Podcast Transcript

You're listening to the RSA Conference podcast where the world talks security.

Hello, listeners. Welcome to this edition of our RSAC podcast series. Thank you for tuning in. I'm Tatyana Sanchez. And I'm Kacy Zurkus. And we are your RSAC podcast hosts. Kacy, what are we going to discuss today?

Gosh, Tatyana. It is the leap to quantum computing.

That's a big one. And I am so fascinated at the level of attention that quantum computing is getting. It's for so long been seen as like this thing that will happen at some time in the future, but it feels like people are paying more and more attention to it. So it isn't just a technical milestone.

It's a fundamental shift in the security landscape that demands that everyone stop patching the past and start really architecting a future where privileged access is inherently unshakable. So we are excited to welcome our guest today, Malhar Voora, as he explores how to protect critical access against quantum threats and AI powered attacks. Such an important conversation going on across the industry right now. He'll be addressing the current preparedness gap and provide actionable strategies for crypto agility and securing all identities, human and nonhuman, for a resilient future.

That's a lot, but are you ready to dive in, Tatyana?

Yes. I'm absolutely ready to unpack everything. But before we get started, we do wanna remind our listeners that here at RSAC, we host podcast twice a month, and we encourage you to subscribe, rate, and review us on your preferred podcast app so that you can be notified when new tracks are posted. And now we would like to ask our guest to take a quick moment to introduce himself. Malhar?

Thank you both. Good day to everybody from Australia. My name is Malhar. I'm working as a principal security engineer and the engineering leader at the ANZ Bank here in Australia. I often share the thought process on the various identity topic. And today, I'm so keen to talk about the content content safe PAM, which is actually preparing the privileged access for the post quantum era.

And thank you for being here today, Melhart. We often hear about quantum computing as a someday problem, but other cybersecurity professionals argue that people need to start preparing now because there's really no due date on when it's gonna come. It can come in 2035. It can come sooner or even after 2035. And it kind of aligns what you talk about that quantum computing is actually a pressing concern.

So why is now the time for organizations to stop looking at the horizon and start worrying about their current encryption standards?

Yeah. Sure. That's a great question. So before I answer, let me start with a simple story. So imagine a thief walks into a bank building.

But instead of trying to crack the safe, they photograph every single one, every lock, every dial, every separate deposit, and they walk out. So they can't open anything today, but they are waiting in in few years from now, a universal safe cracker will exit. And when it does, they will have everything they need. So this is not a movie plot.

This is what is happening to the organizations right now. The nationwide state actors and the software security threat groups are quietly collecting your encrypted data, which is your session recordings, admin credentials, authentication tokens. Right? And then storing it, and they're simply waiting it for the future.

So today, we are talking about what it means for the privileged access management, the critical system that holds the keys to your most sensitive environments, and what you need to do about it before the safe cracker arrives. Right? And this is the quantum safe plan.

Obviously, building a quantum safe blueprint for privileged access management is something that's really important to you. But for those listening who are still managing maybe these traditional frameworks, what does it actually look like to merge cryptographic foundations with privileged control?

So the cryptographic standard already exists today. Things like RSA and ECC. Whether it's a session recording, whether it's authentication, whether it's the internal traffic within the PAM system, they all are encrypted.

But because of the quantum computer, which is arriving in the near future, those encryption method like RSA and ECC are breakable by the quantum computers.

Now the fundamental question is that what we can do about it. How do we prepare ourselves for that future, which is not very far from today?

Today, we are talking about what it means for the privileged access management.

The system holds the key to the most sensitive environments and what you need to do about it before the safe cracker arrives. And this is the quantum safe PAM.

So let me go deep dive into it. So let me start with the... I would call it as a chapter one of our podcast today, which is why your PAM vault is suddenly in the crosshairs. Right? Now think of an encryption like a padlock.

And let's start with a simple thing. All the encryption protecting your privileged access environment today, the stuff which is keeping your word communication, your session recording, your admin password safe, is based on one big assumption. And that assumption is certain METs problem are so hard to solve it. It would take millions of years for any computer to correct them.

