QAAS Framework: Where AI FitsThe QAAS framework defines four converging threat vectors reshaping modern cybersecurity:Quantum Threat — undermining cryptographic foundationsAI Threat — automating and accelerating cyber attacksAPT Threat — enabling long-term, persistent infiltrationSupply Chain Threat — compromising trust at systemic scaleThese axes do not evolve independently. They reinforce one another.If Quantum Threat destabilizes cryptography,AI Threat operationalizes that weakness.If APT groups gain silent access, AI accelerates their movement.If supply chains are compromised, AI scales exploitation.Within QAAS, AI is not merely another threat category.It is the force multiplier that transforms vulnerability into operational cyber risk.AI Threat: A Structural Shift in Cyber RiskCybersecurity has traditionally focused on defending systems.Firewalls, patch management, encryption standards—these formed the backbone of digital protection. The implicit assumption was that attackers attempt to penetrate from outside clearly defined boundaries.AI-driven cyber threats invalidate that assumption.An AI Threat is not limited to technical intrusion.It targets the mechanisms through which trust is formed, validated, and executed. In doing so, it reshapes cyber risk at a structural level.This transformation is already observable in real-world AI-driven attacks.1. Impersonating Trust — AI-Driven Identity ManipulationOne of the most alarming developments in AI cyber attacks is the use of AI for real-time impersonation.In a widely reported financial fraud case involving a global engineering firm, attackers did not exploit network vulnerabilities. They leveraged AI-generated voice and video to impersonate a senior executive during a live video conference.No firewall was breached.No malware was deployed.Instead, AI-driven identity manipulation entered through legitimate decision-making channels. The fraudulent transfer appeared to be properly authorized.This illustrates a critical shift:most cybersecurity architectures ultimately rely on human validation as the final trust anchor. AI now has the capability to simulate that validation layer.By modeling speech patterns, behavioral cues, decision logic, and contextual responses, AI transforms phishing from crude deception into credible operational interaction.In this sense, AI Threat does not bypass trust mechanisms.It weaponizes trust itself.2. Automation of Cyber Attacks — Machine-Speed ExploitationAI Threat also manifests in the automation of cyber attacks.AI-powered offensive engines can:Map network topologyCorrelate vulnerabilitiesIdentify optimal attack pathsAdapt tactics in real timeWhat previously required the expertise of advanced attackers can now be embedded in AI models.Each failed intrusion attempt feeds subsequent optimization.Attack cycles shorten.Learning becomes continuous.This evolution reduces the barrier to entry for sophisticated cyber operations. Capabilities once associated with state-level actors become accessible through AI-enabled tooling.Meanwhile, defensive security operations centers (SOCs) remain bound by:Human review cyclesEscalation proceduresFalse positive managementRegulatory and operational constraintsThe asymmetry is clear:AI-driven attacks operate at machine speed, while cyber defense remains constrained by human decision processes.Within QAAS, AI functions as an accelerator.If Quantum Threat breaks encryption assumptions, AI ensures rapid exploitation of those weaknesses.3. AI-DPA — From Algorithmic Security to Physical LeakageA common assumption in cybersecurity strategy is that strong cryptographic algorithms ensure protection.AI-DPA (AI-driven Differential Power Analysis) challenges this belief.Rather than attacking cryptographic mathematics directly, AI-DPA analyzes physical leakage produced during cryptographic operations:Power fluctuationsTiming variationsElectromagnetic emissionsTraditional side-channel attacks relied on theoretical modeling and feature extraction techniques. Defensive measures such as noise injection and randomized execution could mitigate risk.Deep learning alters this equation.AI-based DPA models can compensate for environmental noise, infer encryption keys from smaller datasets, and detect subtle implementation-level characteristics invisible to human analysts. In some cases, AI identifies entirely new key extraction pathways.This marks a critical transition:side-channel exploitation evolves from specialized expertise into scalable, AI-enabled cyber attack methodology.The implications are particularly severe in:IoT devicesUSIM and eSIM modulesEmbedded systemsMedical and industrial control environmentsIn such contexts, compromised keys can enable unauthorized command execution, not merely data exposure.Security focus therefore shifts:From algorithm strength→ to implementation integrity→ to guarantee physical trust.AI now challenges security across software and hardware layers simultaneously.AI Threat as Systemic Cyber RiskAI Threat must not be understood as a discrete attack vector. It is a systemic cyber risk multiplier.It:Erodes digital trustAutomates exploitationExtracts physical secretsAccelerates APT operationsAmplifies supply chain compromiseWithin the QAAS framework, AI connects the axes. It shortens the time between vulnerability discovery and operational breach.The strategic question is no longer whether AI-driven cyber attacks are possible.The more relevant question is this:As AI Threat becomes operational, how fundamentally are we redesigning trust architecture itself?CMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK Teletech? FAQ | AI Threat and AI-Driven Cyber AttacksQ1. What is an AI Threat in cybersecurity?A. An AI Threat refers to the use of artificial intelligence to automate, accelerate, and enhance cyber attacks. Unlike traditional hacking, AI-driven cyber attacks can simulate human behavior, adapt in real time, and continuously optimize attack strategies.Q2. How are AI-driven cyber attacks different from traditional cyber attacks?A. Traditional cyber attacks rely on human expertise and manual execution. AI-driven attacks embed that expertise into machine learning models, enabling automated vulnerability discovery, adaptive exploitation, and large-scale impersonation at machine speed.Q3. Why is AI Threat considered a systemic cyber risk?A. AI Threat is considered systemic because it does not target isolated vulnerabilities. Instead, it undermines digital trust structures—authentication, identity validation, cryptographic implementation, and decision processes—across entire systems.Q4. What is AI-DPA, and why is it dangerous?A. AI-DPA (AI-driven Differential Power Analysis) is a side-channel attack technique that uses machine learning to analyze physical leakage signals such as power fluctuations and electromagnetic emissions during cryptographic operations. It can extract cryptographic keys even when strong