Imagine a scenario in which bad actors have powerful tools that make it easy to succeed with cyberattacks on electrical grids. These tools let them steal sensitive data, overwhelm intelligent electronic devices (IEDs), introduce ransomware or disrupt service for thousands, or perhaps millions, of customers. Utilities can’t stop the attacks and may not discover them until it’s too late.

With the expected arrival of practical quantum computers and the growing potency of AI, bad actors will soon have the tools they need to turn this imaginary scenario into a harsh reality. Protecting utility communications networks is no longer optional, and quantum-safe security is becoming the de facto approach for ensuring long-term grid resilience.

Grid Modernization and Quantum Threats Add Risk

Utilities are adopting data-driven, software-centric operations to make their grids more reliable and efficient. But smart grids require non-stop communications across a complex environment that include legacy assets, remote locations, mixed vendor ecosystems, and diverse network technologies. This makes them more vulnerable to threats such as eavesdropping, man-in-the-middle (MITM) attacks, and denial-of-service (DoS) attacks.

Cryptography currently provides a reliable defense against many threats. But rapid quantum computing advances will inevitably lead to the creation of cryptographically relevant quantum computers (CRQCs) that can break down existing asymmetric public-key encryption methods that protect grid communications. A CRQC running Shor’s algorithm could easily break these long-trusted ciphers within minutes. Once encryption is compromised, vital grid operational data and even customer data could be compromised.

Harvest Now, Decrypt Later is a Zero-Day Threat

Some bad actors are anticipating CRQCs by using fiber tapping to gather massive volumes of encrypted grid communications. If they gain access to a CRQC, it will be easy for them to decrypt the information and get a detailed view into the grid. The knowledge gained through this harvest now, decrypt later (HNDL) approach will enable them to target specific grid assets with potent attacks.

HNDL is already a threat, and utilities can’t afford to wait to see what happens when CRQCs arrive. They need to prioritize their key areas of vulnerability and start building up crypto resilience and agility now. This will allow them to defend their networks and maintain compliance with government security mandates.

Three Steps to Quantum-Safe Grid Communications

First, some good news: Utilities can build a robust defense against quantum threats today. By applying symmetric cryptography technologies, utilities can implement a multilayer, defense-in-depth approach that keeps their grids safe from HNDL threats and future CRQC attacks. Intrusion detection technologies such as wavelength tracking and Optical Time-Domain Reflectometer (OTDR) tools can complement cryptography by enabling utilities to pinpoint fiber taps and stop attempts to eavesdrop on communications.

Step one is to assess the most valuable and vulnerable communication links, perhaps between key operational sites or data centers. Between these sites, it’s helpful to identify critical applications that should receive higher levels of protection and then decide where to deploy quantum-safe cryptography and at which layers.

Given this plan, step two is to deploy symmetric cryptography at different network layers: OTNsec for the optical layer and MACsec for the Ethernet layer. These technologies use AES-256 symmetric key infrastructure (SKI) as the encryption engine with high-quality classic or quantum physics-derived keys. These keys are generally of a large size at 128 or 256 bits.

Step three is to fill out a quantum-safe protection plan with complementary protections at several layers, including the use of different technologies. This complementary approach yields both resiliency to a possible successful attack, and agility to make future changes as needed without a wholesale cryptographical re-design. The concept is to implement multiple protections in multiple places.

There is no one-size-fits-all approach, so most utilities will address their unique needs with different technologies, including:

• SKI, which distributes keys out of band from encrypted data to make it tougher to predict the keys.
• Quantum key distribution (QKD), which uses a quantum state to generate and protect keys.
• Post-quantum cryptography (PQC) algorithms such as those used in the well-known IPsec solution, which combine highly complex mathematics with an asymmetric distribution approach.
• Post-quantum pre-shared keys (PPKs), which are long, high-entropy keys that are exchanged out-of-band to add an extra layer of protection to that provided by standard key exchanges.

 Utilities that take these steps will enjoy a strong first line of defense against any quantum threat. 

More Help is Coming

Organizations such as NIST and ETSI are developing standards that will help utilities protect grid communications, adapt to new threats and maintain security compliance. However, it will take years for non-telco vendors to integrate these standards into their systems and applications. Utilities can safely rely on SKI-based IPsec, MACsec and OTNsec for the foreseeable future, and then layer on PQC and possibly QKD to increase crypto resilience and agility.

It’s Time to get Quantum-Safe

Utilities have the technologies they need to resist quantum threats. By prioritizing their biggest vulnerabilities and deploying quantum-safe cryptography where it matters most, they can protect critical communications and ensure that intercepted data can never be used to compromise their grids.