Redefining data security for the post-quantum era

sponsor content What's this?

As defense agencies navigate the intersection of post-quantum threats, rapid artificial intelligence adoption and the evolution of autonomous battlefield capabilities, traditional cybersecurity methods no longer suffice. For many years, IT investments have prioritized digital perimeters — improving networks and firewalls — but data breaches continue to intensify year after year.

“The cyber industry hasn’t changed much in 30 years,” said Trent Telford, CEO and founder of Qanapi. “The internet wasn’t designed to be secure, it was designed to share information, so now what the industry is trying to do is retrofit and plug it to secure the data.”

Recent federal guidance, including Executive Order 14028 and OMB Memo M-22-09, focuses on implementing zero trust across all five pillars of CISA’s Zero Trust Maturity Model: identity, devices, networks, applications and workloads, and data. Among these, the last pillar remains the most difficult to operationalize — and critical to success.

As highlighted by the Federal Zero Trust Data Security Guide , “defining data down to the cellular level as the new perimeter and adopting dynamic data tagging, labeling and encryption technology” will protect the most sensitive assets.

Operationalizing post-quantum security

As agencies juggle government mandates, compliance and preparing for the post-quantum era, often with limited budget and workforce resources, security leaders are overwhelmed. They must navigate inefficient legacy systems while securing massive amounts of data and accelerating post-quantum readiness.

NIST has released several post-quantum cryptography (PQC) standards to help agencies safeguard their information. While adopting these standards checks off an essential step, many leaders are left wondering, “What’s next?”

“You’ve got the NIST library, fantastic. Now, what are you going to do with it?” Telford said. “How are you going to go back and post-quantum ready terabytes, petabytes of data sitting in SQL databases or in legacy systems or cloud apps?”

It is this fundamental operational gap that Telford and Qanapi set out to close.

Zero trust at the data layer

Decades of experience building technology companies, pushing past legacy cybersecurity barriers and leading a startup all the way through an IPO helped Telford create the foundation for a pioneering approach to cybersecurity built for the post-quantum world.

The answer lies at the data layer — binding identity, policy and encryption to the data object itself.

“We built a platform on those principles: identity, policy and key management at the object level, through an API service,” Telford said. A quantum API, to be specific, or “Qan-api.”

“Massive cryptoagility on an API platform that can integrate with any combination of systems at huge scale, and the key management and distribution is tied to identity and policy, which completely changes the risk profile of distributing keys out in the wild,” he added.

When keys are tied directly to an identity, whether a human user or a device, and situational conditions, exposure risks plummet. Telford likened it to leaving your home: rather than tossing keys all over the entryway where any passerby can take one, you only give keys to specific, trusted individuals.

“You already make a conscious decision with your keys that you might give it to your cleaner, or to your partner or to the maintenance guy,” Telford said. “But at least you knew who it was when you gave them that key.”

In practice, it’s about being able to prove who or what you are through credentials and context. For a human that might be clearance levels and classifications. For a drone, it could mean altitude, GPS location and wind speed.

“If those things add up together as policies, and the identities are correct, and it's got certain encrypted information being sent to it or preloaded on it, we can manage keys based on those conditions,” Telford said.

Securing AI with ‘dual provenance’

This granular protection extends directly to AI. As AI solutions become deeply integrated into critical missions, verifying data inputs and preventing sensitive data leaks is essential. Wherever data is coming from — sensors on the battlefield, drones in flight, medical devices, the cloud — Qanapi encrypts it at the source under strict policy conditions.

“We can set conditions around it and then we encrypt it, so now that data can go over any network,” Telford said. “When it hits our gateway, we check: ‘Is it from an authorized trusted identity? Is the policy okay?’ If so we will release that into your, for example, .mil AI instance. If none of those conditions line up, we don't even let that data go into the military AI service.”

Moreover, encrypting specific data elements before AI processing prevents sensitive information from leaking into training inferences. Together, these features provide dual provenance: positive provenance, the ability to cryptographically prove that data going into an AI system can be trusted, and negative provenance, proof that sensitive data elements within a file were encrypted at the field level at source, so the LLM can’t read those elements — all while maintaining a cryptographically verifiable audit trail. Put simply, dual provenance ensures there will be no poisoned data and no confidential data leaked into frontier models or mission-critical AI systems.