algorithms are used.Q5. Can strong encryption alone prevent AI-driven attacks?A. No. Strong encryption algorithms are necessary but insufficient. AI-based attacks can target implementation flaws and physical leakage rather than mathematical weaknesses, which means security must extend beyond algorithm selection to hardware-level trust guarantees.Q6. How does AI Threat relate to Quantum Threat within QAAS?A. Within the QAAS framework, Quantum Threat undermines cryptographic mathematics, while AI Threat operationalizes exploitation. If quantum capabilities weaken encryption, AI accelerates the transition from vulnerability to breach.Q7. Are AI-driven cyber attacks already happening?A. Yes. AI-generated impersonation, automated phishing campaigns, adaptive malware, and AI-assisted side-channel attacks are already observable in real-world incidents.Q8. What industries are most exposed to AI Threats?A. Industries relying heavily on digital trust infrastructure—finance, telecommunications, defense, healthcare, IoT ecosystems, and embedded systems—are particularly exposed to AI-driven cyber risks.Read more[Insight] The Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats" [Insight] The Era of QAAS (Part 2): Case Studies of Converged Cyber Threats#AI #CyberSecurity #CyberThreats #AIAttack #Deepfake #CyberDefense #ZeroTrust #QuantumSecurity #SecurityArchitecture #RiskManagement #HardwareSecurity #AIDPA #QAAS #AIThreat

Quantum Threats Go Systemic: 10 Risks Reshaping Nations, Industries, and SocietyAs quantum computing moves from theory to operational reality,The collapse of today’s cryptography will no longer be a technical issue.It will become a systemic risk—one that impacts national security, industrial operations, financial trust, and social stability all at once.? Previous Post: The Post-Quantum World — What Quantum Computing Will Actually BreakWhat makes this threat especially dangerous is its non-linear nature.Encrypted data collected today can be broken years later, retroactively exposing sensitive information across decades.The following ten risks are not speculative scenarios.They represent real, structurally plausible consequences of quantum-capable adversaries—and align directly with the QAAS threat framework: Quantum, AI, APT, and Supply Chain convergence.1. National Intelligence and Defense ExposureQuantum-enabled decryption threatens not only future communications but also decades of archived encrypted data.Diplomatic cables, military strategies, intelligence intercepts (SIGINT), and classified communications—once protected by RSA and ECC—can be decrypted once large-scale quantum computing becomes viable.This fundamentally undermines:Strategic deterrenceIntelligence alliancesLong-term national security planningThe result is not a single breach, but the erosion of sovereign defense capabilities over time.This is why intelligence and defense data are prime targets of Harvest Now, Decrypt Later (HNDL) attacks.2. Collapse of Financial System IntegrityModern financial systems rely on cryptographic signatures to establish transaction authenticity and non-repudiation.If those signatures can be forged through quantum attacks, the problem is not stolen money—it is lost trust.Potential consequences include:Inability to verify legitimate transactionsDisputes with no cryptographic ground truthBreakdown of interbank settlement confidenceIn such a scenario, the financial system does not merely suffer losses—it ceases to function reliably.3. Telecom Identity HijackingTelecommunication networks depend on cryptographic identity at every layer:eSIM / USIM authenticationDevice-to-network trustCore network authorizationOnce those identities are compromised, attackers can impersonate:DevicesBase stationsNetwork infrastructureThis places national communication backbones, emergency networks, and public safety systems at risk—transforming a cyber issue into a matter of national resilience.4. Vehicle and Smart Factory TakeoverVehicles, robots, and industrial systems trust signed commands.If quantum attacks allow attackers to forge OTA updates, ECU authentication, or controller authorization, the command authority itself is compromised.This enables:Remote vehicle manipulationFactory-wide production shutdownsIndustrial accidents and safety failuresAt scale, such attacks threaten the foundations of modern manufacturing economies.5. Satellite and Space System SpoofingSatellite systems were designed for longevity, often relying on cryptographic schemes that cannot be easily upgraded.If command links are compromised:Orbital control commands can be forgedReconnaissance data can be manipulatedGPS time signals can be alteredSince precise timing underpins aviation, logistics, finance, and defense, space-layer compromise cascades into terrestrial chaos.6. Cryptocurrency and Blockchain BreakdownMost blockchain systems rely on ECC-based private keys.Quantum decryption enables:Immediate wallet compromiseSignature forgery at scaleIdentity impersonation in consensus mechanismsOnce transaction authenticity can no longer be verified, the core promise of blockchain—trustless consensus—collapses.7. Quantum-Enabled Supply Chain AttacksFirmware signing, device authentication, and update verification are foundational to global supply chains.Quantum attacks enable attackers to:Forge trusted firmwareInsert persistent backdoorsCompromise entire OEM ecosystemsThis transforms isolated attacks into system-wide supply chain infiltration, especially dangerous for telecom, energy, and defense infrastructure.8. Paralysis of Critical InfrastructurePower grids, water systems, transportation, and industrial control systems (ICS/SCADA) all depend on cryptographic trust.Once that trust fails:Control commands can be spoofedSafety mechanisms can be bypassedPhysical damage becomes possibleThis is where cyber risk crosses into real-world societal disruption.9. Quantum-Enhanced APT OperationsAdvanced Persistent Threat (APT) groups already operate on multi-year timelines.Quantum decryption accelerates this by:Unlocking previously captured encrypted dataExposing internal authentication systemsEnabling undetectable lateral movementThe result is long-term, stealthy control over critical systems, often without immediate detection.10. Social Manipulation and Information CollapseWhen quantum decryption converges with AI-generated deepfakes, trust in information itself erodes.Forged communications from governments, financial institutions, or leaders can:Trigger market panicUndermine political stabilityDisrupt disaster responseThis creates a compound crisis, where technological, financial, and social systems fail simultaneously.Conclusion: Quantum Threats Are Systemic by NatureEach of these risks may appear isolated.In reality, they are interconnected, capable of triggering cascading failures across sectors.The quantum threat is not a future hacking technique.It represents a structural shift