Please enable JavaScript.

Coggle requires JavaScript to display documents.

Blockchain: Cybersecurity Blockchain_Presentation-2 - Coggle Diagram

- - - - "We use XY, you can benefit from it by YX"
  - - - Theoretical construct: What happens if governments issue their own cryptocurrencies?
      - Sovereignty of interpretation
      - How to orientate if none can issue cachets?
      - Oligarchy? Plutocracy? Epistocracy?
      - See also: Ethics (own branch)
    - - Ability to delete // change private data is lagelly required
      - Blockchain records are permanent
      - Solution: Indexing & external data bases: Personal data encrypted and stored in a separate database
      - See also Ownership & Data Quality
  - - - "Negative specific heat"
      - "Thermodynamic disequilibrium"
- - - - Distributed auditability :check:
        
        Policies and the rights exchanges are publicly visible
        
        Any user can know ( :warning: see knowledge gap) at any time the policy paired with a resource and the subjects who currently have the rights (to :warning:) access the resource
        
        Preventing a party from fraudulently denying the rights granted by an enforceable policy
        
        Recorded :check:
        
        Tracking actions & activities :question:
        
        Cross-Enterprise? eXtensible Access Control Markup Language
        (XACML)
    - - = Verifying or rejecting identity
      - Zero-Knowledge Proof
        
        Cryptography
        
        No disclosure of actual information supporting the proof :checkered_flag: :check:
        
        Validity and privacy
        
        See also: "Yao's Millionaires' problem" (Liu et al., 2017)
    - - Blockchain :star:
      - Verifiable Credentials
      - Decentralized Identifiers
    - - Permissionless
        
        No permission needed from anyone to become a node on the network :red_cross:
      - Permissioned :star:
        
        Authorization from one or several parties needed :check:
        
        Integrity of information preserved :check:
  - - - Computing Power
        
        :warning: Quantum Computing (Fernández-Caramés, & Fraga-Lamas, 2020),
        
        Current status: no threat (yet)
        
        20 qubit computer can reach 2^20 computations (similar to the laptops currently available; traditional cloud compute services can do 2^40 compute service ~ 2x IBM’s commercial quantum computer)
        
        "If a computer solves trillion keys a second, it will still take it to do 785 million computations to get to the solution. In time, it results in 14 billion years."
        
        2^80 computations: posing a considerable threat
        
        eXtended Merkle Signature Scheme (XMSS) [resistant to quantum computing]
        
        Neither use p2pk addresses nor reuse p2pkh addresses :warning:
        
        2^3000 computing power: devastating effect
        
        Capable of running Shor’s and/or Grover's algorithm: breaking the most popular ECDSA 256 encryption used by bitcoin :warning: :explode: (Gao et al., 2018)
        
        But also: potential to improve security and privacy (Zeuner et al., 2021) :recycle:
        
        Compatibility with blockchain :question:
        
        Perhaps "series circuit" possible?
      - Storage (Xu & Huang, 2019)
        
        Tamper-Resistant: Time-stamped network of secure logs of data
        
        No third party needed (for data storage)
        
        Less depended on infrastructure: Millions of servers and computer systems all over the world
        
        Immutable & verifiable
      - Alternatives or improvements?
        
        Lightning Network (Li et al., 2018)
        
        = "Layer 2" payment protocol operating on top of a blockchain-based cryptocurrency
        
        Granularity
        
        Privacy
        
        Speed
        
        Transcation throughput
        
        Sharding
        
        = Divide the data store into horizontal partitions (shards). Each shard has the same schema, but holds its own distinct subset of the data. "A shard is a data store in its own right (it can contain the data for many entities of different types), running on a server acting as a storage node." (Microsoft, 2021)
        
        IOTA's Tangle
        
        Directed Acyclic Graphen (DAGs)
        
        Plasma, Cosmos, Raiden Network, PolkaDot
      - Speed
        
        Indestructibility = unflexible?
        
