Re-imagining Cybersecurity through a Blockchain Lens

Re-imagining Cybersecurity Through a Blockchain LensRe-imagining Cybersecurity through a Blockchain LensContents

Thank you for reading Re-imagining Cybersecurity through a Blockchain Lens - Sudip Pramanik Senior Specialist - Cybersecurity, Digital Transformation Practices

Timothy is a digital native. His world is centered around his smartphone – a one stop destination for all activities from scheduling his morning alarm, to paying his bills, to social networking, to binge watching the latest web series on his favorite streaming platform.

Imagine his anguish when on waking up rather late one morning (the alarm did not go off), Timothy finds a strange message flashing on his phone screen. He learns that his connected digital world has been hijacked by cybercriminals, who are demanding a hefty ransom for restoring access.

Timothy is in for a bad day ahead.

Enter Cybersecurity: The Shining Knight in Armor

While Timothy’s experience may sound like a fictional narrative, it is also relatable in light of the growing activities of cybercriminals. These new age miscreants are on the prowl, looking to destabilize our interactions with the digital world and aiming to make ill-gotten profits from their exploits. The severity of their actions is magnified when they succeed in reaching into organization networks, jeopardizing businesses, and causing significant financial losses in the process.

Cybersecurity offers a way to stop these malefactors in their tracks

The idea of cybersecurity has received growing attention in recent years due to a rise in the number and extent of breaches and attacks. These incidents have been reported from almost all segments of the economy – from factory floors to energy distribution centers, and from connected automotive vehicles to home Wi-Fi networks.

An analysis of the nature and target of these incidents allows us to categorize cybercrime as affecting three major segments, viz. Property, Individual, and Enterprises. This would consist of:

Property: Unauthorized use of intellectual property like songs, stories, image, logos, colors, etc.

Individual: Spamming, malware, spoofing, and phishing attacks

Enterprise: Trojan Horse, Distributed Denial of Service (DDoS), server hacks, and salami attacks

At a high level, cybersecurity protocols can therefore be applied to protect the victims through ensuring:

Network and infrastructure security

Internet security

OS level security

Data security

Endpoint security

Cyber experts have developed practices and standards across sectors to mitigate potential risks. While these measures can restrict the bad-faith actors to an extent, the new generation of ransomware and other cyber threats continue to pose significant challenges for organizations in their digital transformation efforts.

It is therefore time for businesses to refresh their cybersecurity perspective and look for new ways to protect their critical assets not just from current threats, but also tomorrow’s challenges.

Blockchain: The Shield and the Spear

Blockchain technology was initially intended to enable the secure transaction between Bitcoin and other cryptocurrencies. However, in recent times, it has been gaining the attention of banks, governments, and businesses for its potential in curbing cybercrimes, and has emerged as the shield and spear in the battle against cybercriminals.

The data stored in a blockchain undergoes sequential hashing to generate a unique fingerprint. Essentially, any data transfer taking place within a blockchain causes the creation of another block, which gets added to the chain to ensure data integrity. Blockchain data, therefore, is immutable – any attempt to access or alter it is indelibly recorded, empowering enterprises to protect their data from the risk of unauthorized access.

Enterprises are building consortiums disclosing the data only between closed parties but in a very transparent manner. This is achieved by the shared ledger technique which is the backbone of the Blockchain system. On the other hand, retail users can take the benefit of Self-Sovereign Identity(SSI) where the owner of the data is in complete control of his/her data. Zero-knowledge-proof(ZKP) is another interesting area where data owners can prove the identity without disclosing the real data.

Leveraging the Shield: Blockchain Implementation

Blockchain can be implemented in several ways, such as public, private, and permissioned blockchain. The accessibility or block creation capacity of the nodes in a network determines the nature of the blockchain platform. Public blockchain allows any node to join the network, take part in the consensus and block creation process at will. Bitcoin, Ethereum, Dash, and Litecoin are examples of public blockchain.

In contrast, private blockchain restricts the read and write permissions and participation in the network without prior verification. Ripple, and Multichain are some examples of permissioned blockchain. Consortium or semi-permissioned platforms allow the features of both public and private blockchain blockchains such as Hyperledger Fabric and Corda.

Compared with the permission-less blockchain, the permissioned blockchain maintains private ledgers among the trusted participating nodes to provide more confidential service, less energy consumption, and has higher system throughput.

Other Areas for Blockchain-Cybersecurity Implementation

Some other instances where blockchain provides an additional layer of security, include:

An access management system is classified in many formats, including, DAC, RBAC, ABAC. Attribute-based Access Control (ABAC) can be re-imagined for the future with Blockchain, where a decision of user accessing transaction is dependent on identity. It supports both chain code and Hyperledger fabric. Chaincode, (aka Smart contract), is a small piece of code integrated with BC nodes to make the system more dynamic. In addition, a blockchain-based solution also encrypts the data stored and transferred within the network and can be used to implement stronger and more secure identity and access management.