in how trust must be built, anchored, and maintained.In the next installment, we will explore the second axis of the QAAS framework:AI Threats—how automation and intelligence amplify attack speed, scale, and impact.CMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK Teletech? FAQ | Why the Quantum Threat Matters Now Q. What is a Quantum Threat? A. A quantum threat refers to the risk that quantum computers can mathematically break widely used cryptographic algorithms, such as RSA and ECC.This is not simply a hacking problem—it represents a systemic risk capable of undermining trust across governments, financial systems, industries, and society as a whole.Q. Why is the quantum threat a problem now, even though quantum computers are not fully developed yet?A. The primary reason is Harvest Now, Decrypt Later (HNDL) attacks.Adversaries are already collecting encrypted data today, with the intention of decrypting it in the future once quantum capabilities mature.As a result, past data becomes vulnerable retroactively, not just future communications.Q. What types of data are most vulnerable to quantum attacks?A. The most vulnerable data is long-lived, high-value information that must remain secure over many years.This includes diplomatic and defense communications, financial transaction records, telecom authentication credentials (eSIM/USIM), vehicle and industrial control commands, and blockchain private keys.Q. How are quantum attacks different from traditional hacking or APT attacks?A. Traditional attacks exploit software vulnerabilities or configuration errors.Quantum attacks, by contrast, break the mathematical foundations of cryptography itself.As a result, they cannot be mitigated with patches alone and require a fundamental redesign of security architectures.Q. Why is the quantum threat considered a “systemic risk”?A. Cryptography underpins authentication, integrity, and command trust across digital systems.When cryptographic trust fails, multiple sectors—finance, telecom, energy, transportation, and defense—can collapse simultaneously, which is why the quantum threat is classified as a systemic risk.Q. When should organizations start preparing for post-quantum cryptography (PQC)?A. Preparation must begin now.Migrating to PQC involves standard validation, system redesign, and hardware replacement, and typically requires 5 to 10 years or more, especially in regulated or embedded environments.Q. Is adopting PQC alone sufficient to address quantum threats?A. No. While PQC is a necessary foundation, it is not sufficient on its own.True quantum resilience also requires Hardware Root of Trust, secure key generation and storage, and supply chain trust verification to be designed together.Q. What happens if organizations ignore the quantum threat?A. Ignoring quantum risk can lead to massive simultaneous data exposure, paralysis of financial and industrial systems, and long-term erosion of trust.Once cryptographic trust collapses, recovery is extremely difficult and costly.Read moreThe Post-Quantum World — What Quantum Computing Will Actually Break The Beginning of the Quantum Threat — Why RSA and ECC Are Compromised by Quantum ComputingThe Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats"

- The Unclonable Device Identity That Makes Zero-Trust Devices Possible From Episode 2: Why Initial Authentication Is Never EnoughIn the previous post, we reached a critical conclusion:Security is not complete with initial authentication alone.For a Zero-Trust Device to exist, a device—and the software running on it—must be able to continuously prove that it is genuine, at every moment.We also identified the foundation of this continuous trust:Hardware Root of Trust (HRoT) — the anchor where device trust begins.That leads to one essential question:What should a Hardware Root of Trust be built on so that its identity cannot be forged, cloned, or stolen?The technology that answers this question is PUF (Physically Unclonable Function).This post explains what PUF is, how it works, and why it is essential for Zero-Trust Device Security.▲ A whiteboard lesson from my first week at ICTK — learning PUF directly from my mentor, Bongho KangWhat Is PUF?PUF (Physically Unclonable Function) is a hardware security technology that generates a unique andunclonable device identity using the natural physical variations that occur during semiconductor manufacturing.Traditional device security typically relies on:stored cryptographic keysdigital certificatesIDs written into memoryPUF takes a fundamentally different approach.A PUF does not store identity.It derives identity from the physical structure of the chip itself—every time it is needed.This distinction is what makes PUF uniquely suited for Zero-Trust Device architectures.Why Stored Keys and IDs Fail in Zero-Trust SecurityToday, many IoT, automotive, and mobile devices authenticate themselves using:secret keys stored in Flash, OTP, or secure memorydevice certificatesfactory-injected IDsThe problem is simple and fundamental:Anything that is stored can eventually be extracted.Even when protected by secure memory, stored secrets remain vulnerable to:Side-channel attacksDifferential power analysis (DPA)Firmware compromiseSupply-chain attacksOnce a key or ID is exposed, attackers can create perfect device clones with the same identity.At that point, the Zero-Trust assumption collapses.How PUF Creates an Unclonable Device IdentityPUF does not rely on algorithms or random numbers.It derives its identity from the physical properties of the silicon itself.These include:microscopic variations in transistor dimensionsinconsistencies in wire length and resistancenatural differences in electrical behaviorThese physical variations:cannot be controlled by designcannot be predictedcannot be reproducedWhen measured electronically, they produce a unique response pattern—a true hardware fingerprint that belongs to only one chip.The Six Essential Properties of a True PUFFor a PUF to serve as the identity foundation of an HRoT, it must satisfy all six of the following security properties.PropertyMeaningSteadinessThe same chip must produce the same identity across time, temperature, voltage, and agingRandomnessThe identity must be unpredictableUniquenessEvery chip must have a different identityPhysically UnclonableThe physical structure cannot be duplicatedMathematically UnclonableNo algorithm or model can reproduce the identityTamper-ResistancePhysical attacks must not allow identity extraction or reuseOnly when all six properties are satisfied does a PUF become a true hardware identity—not just a fingerprint, but a Root of Trust.Why PUF Turns HRoT into a True Root of TrustHardware Root of Trust (HRoT) is where a device proves “I am genuine.”However, if the HRoT relies on stored keys, its trust can eventually be compromised.With a PUF-based HRoT:Traditional ApproachPUF-Based ApproachStores keysStores no keysIdentity exists