Joel Van Dyk (a physicist turned Wall Street cybersecurity veteran): A shield for the gap before crypto migration ends

I spoke with Joel Van Dyk, a physicist turned Wall Street cybersecurity veteran, about the quantum threat to cryptography and what organizations should be doing right now to prepare. Joel shared why he ranks quantum as one of the top risks for CISOs, explained the concept of cryptoagility — the need for continuous readiness to swap algorithms as quantum computers evolve — and described the tools he's building, including a quantum proxy called PQC Done that acts as a shield while firms undertake the years-long process of upgrading their cryptographic infrastructure. We also discussed how boards are becoming aware of the quantum risk, why the security and opportunity sides of quantum should work hand in hand, and where QKD fits into the broader post-quantum landscape.

Transcript

Yuval Boger: Hello, Joel. Thank you for joining me today.

Joel Van Dyk: Hi, thank you for having me.

Yuval: Of course. So who are you and what do you do?

Joel: So I am by education a physicist. I did my graduate degree in physics at NYU and my undergrad is also in physics. I've been one of the refugees from grad school in banking for the last thirty-odd years on Wall Street where I did cybersecurity, and I've become very interested over the last five or six years in quantum cryptography and security and quantum computing in general because it brings those two strands of my background into sharp focus.

Yuval: And today, what are you working on these days?

Joel: So today I am doing consulting to a couple of companies that are working in the cybersecurity post-quantum space. The most interesting is Project Eleven — that's spelled out as the word "eleven" — and they are building a ground-up PQC KMS. And then for myself, I have a company where we are building a quantum proxy complete with auditing information.

So the idea is to flip over traffic into quantum-safe algorithms, so that brings in the cryptography, as well as use AI to package up all the data we're going to see — because we're going to be seeing all the data going in and out — into useful data for risk management and cybersecurity risk management, because there's an endless hunger for that kind of data now.

Yuval: At a 30,000-foot level, a lot of the PQC discussions sound very similar. You know, quantum computers will one day be able to break encryption, therefore you should move to PQC. Even today, rogue actors are storing now to decrypt later, and companies should create an inventory of their assets, prioritize, and then become quantum secure.

But I'm sure there are many more details underneath that. What do you think people should know beyond this 30,000-foot discussion?

Joel: Gosh, that's such a wide field. Let me just attack it in no particular order. Yes, quantum computers are going to come. If I knew the exact date, I'd probably bet on it somewhere and make a lot of money.

But I don't. All I know is that the progress and the research in physics is moving inexorably that way. For instance, around Easter, at the beginning of April, end of March, we had two papers come out that really solved a lot of the basic physics around quantum computing, and also gave a lot of the threat models and a map of how to do it.

And so that turned this endeavor really into an engineering problem. And I know from my undergraduate days — I roomed with a lot of engineers. Engineers are very good at solving problems, so those things tend to get done, whether on a quicker timescale or further timescale, I'm not sure. Even though I mention betting, I'm not a betting man, and this is why we tell all the CISOs to plan for it sooner rather than later.

The most conservative estimate right now used to be 2035, and has moved into about 2029, 2030. Again, that's just a bell curve, a Gaussian. Anyone can be wrong, but that's the most likely. And what you've got to do is really the best offense is a good defense, so you want to prep.

Inventory is just the first good thing that we really worked on at the FS-ISAC PQC working group. But everything else kind of falls under this word we coined — or maybe we coined — of cryptoagility. We've lived for the last twenty-five, thirty years on the current algorithms.

Computers couldn't break them. We don't have that luxury anymore. So not only do you have to do inventory, you have to do inventory of all your hardware, your software, your third-party vendors. Then you have to start centralizing it, and you have to start building the muscle to say, "Hey, when a quantum computer breaks the latest and greatest NIST algorithm, I need to be able to switch that algorithm over in a couple days, a couple weeks."

We can't have another Heartbleed situation where everyone's running around not knowing what they're doing. And then another big thing is blockchain — that's all built around asymmetric encryption. And when a cryptologically relevant quantum computer, as they call it — one that can break a good part of cryptography — comes around in maybe the next four or five years, that's where it's going to go first.

And a lot of the FIs have made a big investment in blockchain, which is again why I'm interested in Project Eleven. They've got some of the best work in that space and a lot of the best intellectual property. That was probably a longer answer than you wanted, but I feel I just touched the surface there.

