Defending Against HNDL Attacks Today

In the ever-evolving landscape of cybersecurity, HNDL (Harvest Now, Decrypt Later) is emerging as a silent but serious threat. It doesn’t require an attacker to break encryption today—it just bets that they will be able to do so tomorrow.

What is HNDL?

HNDL is a long-term data breach strategy in which adversaries intercept and store encrypted data today, with the intention of decrypting it in the future when computing power—particularly quantum computing—makes breaking current cryptography feasible. The value of the data doesn’t need to be immediate. Sensitive medical records, confidential business contracts, defense communications, or citizen data can all retain strategic value years down the road.

Why Should You Be Concerned?

• Quantum computing is not science fiction anymore. Progress is accelerating, and while practical quantum decryption may still be years away, threat actors (including state-sponsored groups) are already preparing by harvesting data now.
• Most encryption used today (like RSA and ECC) will eventually be vulnerable to quantum attacks unless updated with post-quantum cryptography (PQC).
• You may never know it’s happening. Unlike ransomware or denial-of-service attacks, HNDL leaves no immediate trace.

What Should Organizations Do?

You don’t need a crystal ball to defend against future risks—you need a roadmap. Here’s how to act now:

1.        Inventory and Classify Your Cryptographic Assets

• Start with a crypto-agility assessment: Identify all instances of cryptographic use across your infrastructure, including TLS, VPNs, internal apps, backups, and cloud integrations.
• Categorize the data sensitivity and longevity of confidentiality required. Anything that needs to stay confidential for more than 3-5 years is potentially at risk from HNDL.

2.        Prioritize Long-Lived, High-Sensitivity Traffic

• VPN tunnels, database backups, and software distribution systems are prime targets for HNDL.
• Traffic between core systems and long-term logs are especially vulnerable.

3.        Adopt Post-Quantum Cryptography Where It Matters Most

• Begin testing or deploying hybrid cryptographic protocols (e.g., classical + PQC) that meet both current and future security needs.
• Look for standards-compliant solutions like those aligned with NIST’s FIPS 203/204/205 (for ML-KEM, ML-DSA, and SLH-DSA).

4.        Demand PQC Roadmaps from Your Vendors

• Ask your security vendors and infrastructure providers what they are doing to support PQC and mitigate HNDL.
• Seek interoperability tests and pilot deployments—don’t wait for full productization.

5.        Protect the Channel, Not Just the Endpoint

• Even if your endpoints are secure, traffic in transit is vulnerable to interception.
• Secure communication channels (IPsec, TLS, MACsec) should evolve to support PQC as a top priority.

Final Thought

HNDL isn’t just a future problem—it’s a present risk disguised by time. Organizations that wait until quantum computers are fully operational will already have lost the battle for their past data. The time to act is now.

If you are headed for the #RSAC, you can learn more from the Cisco session on Architecting the Future of Security by Cisco Thought Leader Tim Rowley on Tuesday, April 29th 2025 at 10:30 am at the Cisco Security Booth #N5845. We’d love to connect and exchange ideas as we prepare for the new frontiers in security.

Share: