Ledgers of transactions have existed for millennia, mostly validated by some centralized authority to vouch for their accuracy. Although centralized authorities have done an excellent job; there are times when it might not be in your best interest to trust any centralized authority to validate the authenticity or accuracy of information or to prove transactional validity. In cases where this is true, Digital Ledger Technology (DLT) can come to the rescue. For a DLT to work, lots of participants must agree to participate in proving that the information or transactions are accurate. Each of these participants are given a copy of the data and then they all execute specialized computer programs, each proving that the integrity and availability of the information is factually accurate. When enough participants agree that the accuracy is there, the transaction is confirmed, thus affirming TRUTH without relying on a single third party.
If you are an enterprise level officer reading this article, you are likely to be called upon to increase the trust level or PROVE to your customers, clients, patients, or constituents that you can still be trusted. In 2019, building solutions based on an enterprise DLT are likely to be part of your technology solution to this business ask.
I’m hoping terms like Bitcoin, Ethereum, and Blockchain aren’t crossing your eyes for the first time. These, the technology that backs them, and conversations surrounding them have been the talk of major news publications and the internet-at-large for a year or more now, driven primarily by the price fluctuations of the crypto-currency value. What you may not have realized, is that the technology foundation underneath cryptocurrencies is DLT.
As you probably saw on the news or experienced first-hand, the value of the cryptocurrencies plummeted in the last half of 2018 and many startups in the ecosystem have declared the equivalent of bankruptcy. To some, this is a sign that the world is just not ready AT ALL for digital currency or shows that it was not ready for new types of funding models, as seen with the ICO craze. To others, like me, this is a time to review the ecosystem of products that were (or were not) developed for these cryptocurrencies, see which technologies stuck, and then see which solutions are bordering on becoming enterprise ready so that we can realize the benefits.
As I look into what is coming in 2019, I see that we are ready as an industry to drop the word “blockchain” for enterprise-level conversations and instead focus on DLT.
Although most enterprises do not need a monetary cryptocurrency, some may want a utility token in which to exchange value between corporate entities, or reward employees for good deeds (PayPal Employee Reward Token), but often enterprises just want to prove the truth instead of exchanging value. Enterprises likely will focus on building trust with this technology because there is a large trust gap in the world today.
The area of focus I see in 2019 is Trust Delivery.
Trust is delivered with DLT because you can ensure the data has not been modified. In many cases, you can ensure that the integrity is present, that privacy is preserved, and that the centralized entity has not taken steps to leak the data, access the data, or modify the data to suit their own needs. I believe people in the world want to see transparent proof that enterprises are moving to the next level to protect them. In fact, consumers are likely to move toward a model where they start with distrust and enterprises must build that trust back up. There have been far too many data breaches for consumers to believe otherwise.
In 2019, a number of uses cases will likely be focused on by enterprises, all of which will need services, tools, and foundational infrastructures to appropriately deliver them:
- Proof that data is private, and that privacy is preserved as data is transferred
- Proof that data has been written as intended, preserves its integrity, and can only be updated and accessed by the intended owner
- Proof that no third party has accessed the data
- Proof that entities have monitored all of the above
All of the above need tools, infrastructures, blueprints, and expertise. Enterprises are looking to be fast or slow followers in the area of DLT, which means many of them are lacking the internal skill to deliver a quick technology solution when asked by their management. I don’t want to focus on the skills gap in the world of DLT or encryption, but I instead want to just point-out that expertise will need to be externalized in this space. This is one of the few areas which I would personally recommend going outside of your company to initially or permanently build your expertise.
If I were to give three pieces of advice to start 2019, it’s this:
- Never invent your own cryptography: One of the top sins of information security is to invent your own cryptography – which in the world of DLT is the number one rule. Enterprises should bring in trusted builders, libraries, and methods to ensure that the foundation of their trust infrastructure is sound.
- Always get a second opinion if you are delivering a trust solution: There is a reason international standard recommendations like SANS, PCI, NIST, and HIPAA require third-party audits. These are required because no matter how good YOUR experts are, humans are fallible and you’ll always want to bring in one or many external parties to ensure your code is reviewed, tested, audited, pen tested, attacked, monitored, etc. Your level of diligence should match the importance of your application and the data within. Plus, your customers will appreciate it.
- Do not forget the basics: DLT (Blockchain) is simply application code and really strong math. This means that you need all of the common enterprise architecture components WITH IT to deliver a comprehensive solution. Do not forget things like the SANS TOP 20 when you look to build an architecture. People do not first attack the difficult cryptography – they first attack the common easy vectors like password reuse, unpatched infrastructure, or administrative interfaces that you accidentally left exposed to the internet. Please don’t let your DLT solution be compromised because you forgot one of the basics.
As we move quickly into the world of trust in 2019 and your organization looks to speed ahead or just dip their toes into the world of “Enterprise DLT” (aka Blockchain), keep in mind that not only do you have to use trusted and proven math solutions, apply your historic security practices and audit your built product – but you need to have a solid business case to enhance or improve something useful within your company.
To me, in 2019, the number one blockchain business case is Trust building.
- Beyond Crypto: Impacts of Blockchain Technology on Enterprise Security and Operations - August 6, 2020
- Kudelski Security and Crypto.com - July 31, 2020
- Crypto Exchange Security - December 5, 2019