And that's been true until now.

Quantum computers work completely different to those laptops and servers we are used to. They don't grind through the calculations one at a time. They can explore millions of possibilities simultaneously.

And for the specific type of maths that underpin to this encryption, they solve it fast, just in few hours.

So the padlock we are... We have been relying on, the ones protecting every handshake, every login, every period sessions can be open, Not today, but the clock is ticking.

If I have to simplify it, today's encryption is a padlock that takes millions of years to pick. A quantum computer is a key that opens in minutes, and the padlocks are on everything in your environment.

So what's actually at risk in your environment?

So let's deep dive into further. Right? So here is what I want to be specific because encryption, it it has risk. Sounds abstract. Right? Let me make it concrete.

In your PAM environment, the things that depends on this breakable encryption includes the secure channel to your world users to talk to the endpoints, the authentication handset every time an admin logs in, the digital signature on the certificate that tells your system, okay. This connection is legitimate, and please allow them.

The encrypted recordings of every session.

When that encryption breaks, none of these things can be trusted anymore.

An attacker would decrypt your historical wall traffic, could risk... Reconstruct the admin credentials. They could force authentication. They could replay the privileged sessions and walk straight into your credentials.

For organizations in the banking and the financial services, I'm talking about, you know, your swift connections, your payment rails, your core banking system. This isn't an abstract. This is existential.

And how do these two forces, AI and zero trust, since sometimes, you know, they align with one another or they can be complicated, do you see that they complicate or perhaps even strengthen the mission to secure privileged access against quantum level threats?

Absolutely. Absolutely. Yep. So when the quantum safe becomes reality or much before it becomes a reality, we need to prepare all the critical data in a such a way that we can quantum proof all the important data by, you know, implementing the zero trust, which means we remove the entitlements from all the critical data, which is the privileged accounts. So that at any given time, if it has been, you know, compromised, the, you know, the likelihood or the... Of that account remains very low because it's a it's a sort of like zero trust.

And when we talk about the key actions to secure the environment from the quantum safe, The AI helps in certain way. The AI can help to audit the existing data faster.

The AI can find out all the gaps in organizations with the... With particularly to the current encryption standard. It can then help to align with the NIST standard. It can it can give a road map how to quickly implement it. And, of course, there must be, you know, the AI tools which can smartly do all of these jobs together.

So if we're talking about moving from reactive patching to true crypto agility, this is obviously a massive shift. So if a security leader recognizes a preparedness gap today, what's the first practical step they should take to embed these future ready principles into their identity architecture?

Yeah. Absolutely. The first and foremost is to audit.

Find every certificate, every encrypted channel in your environment, and that's a big task itself. And that's where the other things like, you know, the AI tools can become very handy. It can do the job much quicker than, like, a traditional system can do. Right? Step number two is to prioritize, which is focus on the... First on the long lived and high sensitive data and the credentials. The third one is the... You know, reaching out to your PAM vendor and ask for their readiness for the post quantum and, you know, get the road map in the writing.

The step four is to basically migrate, I would say. So start with the new deployment. At the same time, run the old one and the new encryption in parallel.

And step number five, it would be governed. So this would require an executive level sponsorship, right, as a proper program, assign the right owners, get the required budget, and then, you know, work on it.

Lots of real world encryption guidance for our listeners today. Really appreciate that. And I know that you had also alluded to how to hold maybe vendors or create some accountability for vendors. Can you talk a little bit about some action there that our listeners can put into?

Yep. Absolutely.

So the most of the vendors that I know of today in this space are already have a plan.

So we basically, you know... But from our side, what we can do is we can go and talk to the vendor, get the road map, and see how they are planning to fix this problem.

You know, that would give give you a blueprint for a time environment and to see how you're gonna migrate from the current system to the new system, what sort of controls you're gonna put in place, what sort of standard is gonna be supporting from the NIST point of view as well. And, yeah, work with your vendor to plan out a strategy which can help you to mitigate the risk.

Fantastic.

Mallory, thank you so much for being here today. Listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check 1rsac.com for new content posted year round. Until next time.