Yuval: No, it was a great answer. I love the details. So for an organization that wants to prepare, there are so many different approaches out there. How would you recommend they select the right partner to protect the enterprise against the quantum threat?

Joel: I think if we roll back to the very beginning — and I've worked in a lot of CISO organizations, and I've been a CISO myself — there's no one right answer, just like there's no one right answer to just blindly apply all the NIST controls and you'll have a good cybersecurity program.

What you want to do is do something that feels organic to your organization and will work in your organization. Some organizations are very innovative — JPMorgan and HSBC come to mind. Some are very audit-driven and so need a more top-heavy approach based on standards, for lack of a better term.

So you as a CISO have to really try to figure out, which is kind of your job anyway, where this fits in, and then where this fits in with the other side of the coin from security, which is really the general quantum compute. What the heck is the whole firm going to do with quantum computing at the end of the day?

So you want to work very strongly with your chief enterprise architect or their organization, and what I strongly recommend is not turning this into a political battle. What I recommended to my last firm is — I had a guy I worked with who's at JPMorgan now, Rob Otter, and we worked very closely hand in hand because we were both based in the same place in London. He did a lot of the quantum computing, I did a lot of the post-quantum cryptography, and those things kind of went hand in hand. And so the answer for the firm we were at, State Street, was let's form a center of excellence where we can feed off each other. Some firms are going to be very much, "Hey, this has to stay in one area. This has to stay in another area." So there's no one right answer. You just have to dig in and start dealing with all the problems.

Yuval: A CISO is facing multiple threats or multiple concerns every day, right? You've got AI models that are finding other options to break into the enterprise. Where do you rank quantum on that scale of super urgent to non-urgent at all?

Joel: And I'm very much in sympathy with that.

I've been in lots of CISO organizations and, depending on how they run and even depending on how they're set up, you've got a lot of stuff coming across your desk, and every time you turn around a corner, there's another regulator saying, "Here's a letter for you." Certainly AI is the bête noire of the current era, and I think there's lots of things that CISO organizations still have to get right and still have to keep getting right every day.

It's kind of cyber hygiene. You've got to get the SOC organization right. You've got to get your basic strategy and security architecture right. And one of the most important is identity and access management, which just seems to — once you solve it, you have to solve it again because it's that important, and the technology around it just keeps changing.

And then you've got your risk management organization. How do you interface with all your auditors, compliance people, and regulators? So in that whole rubric of things, quantum is definitely something that's not at the top right now as AI is, but I definitely put it second because it's a clear and present danger.

One of my former colleagues told me, yeah, at a particular bank, we could not get AI right and that could really hurt us, and we could not get a bunch of other things right, even blockchain, and we'd just be an also-ran. But if you don't get quantum right, you could be owned in a very short time when that cryptologically relevant quantum computer comes out.

So I definitely put it as number two. But it's something you've still got three or four years to really get under your belt and get an answer for. Don't get me wrong, start working on it now, but AI, you are definitely working on now. Identity and access management, you are working on now. Blockchain, you're working on now.

Yuval: I want to go back to your previous answer and the example you gave from State Street. If I understand correctly, you're basically saying that the two sides of the quantum coin — the risk and the opportunity — should really work hand in hand as opposed to being separate parts of the organization. I remember speaking with a CISO of a large financial institution, and he or she basically said, "Don't tell me about the opportunity, I just worry about the threat."

Why are they interconnected? I mean, is it just because one can tell you how fast the field is progressing versus the other? Why is there an advantage to working on both at the same time?

Joel: So in my mind, you're basically trying to factor the same set of skills. Generally, a lot of people in cybersecurity tend to come out of the networking field, the auditing field, but not very much the programming field.

And changing all this stuff over is going to involve, to quote Liam Neeson, "a particular set of skills." You have to be able to get into the code, be able to talk to the coders about moving their code to a central crypto repository, so you have to be familiar. You don't have to be the world's best coder, but you have to be familiar with how code works so you can speak their language and help them craft a solution and architecture that will actually work.

And when you want to be crafting that solution and that architecture, you want to work hand in hand with the same people who are pushing the skills around how to use quantum into the rest of the firm, because they're basically going to be doing the same thing for the rest of the firm, and so you can draft off their knowledge — to use a biking term — where they can say, "Oh, this is how we explained it to the risk programmers," and you can explain it to everyone else in those ways.

So knowledge is always something you can learn from and be transferrable. And if you want to really solve this problem, I think the more knowledge you have, the better. Which isn't to say that other organizations don't have their own organizational problems and can't work effectively in different ways.