in memoryIdentity is generated from physical structureKeys can be stolenThere is nothing to stealCloning is possiblePhysical cloning is impossiblePUF transforms HRoT from a security function into a physically unforgeable source of trust.That is why PUF can be described as the missing piece of Zero-Trust Device Security.Looking Ahead: Not All PUFs Are EqualSo far, we have examined how PUF creates an unclonable device identity.However, in real products and mass-production environments, not all PUFs meet these six properties equally.Stability under environmental changes, error rates, and key derivation methods creates significant differences in PUF quality.In the next post, we will explore:How PUF implementations differ in real-world deployments, andHow ICTK’s VIA PUF achieves these six properties at an industrial scale.SummaryEncryption protects data.HRoT protects device identity.PUF makes that identity physically and mathematically unclonable.In the IoT, AI, and quantum era, security no longer starts with stronger algorithms— it starts with trust that cannot be copied.Read more[PUF & Hardware Root of Trust] Beyond Encryption: Why "Trust" Is Becoming the Core of Modern Security[PUF & Hardware Root of Trust] Why Initial Authentication Is Never Enough#PUF #ZeroTrust #DeviceSecurity #HardwareSecurity #RootofTrust #HRoT #IoTSecurity

▲ img source: Gettyimagesbank.com Quantum computers are not “faster classical computers.”They are a new physical computing system that performs fundamentally different types of computation.Once quantum computing is introduced at scale,existing security, authentication, and communication systems will be shaken from their foundations.? Previous Post: The Beginning of the Quantum Threat — Why RSA and ECC Are No Longer SecureIn this part, we move beyond the abstract statement that “RSA and ECC will be broken,”and instead examine — in concrete terms — how quantum computing can destabilize and collapsereal-world industrial and national infrastructure.1. Financial infrastructure fails firstMost modern financial systems are built on RSA-based cryptographic structures, including:Internet bankingATM ↔ Core banking encryptionCard payment networksSWIFT messagingDigital-signature-based transfer approvalsIn the post-quantum era, these cryptographic assumptions become decryptable.This is not merely a matter of stolen accounts — it represents:a collapse of system-wide integrity across the financial infrastructure.Once message integrity and identity validation fail, the financial system can no longer guarantee trusted execution.2. Telecommunications (Telco) infrastructure is structurally vulnerableThe following systems all rely on RSA / ECC-based authentication and signature schemes:USIM / eSIM authentication (MILENAGE / EAP-AKA)HSS / AAA authentication serversLTE / 5G Core signalingRAN device authenticationIf quantum attacks succeed, the following become feasible:IMSI extractionRogue / spoofed base stationsFake Core NetworksTelco equipment turning into APT entry pointsIn other words:the telecom network itself can transform into an offensive attack platform.This risk propagates laterally across operators, roaming environments, and cross-domain trust boundaries.3. Automotive, industrial, and manufacturing systems become exposedModern automotive and manufacturing ecosystems consist of dozens —often hundreds — of networked components:ECUssensorscontrollersindustrial robotsThe authentication of these devices is predominantly RSA / ECC-based.In a post-quantum environment, the following attacks become realistic:OTA firmware update tamperingforged vehicle control messagesimpersonated factory robotsremote penetration of industrial equipmentThe result is thatthe entire industrial control network becomes an expanded attack surface.Trust anchors inside operational technology (OT) systems cease to function as reliable roots of identity.4. Defense and space systems are primary quantum-era targetsThe following domains retain strategic value for 20–50+ years,making them high-priority targets for HNDL (Harvest Now, Decrypt Later):satellite communicationstactical communications (TACCOM)weapon-system command linkscryptographic devices (KMIP-based key exchange)GPS spoofing scenariosMeaning:adversaries collect encrypted intelligence today because it will still be valuable long after decryption becomes possible.The long-term persistence of classified data makes national defense systems one of the most exposed sectors in the quantum transition timeline.5. Blockchain and digital assets fail the fastestCryptocurrency ecosystems rely heavily on ECC-based signatures (particularly secp256k1),which become attractive quantum targets.Feasible attack scenarios include:private key exposurewallet takeoverlarge-scale transaction forgerychain-fork manipulation (easier than a 51% attack in some cases)As such,blockchains are expected to be among the earliest large-scale distributed systems to fail in the quantum era.In practice, however, the more immediate risk is likely to emerge in:exchange cryptographic infrastructureauthentication & key-management systemsHistorically, most real-world incidents have targetedexchange vulnerabilities rather than the blockchain protocol itself.Quantum risk amplifies this asymmetry.6. Combined with supply-chain compromise, the impact scales exponentiallyQuantum-enabled cryptographic failure becomes a gateway enablerfor large-scale supply-chain attacks:forged firmware signaturesbypassed device authenticationcompromised update serversOEM-level manipulation and tamperingThus,quantum threat vectors converge with other QAAS attack pillars, completing a multi-vector, system-level attack model.The problem is not merely a cryptography failure — it is the collapse of trust across interconnected ecosystems.In the next part, we will examine:How quantum threats create systemic risk across entire industriesWhy current trust architectures cannot survive a post-quantum transitionnd what this implies for authentication, key management, and infrastructure trust models.CMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK TeletechRead moreThe Beginning of the Quantum Threat — Why RSA and ECC Are Compromised by Quantum ComputingThe Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats"The Era of QAAS (Part 2): Case Studies of Converged Cyber Threats

