Training Course Professional

Quantum Threats to Cloud Data at Rest: Encryption Architecture and Migration

Assessing AES-256 sufficiency, storage encryption risk, and migration priorities for cloud-hosted data.

Full day (6 hours)
Certificate on completion
Enquire About This Course View Curriculum

Proud to recommend our expert members

Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence
Qrypto Cyber
Eclypses
Arqit
QuantBond
Krown
Applied Quantum
Quantum Bitcoin
Venari Security
QuStream
BHO Legal
Census
QSP
IONQ - ID Quantique
Patero
Entopya
Belden
Atlant3D
Zenith Studio
Qudef
Aries Partners
GQI
Upperside Conferences
Austrade
Arrise Innovations
CyberRST
Triarii Research
QSysteme
WizzWang
DeepTech DAO
Xyberteq
Viavi
Entrust
Qsentinel
Nokia
Gopher Security
Quside
QIZ
Global Quantum Intelligence

Course Overview

For cloud security architects and data protection officers. Covers quantum exposure of cloud-stored data across object storage (S3, Azure Blob, GCS), database TDE, and long-retention backup encryption. Addresses harvest-now-decrypt-later risk scoring using the Mosca inequality, data classification frameworks, key hierarchy migration from RSA/ECDH to ML-KEM, and re-encryption strategies at petabyte scale.

Curriculum

Course content is structured into sessions below. Each session is configurable to your organisation's environment, threat model, and objectives.

# Session Topics
1 The HNDL Threat to Cloud Data at Rest Why encrypted stored data is the primary harvest-now-decrypt-later target
2 Object Storage and Database Encryption Exposure Assessing quantum risk across cloud storage layers
  • Object storage encryption: S3 SSE-S3, SSE-KMS, SSE-C, Azure Blob encryption, and GCS CMEK. Which modes use AES-256 key wrapping with RSA or ECDH key agreement vulnerable to quantum attack.
  • Database encryption: TDE (Transparent Data Encryption) in RDS, Cloud SQL, and Azure SQL. Key hierarchy exposure where data-encrypting keys are wrapped by master keys using classical asymmetric algorithms.
  • Backup and archival encryption: long-retention data (7-25 year regulatory holds) with the highest HNDL exposure. Tape encryption, cold storage, and disaster recovery replicas.
Break
3 Data Classification and Retention Risk Scoring Prioritising migration based on data sensitivity and retention period
  • Mosca inequality applied to stored data: if data retention period + migration time exceeds the timeline to cryptographically relevant quantum computers, the data is at risk today
  • Data classification framework: mapping sensitivity levels (public, internal, confidential, restricted) against retention periods to produce a quantum risk score per data class
  • Cloud provider default encryption versus customer-managed keys: understanding which encryption layers you control and which are the cloud provider's responsibility
4 Hands-On Exercise: Encryption Architecture Audit Mapping your cloud encryption dependencies
  • Cryptographic inventory for stored data: cataloguing encryption modes, key types, and key management dependencies across object storage, databases, and backups
  • Key hierarchy analysis: identifying which key wrapping and key agreement operations use classical asymmetric cryptography vulnerable to quantum attack
  • Risk prioritisation matrix: combining data classification scores with key hierarchy exposure to sequence migration
Break
5 Migration Architecture and Re-encryption Strategies Practical approaches to transitioning stored data to PQC-protected encryption
  • Key hierarchy migration: replacing RSA and ECDH key agreement in key wrapping with ML-KEM hybrid mode. Root key rotation versus full re-encryption trade-offs.
  • Re-encryption at scale: strategies for re-encrypting petabytes of object storage data without service disruption. Background re-encryption, versioned objects, and migration checkpointing.
  • Cloud provider PQC roadmap: current and announced PQC support for AWS KMS, Azure Key Vault, and GCP Cloud KMS key wrapping operations for data at rest.
6 Compliance and Migration Planning Regulatory requirements for data at rest encryption upgrades
  • NIST FIPS 203 (ML-KEM) for key encapsulation in key wrapping operations. CNSA 2.0 deadlines for data at rest encryption.
  • Sector-specific retention rules: GDPR data minimisation versus financial services 7-year retention versus healthcare 25-year records. Each creates different HNDL exposure windows.
  • Migration roadmap: sequencing by data classification risk score. Highest-sensitivity longest-retention data first. Rollback procedures for each storage layer.
7 Q&A and Migration Planning

Designed and Delivered By

Training courses are designed and delivered by QSECDEF in collaboration with subject specialists. All instructors have direct experience in quantum technologies and security.

QD

Quantum Security Defence

Course design and delivery

QSECDEF brings expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our membership spans 900+ organisations and 1,500+ professionals working at the intersection of quantum technologies and critical infrastructure security.

Enquire About This Course

Get in touch to discuss scheduling, group pricing, and how this course can be configured to your organisation's needs.

Contact Us
Training Courses Consulting Services Training