But this is what I'd recommend as the best way to do it, just because the technology is so new, so innovative. I think of Y2K way back when, and that was a really cross-functional team because just like quantum, you're going to have to touch the hardware, you're going to have to touch the software and every other place in the firm. And it's arguably a little harder, as one of my colleagues said, because you're not just changing the clock algorithms, you're changing all the crypto algorithms.

Yuval: Tell me about the device that you're building. Maybe you could expand a little bit. You mentioned it earlier when I asked you what you're doing today, but what problem does it solve, and what's unique about the way that it's solving it?

Joel: So I was trained as a physicist, and I spent most of my career being a cyber architect, cyber manager, cyber engineer.

So I am really interested in the nitty-gritty technical problems. That's what makes my socks go up and down. But one of the things you learn being a cyber manager and a CISO is, "Hey, what's the big problem here? From a 35,000, 60,000-foot level, what is going to happen?" And what you plainly see — and Project Eleven, if you go to their website, has a really good report on it.

There's a section of their report, I forget the exact title, where they go over what the landscape is in the blockchain world, but a lot of it applies to quantum in general. And basically what you get is: here's what a big firm, a big investment bank can really do, and it's going to take ten years or so because it's like Y2K.

There's a lot of plumbing, a lot of nuts and bolts that have to be changed. And if a quantum computer is going to get here in four or five years, which is the most probable answer — a cryptologically relevant one — well, you've got a five-year gap, and you need some protection for that.

And so that's what this PQC Done idea really is. It's trying to provide a shield. I'm a big Star Trek fan. It's trying to provide a set of shields to hide the rest of the firm similarly to a firewall, so that the traffic going in and out is handled. It's done. That's why we called it Done.

And then you can have that extra five or six years to really upgrade the engines, the nuts and bolts behind the scenes. Similarly, that's why I'm interested in working with Project Eleven. They're really building the infrastructure from the ground up because there's a lot of this that's going to have to change with PQC, because cryptography is such a fundamental building block.

It's kind of like if you go back to my hometown, New York City — it's the steel bars that are sunk in the bedrock to support everything else. And now we're proposing to switch that out. And so that's what Project Eleven is doing. And then both these tools, because of the traffic they're going to be dealing with, are going to have a lot of information flowing through them that is going to be of premium significance and premium need to a CISO, to the risk management department of a bank or any regulated institution, because you're going to have to show you know where the cryptography is, you know how good all the cryptography is.

There's going to be some that's not good at all, some that's going to be so-so, and some that's going to be okay and easy to move. And so you need to be able to show your internal and your external supervisors and regulators that you have those. And that's what something sitting at the KMS level can do at Project Eleven, and that's what something sitting at the proxy level, like PQC Done, can do.

Yuval: In your assessment, how far are boards educated about the risk? I mean, three years ago, maybe you said, "Oh, well, it may be coming," and you should start thinking about that. Do the vast majority of boards already understand that there is a quantum risk, or are we still climbing the hill of education?

Joel: I think we'll always be climbing the hill of education in the sense that this deals with quantum mechanics.

And my buddies and I in grad school, like every other graduate student before us and after us, spent a lot of time talking about what does all this quantum mechanics really mean and what can it really do. And at the end of the day, we got the same answer from our professors that Niels Bohr gave Albert Einstein: It works. Just keep quiet and calculate, okay?

And so I think you're always going to have a lot of people scratching their heads saying, "Exactly what does it do?" But it works at the end of the day, thanks to Niels Bohr. And I find that when I talk to boards — specifically we tend to talk to the risk and audit committee of the board — they have a fairly good idea from reading the financial news and from reading stuff online, and they tend to be on board with all this stuff way before the executive committee is, and certainly a long time before senior and middle managers are.

And that's not to diss the senior and middle managers and the executive committee — it's just that those people have the burden of having to run the firm day to day. So they've got all the problems on their plate that you mentioned before about, "Hey, what's this week's audit? What's going on now? What's our risk here? Where are we exposed there?"

So I generally think, yeah, it's still a bit of an uphill climb. I think if you think of the Gartner curve, we're sort of at almost the tip of the first cycle.

Yuval: What's a widely held belief in PQC that you think is wrong?

Joel: Oh, gosh. Let me start out with one basic thing. As Albert Einstein said, "God doesn't play dice with the universe, and there's no spooky action at a distance." And I've heard any number of people try to explain to me what basically is the Einstein-Podolsky-Rosen theorem, action at a distance, whatever you want to call it — that there's something going on there in a quantum computer.

