Cybersecurity experts warn that current encryption systems may no longer be enough to protect businesses from quantum-powered cyberattacks, a scenario that could become reality as early as 2029 or 2030 — a milestone known as Q-Day.

Q-Day refers to the point at which a sufficiently powerful quantum computer becomes capable of breaking widely used encryption standards, including Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC). These standards protect websites, email and other internet-based systems. Because that same cryptography also underpins payment systems and other sensitive business data, a break would touch the everyday digital services companies and their customers rely on — one reason the issue is being framed for business leaders rather than technologists alone.

"Q-Day refers to something called Quantum Day, which is when a cryptographically relevant quantum computer comes online and is able to break the current encryption," said Ramesh Nagarajan, head of Quantum Education at Eigensystems, speaking to BusinessWorld during the "Y2Q Horizon: Preparing Leaders for Post-Quantum Cryptography" forum convened by the Asian Institute of Management (AIM).

Mr. Nagarajan said businesses should begin preparing by identifying their cryptographic assets and determining which systems need the most protection. Payment systems and sensitive information should be among their priorities, he said. Companies should also start adopting quantum-safe algorithms to shield their existing systems against future quantum attacks.

"We have to start yesterday. We cannot wait any longer," he said.

He cautioned that migrating to quantum-safe systems could take time, and that delaying preparations would make the transition more difficult as quantum computing advances.

Also at the forum, Francisco Ashley L. Acedillo, AIM clinical professor and academic program director of the Executive Master in Cybersecurity Management, said companies should factor cybersecurity in from the beginning of their digital transformation initiatives.

"Cybersecurity is not a one-size-fits-all approach. You need to consider what your most important assets are, whether these are your digital assets, your information, or your intellectual property," Mr. Acedillo told reporters during the forum.

He said businesses should prioritize assets based on the potential impact of losing or compromising them — especially important given companies' limited resources and the shortage of qualified cybersecurity professionals.

Mr. Acedillo added that Philippine businesses and the government are not yet prepared for Y2Q, which refers to the transition toward a quantum-safe digital environment. He called for cooperation between the public and private sectors to address the threat: the government should provide leadership and regulatory support, while businesses should help secure the digital services and critical infrastructure they operate. How quickly both sides follow through — from cryptographic asset inventories to quantum-safe algorithm adoption — is the thread to watch as the projected 2029–2030 Q-Day window approaches, particularly in the Philippines, which Mr. Acedillo described as not yet prepared.

— Edg Adrian A. Eva, BusinessWorld

Source: BusinessWorld