From analysis paralysis to action

For agency leaders who feel overwhelmed by the prospect of achieving post-quantum readiness, industry partnerships can help relieve some of the pressure. By the end of the year, agencies have been instructed by Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks," to “initiate a pilot project for PQC migration on an appropriate subset of information systems owned or operated by NIST.”

Telford urged agencies to begin with a discovery and immediate low hanging fruit remediation. From there, the strategy is simple: start small.

“After an automated discovery scan, start with data sets that aren't going to impact mission-critical systems day one, then you move up the difficulty curve over the next couple years to reach compliance by the deadline,” Telford said. “Let's start with a thin end of the wedge.”

The priority is showing progress with compliance orders now rather than delaying as deadlines approach. At the same time, industry plays a role in helping agencies move forward, with the responsibility to develop more digestible solutions rather than fragmented tools from numerous vendors.

“It’s overwhelming, but historically the industry hasn’t provided you with a holistic approach. We’ll raise our hand and say, ‘Give Qanapi a chance and we’ll give you that holistic approach,” Telford said. “You need a solution and outcome-based approach, not just piecemeal vendors who leave you with reports you can’t remediate, which turns into a risk bomb. We are happy to provide leadership on how we think this can be solved.”

In many ways, this story is about risk — the risks, known and unknown, of the post-quantum era, the risks inherent to emerging technologies, and the risks tied to both action and inaction. Trying a new approach or partner can be daunting, but Telford said defense leaders are beginning to embrace the concept that breakthrough innovations often come from agile, non-traditional vendors.

“Maybe you don’t have a budget issue; you have an allocation issue,” Telford said. “Instead of giving $200 million to a big company, why don’t you give them $180 million, reserve $20 million, and allocate it to smaller companies to see what they can do?”

Learn more about how Qanapi is helping government agencies revolutionize cybersecurity.

This content is made possible by our sponsor Qanapi; it is not written by and does not necessarily reflect the views of Defense One's editorial staff.

NEXT STORY: The Infrastructure Behind the Mission

赞助商内容 这是什么？

随着国防机构应对后量子威胁、人工智能快速普及和自主战场能力不断演进等多重挑战，传统的网络安全方法已不再适用。多年来，IT投资一直优先考虑数字边界——改进网络和防火墙——但数据泄露事件却逐年加剧。

Qanapi首席执行官兼创始人特伦特·特尔福德表示：“网络安全行业在过去30年里变化不大。互联网最初的设计目的并非安全，而是为了信息共享，因此现在这个行业所做的只是对其进行改造和升级，以确保数据安全。”

近期联邦政府发布的指导意见，包括第14028号行政命令和OMB备忘录M-22-09，重点在于在CISA零信任成熟度模型的五大支柱（身份、设备、网络、应用程序和工作负载以及数据）中实施零信任。其中，数据支柱仍然是最难实施的，但对成功至关重要。

正如联邦零信任数据安全指南所强调的那样，“将数据定义细化到蜂窝级别作为新的边界，并采用动态数据标记、标签和加密技术”将保护最敏感的资产。

后量子安全运作

由于各机构需要在预算和人力资源有限的情况下，兼顾政府指令、合规要求以及为后量子时代做好准备，安全负责人往往不堪重负。他们必须应对低效的遗留系统，同时还要保护海量数据并加快后量子时代的准备工作。

美国国家标准与技术研究院 (NIST) 发布了多项后量子密码学 (PQC) 标准，以帮助各机构保护其信息安全。虽然采用这些标准是至关重要的一步，但许多领导者仍然会问：“接下来该做什么？”

“你们有了NIST库，太棒了。现在，你们打算怎么利用它呢？”特尔福德问道。“你们打算如何处理存储在SQL数据库、传统系统或云应用中的TB级、PB级数据，使其适应后量子时代？”

特尔福德和卡纳皮着手弥合的正是这一根本性的运营差距。

数据层零信任

数十年来，特尔福德积累了创建科技公司、突破传统网络安全障碍以及带领初创公司一路成功上市的经验，这为他打造面向后量子世界的开创性网络安全方法奠定了基础。

答案就在数据层——将身份、策略和加密与数据对象本身绑定。

特尔福德说：“我们基于这些原则构建了一个平台：通过API服务，在对象级别进行身份、策略和密钥管理。” 具体来说，是一个量子API，或者叫“Qan-api”。

“API 平台具有强大的加密灵活性，可以大规模地与任何系统组合集成，密钥管理和分发与身份和策略挂钩，这彻底改变了在外部环境中分发密钥的风险状况，”他补充道。

当钥匙直接与身份（无论是人还是设备）和具体情况绑定时，泄露风险就会大幅降低。特尔福德将其比作出门：与其把钥匙到处乱扔，让路人随意拿走，不如只把钥匙交给特定的、值得信赖的人。