The foundation of modern Internet security is built on public-key cryptography, including RSA, ECC, and DH.For more than 40 years, these algorithms have become de facto standards across almost every industry — finance, telecommunications, mobile, digital signatures, national defense, and more.All of this, however, has relied on a single premise:“On classical computers, deriving the private key from the public keyis computationally infeasible within a valid time window.”The problem is that this premise no longer holds true.Quantum computing introduces a fundamentally different computational paradigm that undermines the foundations of existing cryptographic systems — and at the center of this threat lies Shor’s Algorithm.1. The “Hard Problems” That Classical Cryptography Depends OnRSA is based on the hardness of integer factorization.ECC relies on the hardness of the Discrete Logarithm Problem (DLP).In other words, cryptography has long asserted:“Solving these problems would take billions of yearson classical computers — therefore they are secure.”But this notion of “hardness” only applies under classical computing assumptions.Quantum computers approach these problems using a completely different computational framework.2. Shor’s Algorithm — A New Kind of Mathematics That Breaks Classical CryptographySince its publication in 1994, Shor’s Algorithm has been regarded as one of the most disruptive breakthroughs in cryptography and computer science.Its core mechanism can be summarized as follows.① Transforming factorization into a “period-finding problem.”Instead of performing factorization directly,The algorithm analyzes expressions of the form  and finds the repeating period r.Once r is obtained, the prime factors p and q that compose N can be derived.② Using the Quantum Fourier Transform (QFT) to compute r in polynomial timeIn classical computing, finding r requires enormous iterative computation.However, by leveragingquantum superposition andinterferencethe QFT enables r to be computed in polynomial time.This is where quantum computing fundamentally changes the game.③ Once r is known, the factors are automatically revealedBy computing, andthe GCD with Nthe values of p and q are exposed.This process operates at a speed unimaginable in classical mathematics.3. How Much Faster Is It in Practice?AlgorithmClassical Computing ComplexityQuantum Computing (Shor)RSA FactorizationExponential time (effectively infeasible)Polynomial time (feasible)ECC DLPExponential timePolynomial timeThe conclusion is clear:Once quantum computing reaches a sufficient qubit scale,Both RSA and ECC will be broken.4. “When” It Breaks Is Not the Real Issue — The Attacks Have Already BegunAdversaries are already using the following strategy:✔️ HNDL (Harvest Now, Decrypt Later)Steal today’s encrypted traffic, backups, and stored dataPreserve it for long-term storageDecrypt everything later once quantum computing becomes practicalThis is especially dangerous becausenational securitygovernment archivesfinancial recordshealthcare datacan retain strategic value for 10–20 years.Meaning:Damage is already underway,even before quantum computing is fully realized.5. Conclusion — Every Industry Now Stands at a Quantum Security Turning PointToday’s industrial ecosystem —FinanceTelecommunicationsAutomotiveEnergyAerospace and defenseManufacturing and Infrastructureall operate on top of RSA/ECC-based authentication and signature systems.Quantum computing invalidates that foundational assumption.Therefore,The quantum threat is not merely a technical issue —It is a matter of industrial and national resilience.In the next post, we will explore the world after Shor’s Algorithm:How quantum computing disrupts real-world industrial structures,its impact on authentication and key-management systems, and what this means for security architectures moving forward.CMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK TeletechRead moreTech for QuantumThe Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats"The Era of QAAS (Part 2): Case Studies of Converged Cyber Threats

▲ Image source: Gemini generatedToday, we stand at a precipice of a security landscape that is fundamentally different from anything we have faced in the past. The days when our primary concerns were singular attacks like ransomware or isolated malware incidents are fading.We are witnessing the evolution of a new, hostile ecosystem where four distinct threat vectors are interacting and converging: Quantum, AI, APT, and Supply Chain.At ICTK, we have defined this convergence as the QAAS (Quantum–AI–APT–Supply Chain) threat. It is not merely a list of technologies; it is a structural shift in how attacks are conceived and executed.Here is why these four elements have combined to create the perfect storm, and why the old rules of security no longer apply.1. The Convergence: Why These Four, and Why Now?① The Reality of the Quantum Threat"Harvest Now, Decrypt Later" is no longer theory.The timeline for quantum supremacy is accelerating. With IBM announcing its "Nighthawk" architecture—aiming for 15,000+ Qubits by 2025—the countdown has begun for the breaking of traditional asymmetric encryption standards like RSA-2048 and ECC-521.However, the threat isn't in the future; it is here today. Attackers are actively employing HNDL (Harvest Now, Decrypt Later) strategies. They are exfiltrating encrypted data now, knowing that the quantum capability to decrypt it is just around the corner.② AI-Driven Attacks: The End of Human IntuitionAI is no longer just a tool; it is an active adversary.Artificial Intelligence has weaponized automation. We are seeing DeepFake and DeepVoice technologies replicate human identities in real-time, deceiving authentication protocols and human judgment alike.Beyond social engineering, AI is optimizing intrusion paths and revolutionizing Side-Channel Analysis. Through AI-DPA (Differential Power Analysis), attackers can bypass existing defenses or discover zero-day vulnerabilities faster than any human team could. AI acts as an autonomous agent, adapting its tactics on the fly.③ APT: The Silent, Persistent EnemyThey are already inside.Advanced Persistent Threats (APT) have evolved from "smash and grab" to long-term residency. Once they penetrate a network, they remain dormant for months or even years.Techniques like BPFDoor allow attackers to maintain backdoors that leave virtually no log footprint, making detection nearly impossible. These actors quietly move laterally, targeting the "crown jewels" of your infrastructure: authentication mechanisms, key management systems, and security servers.