Russian Scientists Develop Quantum Risk Index for Data Protection
Russian scientists have examined 78,000 cryptographic vulnerabilities and found that hackers are already targeting those that will become critically dangerous in the quantum era. To assist defenders, they created the Quantum Risk Index (QRI), which indicates which security gaps need to be prioritized for closure.
Quantum technologies are among the top three priority information technologies for Russia's development until 2030. Ensuring quantum resilience of key ecosystems and platforms in the digital economy is a task that must be addressed now.
Imagine a malicious actor stealing an encrypted archive, knowing that in ten years a quantum computer will crack the encryption. This strategy is known as “Harvest Now, Decrypt Later” (HNDL). If a vulnerability allows the theft of a one-time bank password, the risk is low, but if it involves medical records, the gap must be closed today.
Traditional vulnerability assessment systems, such as CVSS, indicate how dangerous a security gap is right now. However, neither of these systems accounts for quantum risks that may manifest over decades. Billions of records worldwide must remain confidential for much longer.
Read this article in full and everything else in Telegram, ad-free
Open in TelegramThanks, I just want to finish reading here
Researchers from Southern Federal University and Sirius University proposed the Quantum Risk Index (QRI) — a formula for calculating vulnerability. The higher the index, the more dangerous the gap is considering future quantum threats.
The new formula considers three factors: the current danger of the vulnerability, its susceptibility to quantum algorithms, and its attractiveness for the HNDL strategy. The longer the data must remain confidential, the higher the QRI score.
The scientists tested the formula on a large database of nearly 80,000 vulnerabilities from the National Vulnerability Database (NIST). It turned out that vulnerabilities from the CISA KEV list have an average QRI that is 26.6% higher than others.
“The main problem with the classical approach to cybersecurity is its reactiveness. Our developed QRI is not just a theoretical abstraction. We have empirically proven that malicious actors are already deliberately exploiting vulnerabilities that will become key targets for quantum computers,” said Professor Sergey Petrenko.
The number of cryptographic vulnerabilities is growing at an average rate of 11% per year. Scientists recommend restructuring the prioritization of vulnerabilities and starting the migration to post-quantum encryption standards.
This work was supported by the Russian Science Foundation. The research results have also been included in relevant reports and formed the basis for a series of publications.
The study involved scientists from Southern Federal University and Sirius University. The results were published in the journal Computers.