        Transaction Speed (Fu et al., 2020)
        
        Bitcoin: 7tx/s
        
        Ethereum: 15tx/s
        
        Block Time: Depends on network
        
        Bitcoin: Every 10 minutes
        
        Ethereum: 15 seconds
        
        Trade-off Speed vs. Security? DoS attacks? :question:
    - - Providing and correcting any errors :red_cross:
      - Appropriate rights (Access Control // Management)
      - Especially important with smart contracts: piece of code, automatically acting upon the terms of a contract
      - Not full-proof :red_cross:
      - No double-spending :check:
      - No infinite digital copying :check:
      - Transparency :check:
        
        Anyone can review public ledger
      - According to Deloitte, more than 84% of businesses expect blockchain to offer better security when it comes to conventional IT systems
    - - Verification of ownership
      - Authentication of ownership
      - Index numbers whoe are tied to individual databases :warning:
      - Data is equally owned where it's distributed
      - For personal data: regulations require one owner who's responsible for data privacy :forbidden:
  - - - Encryption threatened through Quantum Computing (see Scalability > Quantum Computing) :warning:
      - "End-to-end security and encryption" :check:
        
        "Strengthen collaboration" (Rejeb et al., 2021)
        
        See also "Highly available"
      - It can always be hacked. :warning:
      - "Secure" :!?:
      - Neither use p2pk addresses nor reuse p2pkh addresses :warning:
    - - "Decentralized"
      - "Open Source"
      - "Highly available"
        
        Consistently and readily accessible for authorized parties
        
        Unavailable to those who do not understand the technology and/or do not have access to required infrastructure :warning:
      - Hardware & technical infrastructure :question:
      - "Public"
    - - "Incorruptible"
        
        Provision of network security is done by the miners?! :warning:
        
        "Improving accountability" (Rejeb et al., 2021)
      - "Transparent"
        
        "Enhancing information transparency" (Rejeb et al., 2021)
      - Consistency :check: (Xu et al., 2020)
      - Accuracy :question:
        
        "Facilitating auditability" (Rejeb et al., 2021)
      - Trustworthiness :!?:
    - - Identification
      - Authentication
      - Authorization
      - Identity
        
        Requires: Issuing and verification of birth certificates, national id cards, passports or driver’s licenses
        
        Paper-based (out-dated)
        
        Loss
        
        Theft
        
        Fraud
        
        Digital
        
        Bureaucracy -
        
        Speed +
        
        Interoperability +
        
        Hacking -
        
        IAM with Blockchain
        
        I. Owners
        
        Storing credentials in personal wallet, can be used later
        
        Expiring date of validation of credentials?
        
        I. Issuers
        
        Trusted party issues personal credentials for an identity owner (the user)
        
        Information are still stored somewhere :warning:
        
        Information are still disclosed to someone :warning:
        
        Usefulness and reliability of credentials fully depends on the reputation/trustworthiness of Issuer assessed by Verifier :warning:
        
        Option for revoking a claim :check:
        
        I. Verifiers
        
        Third party who wants statements proved
        
        Validation of a proof is based on the verifier’s judgement of the reliability of the attestor :no_entry:
        
        Credentials are still crucial :no_entry:
        
        Dependency from Identity Issuer and Verifier :no_entry:
        
        Trust is still needed :no_entry:
        
        Transparency Issues!
        
        "New form" of centralisation
        
        Reliability of attestor: How is this assessed?
        
        Pseudonymisation
        
        "Preventing identity theft" :recycle:
        
        Portable & verifiable :check:
        
        "Private & secure" :!?:
        
        Dynamic (attributes can change over time) vs. static blocks
  - - - Very sensitive data
      - Electronic medical records and social security numbers
      - Highly vulnerable
      - Credentials
        
        Schemas = Formal description for the structure of a credential
        
        = Set of multiple identity attributes and an identity attribute is a piece of information about an identity
    - - Blockchain itself is immutable, therefore indexing & external database
        
        Security & Privacy Risk :warning:
  - - - Cyber // Hacking Attacks
        
        51% Attack
        
        PoW-based
        
        Reverse transactions: Double-spending
        
        2016: Ethereum (Krypton & Shift) // 2018: Bitcoin Gold ($18 million)
        
        Interrupting recording of new bocks & halting payments
        
        = Attack on a blockchain by a group of miners who control more than 50% of the network's mining hash rate
        
