Nation-state adversaries are vacuuming up encrypted traffic today, waiting for quantum computers to decrypt it tomorrow. This attack strategy, &quot;Harvest Now, Decrypt Later,&quot; isn&#x27;t theoretical. It&#x27;s happening right now. G Mark Hardy sits down with Marcus Sachs (former White House cyber advisor, CSO of NERC, now SVP and Chief Engineer at CIS) to break down two executive orders just signed by the White House on post-quantum cryptography and what every security leader needs to do before the clock runs out. What you&#x27;ll learn: Why TLS, VPNs, and PKI are your most urgent exposure The Harvest Now, Decrypt Later threat model and what it means for your data retention policies How to build a Cryptographic Bill of Materials (CBOM) What cryptographic agility means and why hard-coded crypto is a ticking time bomb Lessons from Y2K that apply directly to the quantum migration You can&#x27;t name a date certain. But your adversaries are already running the clock. Links, NIST resources, and both executive orders in the show notes. https://www.nist.gov/cybersecurity-and-privacy/what-post-quantum-cryptography https://www.nist.gov/pqc

Harvest Now, Decrypt Later (with Marcus Sachs) - #290

CISO Tradecraft®

# Full Transcript

**Podcast:** CISO Tradecraft®

## Transcript

Hey, quantum computing is going to be ready next year. We've been hearing that for 25 years, but the White House finally got serious about stuff this past week. I've got an expert here to talk to you all about it. Stick around.

For everybody out there, so here's a little bit of the background of what's going on. We're going to discuss kind of what could be one of the huge technological advances when it gets here with regard to security, and that is the move to post-quantum cryptography. So we're going to talk a little bit about cryptography, what is quantum, what is post-quantum, and then what's the impact for you as a business leader? How do you communicate this information to your executives in a way that won't make their heads spin, as well as what is the risk of things such as that.

So first of all, kind of a quick cap on the news, and I'll have these references in the show notes. Two presidential actions that were published, executive orders this past week on June 22nd. And one of them addressed American quantum innovation. The other one is accelerating the migration to post-quantum cryptography for high-value organizations are basically important elements of the U.S. government.

So if you're a CISO, maybe the obvious question you should be asking is, now should I care finally today, or is this still going to be somebody else's problem that's going to be 10 years in the future? And I think we've got somebody here who can be a really good expert about that. So Marcus, as I said, I've known you for a number of years, but quick, a little bit of your background. I don't know if you have to go all the way back to the Army days, but you can mention that. Yeah. Well, we can start there because I retired from the Army about 25 years ago.

So right after September 11th, I did a 20-year career, was going to head off to the private sector. September 11th happens. And then I get a phone call from the White House, wanted to know if I could come over and work for them instead of running off to the private sector. So, you know, when the White House calls, of course you say yes. And I was there for a couple of years. This was started early 02. So just a couple of months after September 11th. And through 02, we really were working on the national strategy to secure cyberspace.

First time we'd ever done that, put together a White House strategy. That along with the national strategy to secure the homeland and a whole bunch of national strategies all came out about the same time. And later in spring of 03, we launched the Department of Homeland Security or DHS. The initial concept was to have a cyber capability built in, you know, to be part of it. Today we call that CISA. Back in the summer of 03, it was three of us that were kind of the ones to make.

A startup, if you will. A startup. A startup. Yeah, that's probably the best way to frame it. We had a very little budget and some really coo...

Harvest Now, Decrypt Later (with Marcus Sachs) - #290

Transcript

Built for investment professionals

Every day you wait, your competitors are finding
edge in conversations you're not hearing.

Harvest Now, Decrypt Later (with Marcus Sachs) - #290

Transcript

Built for investment professionals

Every day you wait, your competitors are findingedge in conversations you're not hearing.

Every day you wait, your competitors are finding
edge in conversations you're not hearing.