How does a bank become quantum cybersecure?

Quantum computing is set to eclipse some of the greatest technological advances in living memory, including cellular networks, Wi-Fi routers and the transistor radio.

It’s a quantum leap into multiple future states — known knowns, known unknowns and unknown unknowns — that will allow us to answer complex questions far beyond our current capabilities.

This rapidly evolving technology is already redefining cybersecurity, risk management and financial operations. And banks must leverage these coming innovations holistically to sharpen profitability and organizational resilience. 

The things that make quantum computers (and therefore banking) super powerful, like (and therefore banking) super powerful, like quantum superposition and entanglement, also make current cryptographic defenses (and therefore banks) super vulnerable:

• Public key infrastructures (PKIs) protect digital communications and financial transactions. They depend on the computational complexities of factoring large prime numbers, of which quantum computers are uniquely capable.
• Shor’s algorithm is a quantum algorithm for integer factorization. With a sufficiently powerful quantum computer, a state actor could theoretically use Shor’s algorithm to break RSA encryption (a cornerstone of modern cybersecurity) before quantum-safe cryptosystems can be universally deployed. Alternatively, classically encrypted (e.g., public-key cryptography) information could be scraped and stored for decryption at a later date.

Unsurprisingly, the race to devise quantum-resistant cryptography is on. The National Institute of Standards and Technology (NIST) is endeavoring to standardize post-quantum cryptographic algorithms. Fortunately, the banking industry has thrown its considerable weight behind the   initiative to ensure financial systems are in pole position for the implementation of quantum-safe encryption.

Even so, integrating cyber agility with system modernization will be a massive undertaking for top-tier banks. It will involve the entire cast of financial services players and standards bodies and will  be supported by cross-industry cooperation at all levels.

Here are three reasons for getting quantum-ready now:

• Quantum computers will transform banking value chains, enabling rapid market share gains and greater profitability.
• The learning curve is steep, so fast followers could easily overspend playing catch-up.
• An in-house center of competency will take years to establish and produce sufficient talent.

• Encryption and cryptography: While it’s true that quantum computing could make traditional encryption obsolete, it can also enhance banking cybersecurity. Quantum key distribution (QKD) uses quantum mechanics to allow two parties to share a secret key that is demonstrably protected against computational attacks.
• Fraud detection: The ability to analyze massive datasets at quantum speed enables real-time fraud detection, minimizing the time fraudulent transactions remain hidden.
• Risk analysis and management: Rapidly solving optimization problems promotes more sophisticated risk management, potentially saving billions by averting crises and improving decisioning.
• Portfolio optimization: Simulating complex financial systems with quantum algorithms enables banks to analyze risk and resolve asset pricing problems with lightning speed and accuracy. This could transform portfolio management by supporting the virtually instant analysis of complex investment narratives to determine an optimal asset mix.

• The global enterprise quantum computing market was valued at $1.37 billion in 2020 and is expected to reach $18.3 billion by 2030, registering a CAGR of 29.7% from 2021 to 2030.
• According to BCG, quantum computing could add $450-$850 billion in incremental value to the economy over the next 15-30 years.
• Significant investments in quantum technologies by leading banks such as JPMorgan Chase and Goldman Sachs highlight the potential impact of quantum computing. A recent McKinsey report logged investment in quantum technologies at $2.35 billion in 2022. It also reported that financial services (and other industries) stand to gain up to $1.3 trillion in value by 2035.

But banks are not sitting back twiddling their thumbs, waiting for the good times to roll. They’re launching pilot programs with quantum-safe algorithms and meshing them with existing cybersecurity practices in preparation for future quantum activities. Many institutions have started trials to gauge the efficiency and security of these algorithms under real-world conditions.

Partnerships between research companies and technology providers are mushrooming, translating quantum research into practical business expertise. Now, tech firms are partnering with banks to establish potential use cases, design quantum algorithms and test developments on real quantum computers. And the first applications won’t be far behind. For instance, JPMorgan Chase has teamed up with IBM to experiment with quantum algorithms for financial use cases.

In due course, quantum literacy and expertise must be embedded throughout the enterprise. In addition, quantum task forces (IT specialists, cybersecurity experts and financial analysts) should be mobilized to evaluate new quantum applications and threats.

Approach and deployment

Quantum computing is imminent, and banking leaders need to view this mega opportunity with a mix of guarded optimism and planned investment. Quantum technologies will likely become the linchpin of banks’ financial strategies.

Different quantum computers solve different problems and fall into three categories: quantum annealing, noisy intermediate-scale quantum (NISQ) computing and fault-tolerant universal quantum computing.

Received wisdom states that quantum annealing is not a true quantum computer, offering only a slight advantage over traditional computers. Also, the development trail for quantum annealing doesn’t lead to our ultimate goal: fault-tolerant, universal quantum computers.

Many new algorithms are being adapted for NISQ computers, making them the best bet for delivering a momentary commercial advantage. And unlike quantum annealing, NISQs aim to build fault-tolerant universal quantum computers that solve significant business and technical problems exponentially faster than contemporary devices.

The heart of the matter

Quantum computing’s mounting influence on banking is a given, and its root-and-branch impact on cybersecurity, data analysis and financial modeling will be intense. Those who manage the change judiciously and proactively will gain an invaluable market advantage.