④ Supply Chain: The Hardware TrojanFrom software vulnerabilities to kinetic threats.Historically, supply chain attacks focused on open-source software vulnerabilities. Today, the battlefield has shifted to hardware: communication equipment, base stations, femtocells, IoT devices, and firmware.Attackers are pre-planting malicious functions into equipment during manufacturing or distribution, which can be activated remotely. We must also confront a chilling reality: Any battery-equipped device lacking robust supply chain security can be weaponized into a kinetic explosive. The integrity of the physical device is now as critical as the software running on it.2. Defining QAASQAAS is not a product. It is a paradigm shift.When we speak of QAAS at ICTK, we are describing the collapse of traditional trust models:Quantum: The inevitable obsolescence of all PKI (RSA, ECC) based security.AI: The hyper-sophistication of attacks via automation, Deepfakes, and DPA.APT: The persistent, invisible seizure of core systems, leveraged by Quantum and AI tools.Supply Chain: The total erosion of trust in hardware integrity.QAAS is not a prediction of future threats. It is the operational reality of the threat landscape we are living in right now.3. Why Legacy Security Architectures Are FailingCurrent security infrastructures were built on four foundational assumptions. In the QAAS era, all four constitute a fatal miscalculation:Legacy Assumption: "Authentication keys are safe in storage."QAAS Reality: In the Quantum age, traditional encryption is brittle, and keys are being harvested daily.Legacy Assumption: "The internal perimeter is relatively safe."QAAS Reality: APTs have likely already compromised the internal network and are waiting.Legacy Assumption: "Software updates can fix vulnerabilities."QAAS Reality: You cannot patch compromised hardware or firmware that was tampered with in the supply chain.Legacy Assumption: "Human judgment is the final defense."QAAS Reality: AI and Deepfakes have rendered human verification unreliable.4. Looking Ahead: Part 2QAAS is not abstract. It is causing massive damage today.We are moving beyond theory. In my next post, I will dissect specific, real-world incidents that illustrate the QAAS framework in action. We will analyze the APT breaches at major domestic telcos (SKT, LGU+), the KT Femtocell supply chain attack in Korea, the Arup Deepfake financial fraud, and the recent kinetic attacks involving communication devices.Next: ? [Part 2] The Era of QAAS: Deconstructing the Anatomy of Complex Threats through Real CasesCMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK TeletechRead moreVIA PUFTM Technology for QAASBeyond Encryption: Why "Trust" Is Becoming the Core of Modern SecurityWhy Initial Authentication Is Never Enough

In Part 1, we introduced the emergence of QAAS (Quantum-AI-APT-Supply Chain)—a sophisticated convergence of threats—and explored why traditional security paradigms are failing to stop them.? Previous Post: The Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats"Theory is best proven through reality. In Part 2, we analyze how QAAS threats operate in the real world to dismantle existing security frameworks, using specific cases: the SKT/LGU+ breaches, the KT Femtocell incident, the Arup deepfake fraud, and the Lebanon pager explosions.1. APT and the Collapse of Authentication: The LGU+ & SKT BreachesThe telecommunications APT breaches are representative cases of the "long-term incubation followed by core authentication theft" pattern. This was not a simple hack; it shook the very foundation of mobile security.Attack Flow: Infiltration via web server vulnerabilities ➡ Lateral movement  ➡  Installation of BPFDoor backdoor.Scale of Damage: 23 Linux servers infected, compromising the HSS (Home Subscriber Server)—the core authentication server.Devastating Consequences : Massive theft of 26,957,749 IMSIs (International Mobile Subscriber Identity), 291,831 IMEIs, and most importantly, Ki (Subscriber Authentication Key) values.Why it matters:The compromise of Ki values means an attacker can clone USIMs, intercept SMS and calls, and bypass 2FA (Two-Factor Authentication) entirely. This is a classic QAAS pattern: blending APT persistence, authentication penetration, and critical key exfiltration.2. Supply Chain Subversion: The KT Femtocell IncidentThe KT Femtocell case clearly demonstrates how vulnerabilities in the hardware and software supply chain lead to direct financial loss and why supply chain threats are so lethal.The Vulnerability: Authentication keys were software-based (making them clonable), and KT’s policy allowed for Cyphering Fallback, exposing SMS to plain-text interception.The Attack: Attackers deployed approximately 20 illegal femtocells ("Rogue Base Stations"), tricking user devices into connecting to them to steal SMS, IMSI, and IMEI data.Devastating Consequences:  Personal data leak of 22,000 users and over $200,000 in financial damages due to unauthorized micro-payments.Why it matters:This incident represents a sophisticated QAAS-style attack where supply chain tampering, authentication weakness, and communication protocol flaws converged to collapse the trust structure of telecom infrastructure.3. AI Attacks Human Trust: The Arup Deepfake Remittance FraudSource: https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo/ Technical vulnerabilities aren't the only issue. The case of the British engineering firm Arup signals an era where AI "hacks" human judgment.Overview: AI-generated deepfakes of company executives attended a video conference. Believing the meeting to be real, an employee transferred approximately $25 million USD.Key Insight: Existing security systems detected absolutely nothing. The essence of the attack was not "technical penetration" of a system, but the destruction of Human Trust.Why it matters:This is a stark example showing that AI is no longer just a tool, but an agent capable of executing complex psychological and social engineering attacks.4. Weaponizing Everyday Devices: The "Internet of Bombs"Source: https://asiatimes.com/2024/09/the-weaponization-of-everything-has-begun/ The 2024 pager and walkie-talkie explosions in Lebanon are a shocking revelation of the extreme endgame for supply chain attacks.Overview: Everyday communication devices exploded via remote commands, resulting in over 40 deaths and 3,000 injuries.The Rise of SDW: This went beyond cyber-attacks; it marked the emergence of SDW (Software-Defined Weapons), where the device itself becomes the bomb through supply chain compromise.Why it matters:The fact that consumer electronics can be weaponized signals a fundamental breakdown in the global trust of the supply chain.Conclusion: QAAS is an Environment, Not Just an IncidentThe common thread among these four cases—network hijacking, femtocell cloning, deepfake fraud, and device explosions—is clear: QAAS is a multi-layered attack structure.Quantum: Neutralizing encryption.AI: Automating attacks and mastering social engineering.APT: Long-term infiltration and system takeover.Supply Chain: Destroying the integrity of hardware and firmware.In an environment where these elements combine, legacy security paradigms are no longer valid. We have reached a point where we need a philosophical shift in security architecture, not just a simple combination of technologies.? Next:  we will take a deep dive into the PAZI (Post-Quantum + AI + Zero Trust + Identity) model—the only viable alternative in the QAAS era.CMO(Chief Marketing Officer), ICTKCTO(Chief Technical Officer), ICTKDirector, Cisco Systems Korea Developer, SK TeletechRead moreThe Era of QAAS (Part 1): Why We Are Facing a "New Age of Threats"VIA PUFTM Technology for QAASBeyond Encryption: Why "Trust" Is Becoming the Core of Modern SecurityWhy Initial Authentication Is Never Enough

