PETALING JAYA: Malaysia is beginning to see a shift towards post-quantum cryptography (PQC) within the cybersecurity space as the country rapidly grows its digital economy.
Often seen as a technical term, PQC – which essentially refers to cryptographic algorithms used to protect against potential cyberattacks from quantum computers – will only become increasingly common in the business world.
In Malaysia, the PQC Migration Framework was developed by the government to allow for a proper pathway assisting companies to transition from traditional cryptographic systems to quantum-safe alternatives.
Industry observers said at its core, PQC is really about protecting the systems that work in the modern economy, such as digital payments, online banking transactions, and cross-border exchanges that rely on encryption to ensure that funds move securely and identities are properly verified.
“The concern is that the next wave of computing – quantum computing – could eventually break the encryption methods that businesses and organisations are depending on today, hence, PQC will become increasingly the norm,” said one observer.
Securemetric Bhd
chief executive officer (CEO) Edward Law said the shift toward PQC is no longer just a technical trend, instead, it is becoming a global regulatory requirement.
“As the world moves toward PQC as a standard, organisations that fail to adapt will eventually find themselves excluded from international digital supply chains and financial networks,” Law told StarBiz.
Law reckons Malaysia is ahead of many countries in the region because it has successfully transitioned from awareness to enforcement.
“While many Asean neighbours are still in the ‘whitepaper’ or research phase, Malaysia has built a comprehensive ecosystem for implementation,” he added.
He said Securemetric has ventured into Public Key Infrastructure or PKI solutions since 2010 with active participation on PKI projects across South-East Asia since.
“PKI is well recognised as the security fundamental of many information technology (IT) systems, and the role of PQC here is very crucial as well,” he said.
Another CEO of a cybersecurity company said PQC will shift from being an overly technical term into a more generic, broader term that will be intertwined with financial stability, risk management, and long-term economic planning.
“As infrastructure such as roads and ports facilitate trade, cryptography is needed to enable advanced digital commerce,” he added.
He noted that current encryption systems can still provide some security against conventional computers, but quantum machines are a “different animal”.
“For financial institutions like banks and insurance companies, and even some government-linked investment companies, the uncomfortable question about how long sensitive financial data can truly remain secure is brought up more often these days.
“In this sense, PQC becomes less about theoretical cryptography and more about security. Think about it as a form of long-term risk hedging.
“Just as companies hedge against currency volatility or rate movements, they now need to look into hedging against future decryption risk as well,” he said.
The CEO also reckons that Malaysia is “way ahead” of its regional peers, adding that by planning a phased transition over the next few years, Malaysia is able to spread out the costs and complexity of adoption while minimising the risks of sudden disruption to systems.
“This is actually how a lot of the financial reforms we’ve seen are typically implemented, where slow adjustment is preferred over abrupt changes,” he added.
Nevertheless, there will be challenges.
An analyst said companies that adopt PQC, particularly the smaller ones, will likely struggle with costs and technical complexity, especially in the beginning.
Securemetric’s Law said cost is a subjective issue.
“If we talk about getting an organisation to be PQC-ready, this is mostly subjected to the scope of work that will be involved.
“Normally, the more complex their IT systems are, the higher the costs will be.”
Meanwhile, the analyst also pointed out that the adoption process could be affected by the lack of talent in advanced cryptography.
“But beyond this, the global standards for PQC are still evolving, which means there is a certain degree of uncertainty.”
