HPE Storage Securing Data for the Quantum Era

Quantum risk is not only about predicting when a cryptographically relevant quantum computer will arrive. Delegates will learn how to identify long-lived data and cryptographic exposure, prioritize migration decisions, build crypto agility, and create a phased post-quantum readiness roadmap that can begin today. Anthony Dutra, a technical marketing engineer at HPE, presented this session for HPE Storage at Security Field Day 16. He framed the threat around attackers harvesting encrypted data now so they can decrypt it once quantum computing becomes usable.

Dutra cited a readiness gap in which 87% of organizations are planning for post-quantum cryptography (PQC) but only 7% have acted. He separated PQC-capable products, which can support the new algorithms, from PQC-enabled ones, which have the capability turned on. His timeline began with NIST’s 2024 standards, set 2027 as the target for migration readiness, and put Q-Day around 2030. HPE’s recommended process is to discover sensitive data and how long it must stay confidential, prioritize by exposure lifetime and business impact, modernize through hybrid classical and post-quantum crypto agility, and validate everything. The inventory should cover data at rest, backups, archives, IAM, firmware, and software. When delegates asked about discovery tooling, Dutra said HPE currently uses only an internal readiness questionnaire and has no discovery tool on the roadmap. Delegates noted that customers often do not know where encryption lives in their environments.

On HPE’s own portfolio, Dutra said the Silicon Root of Trust in ProLiant servers already uses PQC-ready firmware signing. HPE is working with Brocade and Emulex HBAs across its SAN switches and arrays, and engineering is preparing Zerto as well. Storage remains PQC capable rather than enabled, because HPE has not yet validated the new algorithms on the data side. Dutra advised starting with the data that must be protected longest, migrating in phases that follow product roadmaps, and keeping trusted recovery copies throughout the transition. One delegate asked about data already stored under classical encryption. Dutra acknowledged that converting it would likely require migrating to a new array, a practical cost organizations should factor into their 2027 to 2030 planning.