- Developing and exercising a playbook that details the steps needed to replace an encryption platform while ensuring the plan can be executed on time.

- Modifying and separating systems, as needed, to facilitate work to come.

- Beginning organisational change management efforts to build a strong risk culture and risk-based mindset within organisations.

The firm also suggests closely monitoring activities taking place within the regulatory community that address topics like standardisation, including NIST’s focus on post-quantum cryptography (PQC) standards.

Added Kumar, “We look forward to partnering with the industry to continue this critical dialogue and to prepare for the emergence of PQC standards. Collaboration and preparation will be key to ensuring that the security, privacy, and integrity of the financial industry is preserved.”