And it's like, "No, no, there isn't." So that's one of the things that I really think is one of the misconceptions. And the reason I mention it is that you have this confusion around the field in general, which is why I'd put out an advertisement for a lot of FIs and other banks: get a physicist or someone like that on your staff who can tell you if this stuff is important or not.

But the second thing is it leads to a lot of fear, uncertainty, and doubt. And so you've got a lot of people who are saying, "Oh, no, we have to prepare for this. Quantum computer's going to be here any day," which is probably not true. And then you've got a lot of other people saying, "This is clearly impossible because it just doesn't make physical sense." And I point those back to Niels Bohr.

So that's one of the biggest misconceptions. And the other misconception is, "Hey, we can do this problem and get it all done." And that's why the term cryptoagility has been coined — because of the way the quantum computer works, because of what it can do, because of what it's capable of solving, all the algorithms we have now will eventually be solved. And so you need to be in a state of continual agility, continually prepping, continually exercising that muscle.

It's kind of like when you do backups at a firm, right? Firms, depending on their risk profile, practice backups once every quarter, or at least once every half a year, at least once a year, to be able to restore from nothing. And that's to keep that muscle going, to know exactly what to do if the worst happens. And that's what's unfortunately going to happen with cryptography.

Yuval: Do you feel that the quantum threat is driving people to the cloud because the cloud providers, with the resources and understanding, can deploy quantum-safe cryptography quicker than what an enterprise could?

Joel: I'm going to answer that with a definite probably, okay? I think the writing, as they say in the Bible, has been on the wall for a long time.

Cloud. Banks first got into the data center business because they didn't have a choice, and we do an okay job at running data centers. The people who run data centers really well, as their lifeblood, are your cloud service providers — AWS, GCP, Azure. And no matter how smart we are, and we're plenty smart, don't get me wrong, it's just not our lifeblood.

Our lifeblood in banking is making a profit out of doing stuff and managing money, and so we're always going to be a cost center to them. So there's an inexorable finger pointing you to the cloud, and a lot of banks' infrastructure sits in the cloud already. With that, there's a mixture of stuff that you can't really move to the cloud.

A lot of banks still have their mainframe just because it still has the books of the bank on it, and they haven't really bitten the bullet of moving it to an IBM-managed mainframe. Lots of stuff you just want to keep internally, like a quantum KMS or any KMS, because you want to keep the keys to the kingdom to yourself.

So will a lot of it go to the cloud? Probably. That will make migration a lot quicker and better, because the CSPs tend to have superior tooling that's easier to deploy than we can do as a cost center. Will some of it still be internal? Probably. What that percentage is, I wish I knew.

Yuval: You mentioned KMS, so it begs the question: how do you feel about QKD, quantum key distribution? Is that useful, or is that a distraction from real PQC work?

Joel: I mean, for me as a physicist, I could pull out my physics book and show you the chapter and verse where we studied this way back when in grad school.

So it's tremendously interesting to me. There are lots of CISOs, some very influential in the field, who say QKD is a distraction and we should get the rest of the house in order, all the way over to some who are leading very innovative programs and say, "Hey, we need to look at this now." I tend to come down in the middle.

I don't see how we can do it today. However, things are moving so fast — what I said I might have six months for, I find out the next week I've only got three months for. And so should you be pursuing a program in QKD and trying to figure out how it works and where you'd deploy it in your firm? Absolutely. The whole island of Ireland is doing this between the Republic and the northern provinces. They've got a whole QKD pilot going on, and they're only one of many.

Should it come before fixing your basic cryptography and figuring out where all your inventory is? Probably not. That should be at the top of your pile first.

Yuval: And last, I wanted to ask you a hypothetical. If you could have dinner with one of the quantum greats, dead or alive, who would that be?

Joel: So I am going to lean towards my tribe. My mother was German Jewish from Bavaria, and Albert Einstein was from Ulm, and so I'd love to spend some time, even speaking German, chewing the fat with Albert Einstein. And maybe he could really explain things to me about quantum, and more importantly about grand unified field theories and quantum gravity and everything else that he never solved in his life.

Because one of his great sayings, which I always remember, is that God doesn't lead us around by the nose, but sometimes He really does because He's a little malevolent.

Yuval: Joel, thank you very much for joining me today.

Joel: Thank you. Thank you very much for having me.

Yuval Boger is the Chief Commercial Officer of QuEra Computing.