PKI model is widely accepted as a very good system for Security implementation. However, it runs on few known challenges. A Central Authority to manage everything, from DNS requests to X.509 certificates and many more. Hence, A good case for a single point of failure. Blockchain with its decentralized network from a DPKI solution. A smart contract can be configured to invoke specific PKI operations, entities can have multiple attributes to authentication ownership using public key/Ethereum address.

The CIA security triad principle enforces 2FA mechanism, but cases have been reported where hackers were able to bypass both the levels. The reason is mostly 1st level and 2nd level both are managed centrally. An Ethereum based OTP generations systems can be implemented which does not directly interact with the user app (Dapp) but is highly controlled by a smart contract.

Talking about Network security, DNS security is an important subject. Currently, there are keys to minimizing the threat vectors for DNS spoofing, However, DNS chain has come up as a famous project to transform the DNS framework and protect it from spoofing challenges. It replaces X.509 certificates with MITM-proof public key-based infra. This promotes no centralization of the system root server but an Ethereum based DNS platform to connect client and name server without any involvement of a third party in between. There are blockchain-based DDoS protection platforms that are also available which deploy decentralized ledger to blacklisted IPs are simultaneously eliminate the risk of a single point of failure for the centralized web application layer.

Blockchain in Overall IT Security

While Blockchain is neither unbreakable, nor is it a solution for every security question, it has evolved to become one of the most foolproof forms of transacting in the digital space. Here are few use cases of future beneficial use of blockchain to strengthen cybersecurity.

Securing Private Messaging

IoT Security (OT-Cloud-IT)

Decentralized Medium Storage

Securing DNS and DDoS

Verification of Cyber-physical infrastructure

Protecting data transmission

A blockchain-enabled cybersecurity solution offers enterprises a way to protect both their legacy and current IT systems. It enables better tracking of information and a secure decentralization of data storage than all other known technologies. Blockchain can be used in distributed storage software. Most common three step processes are:

1. Break up data into chunks.

2. Encrypt the data so that you are the only one with access to it.

3. Distribute files across a network in a way that means all your files are available, even if part of the network is down.

Blockchain hosted across multiple data centers as like cloud can give you the distribution of data with a sense of isolation and business continuity.

Additionally, the data get saved as cryptographic signature of a document or file on a Blockchain. This would give users a way to ensure a file is untampered, without needing to save the entire file on the Blockchain. When you look at a file, you can guarantee that it is the same version of the document that existed at another time.

Blockchain can therefore be considered as an efficient alternative to protect critical, and sensitive intermediates, and is capable of encrypting, tracking, certification of source (non-repudiation) of any information collected and stored.

As a use case, let us look at a Non-Disclosure Agreement (NDA), a standard legal agreement to prevent the disclosure of confidential data to a third party. It takes time due to manual interventions, and there are other difficulties in managing the document for life. viz.

Disconnection between clauses written in the agreement and how it is getting applied in the field.
Tracking those documents for auditing is difficult.

A blockchain can be particularly effective here, by enabling:

Rapid digitization of contract process and documents
A shared ledger to give all the parties a single source of truth view
A shared channel between all contracting parties to securely view, amend, and give consensus on the clauses
Monitoring any change or forgery attempt by a Digital Signature mechanism

This helps optimize the signing of online contracts and prevents potential fraud in the registration of the documents. The decentralized nature of the distributed ledger technology therefore empowers enterprises by helping them overcome a single point of failure from where an infection can enter the network and lock down critical infrastructure.

The Road Ahead

Cybersecurity is a dynamic field of study. While there is no end to possible scenarios in this domain, hackers will keep on inventing new ways of breaking a system, underscoring a constant need to focus on the emerging trends. While Artificial Intelligence (AI) has been providing valuable insights to the security personal by predicting risk scenarios, it is still on its way to maturity, and has not yet reached its target potential.

Blockchain therefore provides a new way to change the world of cybersecurity in terms of providing better security and privacy. The combination of a different concepts like cryptography, distributed processing, smart algorithms, hashing, blocks, consensus, and a robust backed cloud infrastructure would be critical in this direction. While the technology has attracted the malicious attention of cybercriminals, and there have been some reports of attempted breeches, further reach is sure to prove decisive in strengthening and expanding the capabilities of blockchain in delivering a secure cyber environment.

After all, what happened to Timothy, can also happen to you.

The LTTS Advantage

LTTS has a holistic vision towards the next level of cybersecurity with blockchain as an integral part of the security infrastructure. As a major global ER&D company with robust capabilities in the cybersecurity space, the Company has several long-standing partnerships with global OEMs across verticals and is acutely aware of the developments in the domain.

With a deep knowledge of cryptography, the LTTS team has helped successfully drive several implementations of secure process and device integration initiatives in the manufacturing, O&G, and the transportation sector. It is attuned to the unique challenges facing its customers and is constantly upgrading skillsets and offerings for unlocking business value across verticals and industries.