特尔福德说：“你把钥匙交给别人时，就已经有意识地决定了，你可能会把钥匙交给清洁工、伴侣或维修人员。但至少你把钥匙交给他们的时候，知道是谁的。”

实际上，关键在于能够通过资质和相关信息来证明你的身份或设备。对于人类而言，这可能意味着安全许可级别和分类；对于无人机而言，则可能意味着飞行高度、GPS定位和风速。

“如果这些因素加起来构成策略，身份也正确，并且向其发送或预加载了某些加密信息，我们就可以根据这些条件来管理密钥，”特尔福德说。

利用“双重溯源”保障人工智能安全

这种精细化的保护措施直接延伸至人工智能领域。随着人工智能解决方案与关键任务的深度融合，验证数据输入和防止敏感数据泄露至关重要。无论数据来源如何——战场上的传感器、飞行中的无人机、医疗设备、云端——Qanapi 都会在严格的策略条件下，从源头对数据进行加密。

“我们可以设定一些条件，然后对其进行加密，这样数据就可以通过任何网络传输了，”特尔福德说。“当数据到达我们的网关时，我们会检查：‘是否来自授权的可信身份？策略是否正确？’如果都符合，我们会将其发布到例如您的.mil AI实例中。如果这些条件都不符合，我们甚至不会允许该数据进入军用AI服务。”

此外，在人工智能处理之前对特定数据元素进行加密，可以防止敏感信息泄露到训练推理过程中。这些特性共同提供了双重溯源：正向溯源，即通过加密技术证明输入人工智能系统的数据可信；以及负向溯源，即证明文件中的敏感数据元素在源头已按字段级别加密，因此逻辑层模型（LLM）无法读取这些元素——所有这些都在保持加密可验证的审计跟踪的前提下完成。简而言之，双重溯源确保不会出现数据污染或机密数据泄露到前沿模型或关键任务人工智能系统中的情况。

从分析瘫痪到行动

对于那些因实现后量子时代准备工作而感到压力巨大的机构领导者来说，与业界合作可以帮助缓解部分压力。根据第14412号行政命令《保障国家免受高级密码攻击》，各机构已被指示在年底前“在NIST拥有或运营的适当信息系统子集上启动PQC迁移试点项目”。

特尔福德敦促各机构首先进行调查取证，并立即采取最容易实施的补救措施。接下来的策略很简单：从小处着手。

“在完成自动化发现扫描后，首先从不会对关键任务系统造成直接影响的数据集入手，然后在接下来的几年里逐步增加难度，最终在截止日期前达到合规要求，”特尔福德说。“让我们从最简单的开始。”

当务之急是立即推进合规指令的执行，而不是在截止日期临近时拖延。与此同时，行业也应发挥作用，帮助各机构推进工作，其责任是开发更易于理解和使用的解决方案，而不是来自众多供应商的零散工具。

“这确实令人不知所措，但从历史上看，这个行业并没有提供全面的解决方案。我们愿意举手表示，‘给Qanapi一个机会，我们将为您提供这种全面的解决方案，’”特尔福德说道。“您需要的是以解决方案和结果为导向的方法，而不是那些只会提供零散服务的供应商，他们只会留下一些您无法补救的报告，最终变成一颗隐患。我们很乐意在如何解决这个问题上发挥领导作用。”

从很多方面来看，这个故事都与风险有关——后量子时代已知的和未知的风险，新兴技术固有的风险，以及行动和不行动所带来的风险。尝试新的方法或合作伙伴可能令人望而生畏，但特尔福德表示，国防领导人正开始接受这样一个理念：突破性创新往往来自灵活、非传统的供应商。

“或许你们的问题不在于预算，而在于资金分配，”特尔福德说。“与其给一家大公司2亿美元，为什么不给他们1.8亿美元，留出2000万美元，分配给一些小公司，看看他们能做些什么呢？”

了解更多关于 Qanapi 如何帮助政府机构革新网络安全的信息。

此内容由我们的赞助商 Qanapi 提供；它并非由 Defense One 编辑人员撰写，也不一定反映其观点。

下一篇报道：任务背后的基础设施