HP Intros Printers with Protection Against Quantum Cyberattacks – Source: securityboulevard.com

HP this week announced a new family of printers that include features to protect them against cyberthreats expected to arrive with quantum computing, which given recent breakthroughs could arrive sooner than many think.

While the technology promises huge advances in everything from drug discovery to machine learning to supply chain management, it also likely could break modern encryption methods, putting vast amounts of data at risk of exposure and theft.

“A sufficiently powerful quantum computer could break much of the cryptography relied upon globally,” Tommy Charles and Thalia Laing, researchers with HP Security Lab, wrote in a report accompanying HP’s announcement. “Given how fundamental cryptography is to security everywhere, a quantum computing breakthrough before the world is ready would jeopardise security.”

HP has begun to harden products against the threat of quantum systems breaking the cryptography of its products. A year ago, the company unveiled business PCs that included an upgraded Endpoint Security Controller chip to protect the systems’ firmware against quantum computer-based hacks.

This year the company turned its attention to business printers, rolling out the new 8000 Series devices that offer quantum resilience capabilities. Those capabilities include new ASIC chips designed with quantum-resistant cryptography and allow for digital signature verification to protect the integrity of firmware during quantum-based attacks. In addition, the chip protects early-stage BIOS and BIOS boot firmware, reducing the risk of data breaches, according to the company.

The lineup includes the HP Color LaserJet Enterprise MFP 8801, Mono MFP 8601, and LaserJet Pro Mono SFP 8501 printers.

Printers are Overlooked

HP’s announcement at its HP Amplify Conference in Nashville, Tennessee, put a spotlight on two security concerns enterprises and SMBs have to wrestle with: the threat posed by connected printers, copiers, and other Internet of Things (IoT) devices and the need to begin preparing now for the arrival of quantum computing.

Printers often are overlooked when talking about security, but their connection to the internet and the amount of data they hold make them attractive targets for cybercriminals.

“Printers often sit under the radar of standard endpoint security, which leaves them surprisingly vulnerable,” Louis Costantini, digital marketing manager at Sharp, wrote in January. “Many SMBs still operate with default settings, unpatched firmware, and inadequate encryption protocols. This lapse can be fatal: attackers see a network-connected printer as an easy way to bypass traditional security measures, collect valuable data, and move across a company’s internal network.”

Quantum May Be Closer Than It Appears

However, while cyberthreats are real now, quantum computing has been something that has been a long time coming, with some wondering if it was every going to arrive. However, breakthroughs in recent months by the likes of Google, Microsoft, and Amazon Web Services to solve long-standing problems like error correction in qubits – the fragile foundation of quantum computing – has some thinking fault-tolerant quantum systems are coming fast. Microsoft, in announcing its new Majorana quantum chip last month, said its likely years away, not decades.

HP Security Lab’s Charles and Laing pointed to a report by the Global Risk Institute that in which almost a third of 32 experts surveyed said there was a 50% or greater chance of quantum systems breaking cryptography by 2034, which the organization said posed an “intolerable risk from a cybersecurity perspective.”

But the deadlines facing enterprises aren’t just about when reliable quantum systems will arrive. For example, the U.S. National Security Agency starting in 2027 will only buy devices with firmware and software secured with quantum-resistant cryptographic code signing. HP noted that most contractual sales and managed print services agreements cover three-to-five years, which means organization need to include quantum-resilient capabilities with their next round of printer purchases if they’re to make U.S. government’s 2027 deadline.

Heightened Urgency

“In reaction to these advancements, there has been an increased sense of urgency to fortify cryptography, driven by technical authorities and experts,” HP Security Lab’s Charles and Laing wrote. “This urgency has led to accelerated timelines and new policies to address the looming quantum threat.”

There also have been two false alarms about quantum-based security threats, which have added fuel to the urgency, Charles and Laing wrote.

The threats aren’t just about the cryptography of systems at the time reliable quantum computers arrive. There also is worry that bad actors may have stolen massive amounts of data now in anticipation that they’ll be able to break the encryption that protects them now when quantum computing becomes available, a process called “harvest now, decrypt later.”

Prepare Now

Vendors and enterprises need to start addressing the cyberthreat of quantum computing now rather than waiting for when the systems finally arrive, Charles and Laing wrote, noting that NIST last year standardized general-purpose quantum-resistant cryptography algorithms that are being adopted internationally, creating a viable migration path for organizations to follow.

“The threat quantum computers pose to cryptography has steadily advanced this past year, creating an unacceptable security risk to the algorithms fundamental to securing our digital lives,” they wrote. “It would be devastating if these cryptographic algorithms were broken.”