        Routing Attack
        
        DDoS Attack
        
        Sybil Attack
        
        Forks
        
        Soft Fork
        
        Old transactions still valid
        
        Hard Fork
        
        Prime example: ETH / ETC
        
        Old transactions are not valid anymore
        
        = When there exists two or more versions of an existing protocol of piece of software (sharing the same history)
      - Vendors // 3rd-Party
        
        Weak security controls on their own systems
        
        Flawed code
        
        Personnel vulnerabilities
        
        See "Factor Human"
      - Software Bugs
        
        Glitches
        
        Hazards & Spikes
        
        Inferior code quality :forbidden:
        
        Especially dangerous regarding the decentralisation and irreversibility of the technology
        
        Not mature or untested
      - Endpoint Vulnerabilities
        
        Credentials required to access the shared distributed ledger
        
        Like regular passwords and login details - exposure would be dangerous!
        
        Stored savely?
        
        No social engineering, hacking etc.
        
        Used wisely?
        
        Not exposed by software when used to sign a transaction
        
        Security mechanisms in case of leaking
        
        Receive information in a timely manner
        
        Error culture?
        
        Willingness to admit an error?
        
        See "Factor Human" & "Conceptions of Men"
        
        Alternative? SSL certificates located on each device
        
        More hacker-proof
        
        = Space where humans and blockchain converge
        
        Human error
        
        See "Factor Human"
        
        "Endpoints are computer systems that are used by individuals or businesses to access blockchain-based services"
        
        See Data Quality
      - Vulnerabilities of infrastructure
        
        Digital (and physical in parts)
        
        Commuting time (and pollution)
        
        Risks of failures during high stress situations
        
        Climate induced changes
      - Computing Power (see Quantum Computing) :warning:
      - Complexity of Use Cases for Blockchain :explode:
        
        Different "ecosystems"
        
        Cloud
        
        Mobile
        
        Decentralized
        
        Different (block) characteristics [extract only] (Rejeb et al., 2021)
        
        Storage
        
        Token Storage
        
        Databases
        
        File Systems / Blobs
        
        Computing
        
        Stateless (combinational) business logic
        
        Stateful (sequential) business logic
        
        High-Performance Compute (HPC)
        
        Communications
        
        Networks of Data
        
        Networks of Value
        
        Networks of State
    - - Strong security features
        
        Always up-to-date anti-malware // antivirus software
        
        Strong firewall setting (carefully selected white list and very limitied access for employees) (Hasanova et al., 2019)
        
        VPN
        
        Full encryption of data
        
        See "Access Control"
        
        Must be built into the solutions
        
        Reasonable & appropriate
        
        Proofs of consent for data sharing or reception of data
        
        ID verification
        
        Rank-Weight Methods (e.g. CyFEr) (Gourisetti, Mylrea & Patangia, 2019)
        
        Introducing Quantum Computing
        
        BB84 protocol (Mavroeidis et al., 2018)
        
        Lattice-based cryptography (Mavroeidis et al., 2018)
        
        Blind quantum computing protocol (Zeuner et al., 2021)
        
        Requires communications between client and server :red_cross:
        
        Homomorphic encryption Zeuner et al., 2021)
      - Only carefully selectes vendors (if at all) (Shi et al., 2021)
        
        Autonomy is always to be preferred :checkered_flag:
      - The more people (nodes) on the network, the more difficult to subvert veracity :check:
        
        Sybil Attacks :!?:
      - Pseudonymization
        
        DID Descriptor Objects (DDOs)
        
        Public Decentralised Identifiers (Public DIDs)
        
        Entirely controlled by identity owner
        
        Individual to own and control their identity without depending on other parties :check:
        
        Security? It is only revealed what has been disclosed beforehand :forbidden:
        
        Non-reassignable
        
        Privacy & Security?! :forbidden:
        
        Permanent
        
        Privacy & Security?! :forbidden:
        
        Cryptographically verifiable
        
        Quantum Computing?! :forbidden:
        
        Schemas = Formal description for the structure of a credential
        
        Non-correlation principles
        
        Proofs of identity or qualification stored on ledger
      - Strong consenus algorithms
        
        Proof of Work (PoW)
        
        Requires a vast amount of computing resources (consuming significant amount of electricity) :forbidden:
        
        Network-bound (time)
        
        Memory-bound (time and memory)
        