This article is the second part of our exploration into where security truly begins and how it must be sustained. While many systems still rely heavily on encryption as the core of their security model, the most dangerous attacks often occur after initial authentication—through identity masquerading and spoofing inside the system. That is why the essence of modern security lies not in a “one-time check,” but in a device’s ability to continuously prove that it is genuine at every moment.In this post, we take a closer look at why the starting point of continuous trust must be a Hardware Root of Trust (HRoT), and why only a PUF-based HRoT can fully meet the requirements for an uncompromisable foundation of device identity.| When Trust Backfires: The Dragon King, the Terrapin… and the Rabbit Who Outsmarted Them AllFollowing our previous analogy with The Wolf and the Seven Little Goats, let’s turn to a well-known Korean folktale this time—The Story of the Rabbit and the Dragon King.In this classic tale, the Dragon King is told that he needs a rabbit’s liver to cure his illness. Believing the rabbit would obediently sacrifice itself, he orders his loyal terrapin to bring the rabbit to the underwater palace. To him, confirming that the rabbit was “genuine” at the moment of entry seemed more than enough.But the clever rabbit manages to earn just enough trust to survive the situation.? “Your Majesty, I left my liver on land. I must return to retrieve it.”The Dragon King and the terrapin continue trusting the rabbit simply because the rabbit initially appeared cooperative and genuine.And what happened next is obvious.Once the rabbit returned to land, it had no intention of ever going back to the Dragon Palace. The Dragon King was deceived because he relied entirely on one-time confirmed trust—and never questioned it again.This is precisely where the critical flaw of today’s IoT security surfaces:the dangerous assumption that once trust is established, it will continue unchallenged.In the previous episode, we emphasized that the root cause of modern breaches is not the limitation of encryption technologies, but device identity spoofing—malicious actors impersonating trusted devices after the initial credential check.?? Read the previous episode: “Beyond Encryption: Why "Trust" Is Becoming the Core of Modern Security "So the key question is this:“If a device is verified as genuine once, is it truly safe afterward?”Just like the lesson from The Story of the Rabbit and the Dragon King,the answer is — No.| The Danger of a “One-Time Authentication” Security ModelMost IoT systems still operate under a familiar pattern:| Initial enrollment/authentication → Trust granted → Long-term use without re-verificationOnce a device is registered as legitimate, it is trusted for an extended period without question.And this “indefinite extension of trust” becomes the perfect opening for attackers.The most vulnerable moment in any security architecture is when an attacker successfully looks like an insider.Attackers rarely try to break in by acting “abnormally.”Instead, their goal is to make every malicious action appear perfectly legitimate.Credential theft allows an attacker to behave exactly like a trusted device.Software hacking lets compromised code operate as if it were genuine.Firmware tampering hides malicious routines behind what looks like normal behavior.Cloned device creation enables counterfeit hardware to enter the system while masquerading as an authentic product.In every case, the intent is the same:to blend in as a normal, trusted device.In other words, attackers aren’t trying to “break down the door.”Instead, they choose the strategy of looking exactly like the homeowner.| Initial authentication is a necessary condition — but never a sufficient one.Encryption hides the content of communication.Initial authentication verifies who the other party is.But here’s the real problem:“There is no guarantee that the identity verified at the initial moment will remain valid afterward.”Once a device slips inside the system, everything operates under the assumption that the device is trustworthy.It’s the same as:a hotel that treats anyone as a valid guest simply because they checked in once,a building where anyone with an old access card can walk right in,a company where possession of an employee badge provides unrestricted access to internal servers.Trust should never be a one-time event.It must be continuously validated.| Why HRoT Is the Foundation of Continuous TrustAn HRoT is not merely a tool for initial authentication.A device equipped with a Hardware Root of Trust can independently perform three critical functions:Guarantee its own unique identity, blocking cloning and spoofing attempts.Verify that it has not been tampered with before booting, encrypting, or authenticating—enabling secure boot and integrity checks.Maintain its identity consistently during operation, making continuous trust possible.In other words, an HRoT is not simply a mechanism that starts security. It is the starting point of all device identity, the foundation of continuous trust, and the anchor on which all other trust decisions depend.The most dangerous attacks are not the ones pounding on the door from the outside.They are the ones that have already made their way inside.A security model based on one-time authentication creates opportunities for attackers.A model built on continuous identity validation, however, leaves no place for attackers to hide behind “false trust.”If encryption protects data, continuous identity proof is what protects the system.It is the essence of security.This leads us to the core question of Zero-Trust Devices:“Is this device — and its software — still genuine right now?”To answer that question at every moment, trust must not originate from the initial authentication event.It must originate from within the device itself.That is the role of the HRoT we have repeatedly emphasized.But this raises an even more fundamental question:“What if the very identity anchor of the HRoT could be forged?”Any stored identity — a stored ID, stored key, or memory-based credential — can eventually be extracted, duplicated, or tampered with.For an HRoT to be truly trustworthy, its identity cannot be stored; it must be generated.And it must be impossible to clone.Only a PUF-based (Physically Unclonable Function) HRoT satisfies all of these conditions.It is the only structure capable of delivering continuous, uncompromisable identity proof all the way through.While other approaches focus on protecting stored secrets,a PUF stores no secrets that can be stolen.It begins from something fundamentally different:not a key that must be hidden,but a unique, unreplicable physical identity — an existence that is the key.In the next episode, we will dive deeper into what a PUF is and why it matters.? Before moving on to the next episode, explore the fundamentals of PUF here. 