But it’s not enough to be on nodding terms with the fundamentals. Banks must prepare thoroughly because the competition for quantum primacy is not solely about speed; it’s about having the insight and understanding to transform security, grasp complexity and exploit quantum computing fully to secure your banking future. 

So, what can we do to protect sensitive information and maintain the integrity of essential applications and infrastructure in the face of future cyber threats and traditional hostile actors?

As we’ve seen, although practical quantum computing is down the road a ways, we need to develop quantum-safe cryptographic strategies now. At the same time, we still have to consider the business and social impact. Integrating cyber agility with system modernization will be a massive undertaking for top-tier banks, involving every financial services player and standards body (e.g., NIST) and will be supported by through-the-line, cross-industry collaboration.

Any classically encrypted (e.g., public-key cryptography) wire-tappable communications are vulnerable and already at risk, the idea being to “harvest data now, decrypt later” when quantum decryption techniques are finally realized. The IBM z17 provides extra protection by encrypting data wherever it resides, at rest, in-flight and now, in use, with fully homomorphic encryption.

The IBM z17 is quantum-safe ready. IBM has implemented quantum-safe cryptography in the z17 to protect against potential future threats from quantum computers. The system utilizes algorithms like CRYSTALS-Kyber and CRYSTALS-Dilithium, which have been selected by NIST for standardization. These efforts ensure that the IBM z17 can secure data against the advanced computational capabilities of quantum computers, making it a forward-thinking solution for cybersecurity.

Mainframe resilience: For decades, mainframes have formed the spine of banking operations. They provide robust processing capabilities, super resilience and unparalleled security. Mainframes handle massive transaction volumes with ease. According to IBM, they process something like 30 billion transactions a day, plus 87% of all credit card transactions, highlighting their critical role in banking.

Hybrid flexibility: Hybrid cloud architecture combines public cloud flexibility with private cloud security and on-prem infrastructure. It allows banks to scale resources on demand, enabling rapid responses to market developments. Gartner predicted that by 2025, more than 90% of enterprises will have a hybrid cloud infrastructure and platform. However, fewer than 10% have an effective multi-cloud strategy to address complexity, attain simplicity and take advantage of the opportunity. 

Security breaches can have catastrophic consequences, so the mainframe’s reputation for stiffened security is an attractive feature. Its ability to handle encryption and security protocols at scale is unmatched; an IBM Z mainframe can process up to 12 billion encrypted transactions a day.

Complying with regulations such as GDPR and PCI DSS is mandatory for banks. The mainframe’s robust audit and compliance tools provide a secure environment that helps meet exacting requirements. This is crucial because a single oversight can bring hefty penalties and reputational scrutiny.

Downtime is banking’s nemesis. Fortunately, mainframe systems are known for maintaining decades of business continuity. They offer high-availability features such as IBM Parallel Sysplex, which enables banks to run a cluster of up to 32 servers in parallel, ensuring high performance and continuous availability (even during maintenance or upgrades).

This reliability is essential for “always on” banking. For instance, a central European bank reported an impressive 99.99% availability after integrating its mainframe systems, underscoring the extraordinary reliability of the mainframe. 

The agility a hybrid cloud model provides is a primary driver for digital innovation. Mainframe systems offer a stable, high-performance foundation. At the same time, integration with cloud services enables banks to experiment with the latest front-end technologies, including generative AI, machine learning (ML) and advanced analytics without disrupting core banking functions. Banks can deploy a combination of ML cloud models to score mainframe transactions, enhancing the customer experience, improving risk management and tackling fraud.

Modernizing IT infrastructure is expensive. Notably, a cost-effective mainframe hybrid cloud strategy allows banks to modernize without discarding existing investments and expand mainframe capabilities with cloud service agility. In fact, a leading U.S. bank leveraged this architecture to modernize several of its workplace applications, achieving a 70% reduction in processing time and significant cost savings. 

The importance of effective data management is well known, and mainframes offer superior capabilities in managing vast data volumes. Banks can use cloud analytics tools to glean actionable insights while, their mainframe systems ensure high-quality, high-volume data is processed efficiently.

A long-standing DXC client, a large multinational bank, integrates mainframe data with cloud analytics to gain real-time insights into customer behavior, improving decision-making and customer service. 

Inevitably, as a bank grows, its infrastructure becomes increasingly complex. Cloud costs also increase, e.g., due to rising transaction volume and platform management. Consequently, banks are looking to accelerate hybrid cloud efficiency and procure the appropriate internal and external resources to make this happen. A recent report into the escalating cost of cloud computing showed that spending had overtaken security as the #1 management challenge, and a lack of resources/expertise was next in line. 

Mainframe hybrid cloud offers a streamlined solution to simplify IT management. The centralized nature of mainframes makes them easier to manage and secure. At the same time, cloud integration enables the rapid deployment of new services.

Banks need simplicity and ease of management to focus more on their core business and less on complex technological issues. 

Can you afford to stand by while quantum competitors snap up IP, talent and ecosystem relationships? It might be a long and winding road to the final destination, but others are speeding past several crucial milestones. Clearly, early adopters will build a tremendous lead and lasting advantage.

To learn more about what it takes to become quantum cybersecure and how Hogan-powered mainframe hybrid cloud enablement can help you become a quantum contender, taking care of securing BAU as well as helping to prepare for future threats and opportunities, visit the Hogan x page. Or, if you have a specific issue you’d like to discuss, contact our experts.