        Delegated Proof of Stake (DPoS)
        
        Still: Attacks are not impossible! :warning:
        
        Proof of Stake (PoS)
        
        Reduced incentives: Attacker would need to own a majority of all bitcoin
        
        Help in making an attack very unpracticable
        
        Practical Byzantiine Fault Tolerance (PBFT)
      - Right to be forgotten (GDPR)
        
        Sensitive data must not be part of the hash (indexing for secure [external] database) :warning: :lock:
        
        Database Security Risks :warning:
      - BUT: Higher security standard ≠ higher security level per se :explode: (Yang et al. 2016)
        
        No concrecte countermeasures and/or combinations (Xu et al. 2010)
        
        Misleading
        
        Inneficency
        
        Abstract standards (Siponen & Willison, 2009)
        
        Very generic scope (Siponen & Willison, 2009)
        
        Fallback to ad-hoc implementations
        
        No prestigue topic // only visible if issues arise
        
        Too much Complexity :explode:
        
        Regional differences in the use and context of frameworks (Diesch, Pfaff & Krcmar, 2021)
        
        No easy to understand toolkit (Mijnhardt, Baars & Spruit, 2016)
        
        Not practical (e.g. ISO 27000-series: 450+ items; 9 focus areas; ISA/IEC 62443)
        
        Generic scope
        
        Lack of Complexity :explode:
        
        No additional layer of control implemented :warning:(Tu & Yuan, 2014)
        
        Trade-off security vs. velocity
        
        Lack of long-term perspectives
        
        No coherent security concept (relationships between the concepts are hardly ever considered) (Fu et al., 2021) :warning:
        
        Daily work // needs are not considered sufficently :warning: (Hedström et al., 2011)
        
        Security as "Corporate Goal" but without practical implications (levels too high)
        
        Integrated Cybersecurity Concept, Blockchain should not merely be an "add-on" :warning:
        
        Inadequate empirical studies (Diesch, Pfaff & Krcmar, 2021
        
        Need to validate the theoretical inferences with other approaches (such as expert interviews and empirical tests) :warning: (Rejeb et al, 2021)
- - - - Dunning-Kruger effect (Dunning, 2011)
        
        The incompetent feels competent
        
        “(it) is a cognitive bias in which low-ability individuals suffer from illusory superiority, mistakenly assessing their ability as much higher than it really is.”
      - Imposter Syndrome (Kolligian & Sternberg, 1991)
        
        “[...] feeling of inadequacy or self-doubt, despite there being no evidence to support such a belief.”
        
        The competent feels incompetent
      - Varying modes of performance: Explainability vs. Interpretability / Understandability :explode:
    - - "Islands of digital exclusion" (Abascal et al., 2016)
      - Lack of digital accessibility (Dobransky & Hargittai, 2006)
      - Economic restrictions
      - Linguistic restrictions
    - - Who has invented it?
      - Where does it come from?
      - What are his or her intentions?
      - Who is "Satoshi Nakamoto"? (Pseudonym!) (Ballis & Drakos, 2021)
      - Dependency on miners
  - - - Zoon politikon
      - Homo rationale
      - Homo faber
      - Homo oeconomicus
      - Homo ludens
      - Zoon logon echon
      - Homo sociologicus
      - Animal laborans (Arendt, 1958)
- - - - Finance
      - Computer Science
      - Economics
      - Politics
    - - Many different use-cases
        
        Retail
        
        Inernational Trading
        
        Sports
        
        Insurance
        
        Automobiles
        
        Healthcare
        
        Pharmaceutical Trading
        
        Medical Recordkeeping
        
        Energy
        
        Food Safety
        
        Certificate Verification
        
        Claims Process
        
        Asset Management
        
        Digital Voting
        
        Government Services
        
        Real Estate
        
        Charity
        
        Copyright Protection
        
        Digital Identity
        
        Banking & Finance
        
        Supply Chain
        
        Monitoring
  - - - 100%: Permissionless, Public, Shared Systems
      - Less than 80%: Permissioned, Public, Shared Systems
      - Less than 50%: Permissioned, Private, Shared Systems
    - - Consensus algorithms
      - Consensus of the majority (51% agreement)
    - - Rapid verification of data