This article explains that the primary cause of modern security breaches is not the limitation of encryption technologies, but device identity spoofing. In IoT environments, once a device is authenticated, it is often trusted continuously, allowing cloned, tampered, or counterfeit devices to infiltrate systems with ease. As a solution, the article highlights Hardware Root of Trust (HRoT), emphasizing that a device must be able to independently prove “I am genuine” for a Zero-Trust Device architecture to be achieved.| Cyberattacks Work Like the Wolf in Disguise(Image generated by DeeVid AI)Do you remember the story “The Wolf and the Seven Little Goats”?Before leaving home, the mother goat warns her children:“Keep the door locked, and never let anyone in unless it is truly me.”However, the wolf imitates the mother’s voice (DeepVoice),whitens his black paws (DeepFake),and disguises himself to look like the mother to trick them into opening the door.The young goats hesitate, but eventually fall for the deception.This is remarkably similar to the modern cybersecurity landscape.Today’s attackers rarely break encryption or smash through firewalls. Instead, they pretend to be trusted — spoofing device identity, certificates, firmware, and hardware signatures to enter systems unnoticed.Once a compromised, cloned, or counterfeit device passes as a “legitimate” one inside the network, all other security layers can be silently bypassed.Modern attacks don’t succeed because encryption fails — they succeed because trust is misplaced.| The Real Issue: Isn’t Encryption Strength — It’s Trust in the IdentityMany people still equate “security” with “strong encryption.”But most real-world breaches today do not result from breaking cryptography. They result from attacks that compromise the identity of the device itself.Common examples include:Device ID spoofingFirmware manipulationPrivate key extractionCertificate theftMass production of cloned devicesAttackers have learned that they don’t need to defeat AES, ECC, PQC, RSA, or any cryptographic algorithm.It is far easier — and far more scalable — to make a system trust a counterfeit device as if it were authentic.This weakness becomes especially severe in large-scale IoT deployments, where millions of devices are interconnected and a device is often trusted indefinitely after a single authentication event.Once a fake or tampered device enters the ecosystem, it can remain inside — undetected — for months or even years.The unavoidable truth is this:Even the strongest encryption cannot secure a system if it cannot confidently answer:“Is this device truly authentic?”| Security Doesn’t Begin With Encryption — It Begins With Authenticity A door can have the strongest lock in the world, yet it will still open if the thief successfully pretends to be the homeowner.The real failure is not the lock — it is trust placed in the wrong identity.Digital infrastructure is no different.Before defending data, the system must first verify identity.That is the role of the Root of Trust (RoT) — the foundational anchor that ensures the entire security chain begins from something genuine:Genuine deviceGenuine firmwareGenuine cryptographic operationsIf the starting point is fake, everything built on top becomes meaningless — including encryption.| Hardware Root of Trust (HRoT): The Device’s “Passport”Many IoT devices still rely primarily on software-based security, but software can be copied, modified, or stolen.A secure architecture must therefore include a hardware anchor of identity that cannot be cloned.This is where Hardware Root of Trust (HRoT) becomes indispensable.An HRoT is a dedicated security module embedded in silicon that functions as a device’s fingerprint, passport, and identity token. It provides:A physically unclonable, unique device identifierA private key that never leaves the silicon boundaryAssurance that boot, runtime cryptography, and authentication execute only on genuine hardwareIn practice, an HRoT gives the device the ability to assert:“I am the original hardware — and here is the cryptographic proof.”Without HRoT, even the strongest encryption can be silently undermined by cloned devices, tampered hardware, and unauthorized firmware.With HRoT, trust becomes rooted in hardware, enabling identity-centric security at a global scale.This is why HRoT is now seen not as an optional security feature but as the base requirement for Zero-Trust Device architectures.| The Global Shift: From Encryption-Centric to Trust-Centric SecurityThe security paradigm is moving quickly: EraSecurity FocusPastEncryption-centricPresentDevive identity-centricFutureHRoT-based Zero-Trust Device ArchitectureIn the IoT era, the defining question becomes: ❌ “Is the cipher strong?”✔ “Can the device continuously prove that it is genuine?”We are entering a reality where security leadership will be defined not by who encrypts the most, but by who anchors trust at the hardware level.| The Future of Security = Authenticity, Proven in Hardware Cybersecurity cannot rely solely on technologies that conceal information.A secure system must first be capable of detecting — reliably and repeatedly — whether a device is real or fake.As IoT, AI, and the post-quantum era accelerate, the concept of trust based on HRoT will become the foundation of scalable, long-term security resilience.Organizations that deploy HRoT will naturally evolve toward Zero-Trust Device architectures.Those that continue depending only on software-level security expose themselves to escalating risks from counterfeit, cloned, and tampered devices.The future of security belongs not to those who encrypt the most —but to those who can prove authenticity at the hardware level, continuously and cryptographically.| Key TakeawaysWithout HRoTWith HRoTSystem trusts counterfeit devicesSystem trusts only genuine hardwareEncryption alone can be bypassedSecurity scales from the hardware rootZero-Trust is hard to implementZero-Trust Device happens naturallyHigh risk in IoT deploymentsSecure lifecycle and device integrityLearn how VIA PUF-based Hardware Root of Trust prevents device spoofing, cloning, and unauthorized access at the silicon level.? VIA PUF-based HRoT