topic Re: BlockChain Security in Industry News

BlockChain Security

Adesoji — Tue, 22 May 2018 12:22:35 GMT

Does anyone have any information or some sort of nugget on BlockChain Security?

Or some BlockChain Security Hygiene.

Re: BlockChain Security

Flyslinger2 — Tue, 22 May 2018 13:35:10 GMT

This may help you in your research: https://www.computerworld.com/article/3273931/blockchain/businesses-join-to-create-enterprise-standard-for-blockchain-networks.html

My initial concern is the distributed model. It will take a lot of engineering to assure a secure and solid technology.

Re: BlockChain Security

Chuxing — Fri, 01 Jun 2018 14:33:30 GMT

Blockchain is still in its infancy, I am not sure which part of the technology is more vulnerable. The blockchain itself seems to be secure by default, but the reported issues are mostly related to the key security management.

Re: BlockChain Security

Adesoji — Fri, 01 Jun 2018 15:07:43 GMT

Thanks for the response.

Quite informative!

Re: BlockChain Security

Adesoji — Fri, 01 Jun 2018 15:09:05 GMT

Thanks my friend!

Quite informative

Re: BlockChain Security

Chuxing — Fri, 01 Jun 2018 15:19:15 GMT

@Adesoji,

As far as I am aware, no one has broken into the chain itself, whether Bitcoin, Ethereum, Ripple, or others, but various bleaches did happen in either trading portals or personal wallets, thus stolen keys.

The blocks themselves are very hard to hijack, due to the distributed verification by design.

Happy cryptocurrency...

Re: BlockChain Security

Chuxing — Fri, 01 Jun 2018 15:28:48 GMT

By the way, for those who is interested in how blockchain works, Princeton University has a series of lectures on YouTube that are very good, albeit you will need some fundamental knowledge of encryption, programming, and some other computer science basics. I assume most CISSPs do have that.

Here's the link to the first lecture:

https://www.youtube.com/watch?v=fOMVZXLjKYo&t=55s

Enjoy,

Re: BlockChain Security

NoticeBored — Fri, 01 Jun 2018 22:38:53 GMT

It's only a matter of time and power.
Once upon a time, people thought castles were impregnable.

Re: BlockChain Security

Chuxing — Sat, 02 Jun 2018 01:33:18 GMT

In theory, one can break 64, 128, 256 bit encryption with enough "time and power", but there's yet to be one case...

In theory, if you control 51% of a specific blockchain nodes, say, Bitcoin, you can hijack the block...

Always be reminded, defense is also progressing during the same "time and power"...

Guess it's time to learn a bit more about what the heck is "blockchain" ...

Re: BlockChain Security

Adesoji — Sat, 02 Jun 2018 09:10:31 GMT

Food for thought.

Everything in this realm has a weakpoint.

So, the earlier security professionals discovers and understand the weaknesses of blockchain the better in order for us to help protect it

Re: BlockChain Security

Adesoji — Sat, 02 Jun 2018 09:13:43 GMT

Please Chuxing, keep the information coming.

I am enjoying it

Re: BlockChain Security

rslade — Thu, 16 Aug 2018 15:58:40 GMT

@Adesoji wrote:
So, the earlier security professionals discovers and understand the weaknesses of blockchain the better in order for us to help protect it

And we'd better do it fast. Blockchain is becoming the "biometric" of our day: the magic cure-all that fixes everything we don't understand ...

Re: BlockChain Security

Caute_cautim — Thu, 16 Aug 2018 20:02:21 GMT

Blockchain lacks enterprise security frameworks and associated controls: Rather like the chain of trust, including that of Public Key Infrastructure (PKI) you need to look under the hood and simply ask the questions:

https://securityintelligence.com/why-you-should-do-your-homework-before-investing-in-enterprise-blockchains/

Regards

Caute_cautim

Re: BlockChain Security

Early_Adopter — Fri, 17 Aug 2018 08:18:53 GMT

To quote Hal Finney:

"Bitcoin seems to be a very promising idea. I like the idea of basing security on the assumption that the CPU power of honest participants outweighs that of the attacker. It is a very modern notion that exploits the power of the long tail.”

There was a lot of game theory going into blockchain(assuming you don't live in sociopath central), and while the philosophy is sound we do have to look at the weakest link.

If you think about it form a classical engineering standpoint joints between materials of different hardness and toughness can be problematic, applying it to new technologies - sixty odd years ago DeHaviland Comets were popping like balloons because(simplifying) - square corners on windows.

https://aerospaceengineeringblog.com/dehavilland-comet-crash/

Blockchain itself isn't the problem, it's how it's used, developed and tested. you assume that your HSM keeps the private key all nice and secure, but then a new attack comes along and maybe you need this:

https://arxiv.org/pdf/1710.01430.pdf

But then what of this:

https://www.bbc.com/news/technology-45194333

Re: BlockChain Security

Baechle — Fri, 17 Aug 2018 13:57:08 GMT

@Adesoji wrote:
Does anyone have any information or some sort of nugget on BlockChain Security?
Or some BlockChain Security Hygiene.

Are you talking about implementing a Private, Public, or Hybrid BlockChain?

If it's private, then really you're talking about all the standard protective measures applied to your most critical systems along with proper crypto key management.

If it's public then what we are talking about is trusting a public consensus. There is an assumption in the public blockchain implementations that the participants doing the "mining" or keeping the ledger are all altruistic. However it's theoretically possible to attack the blockchain by overwhelming it with unaffiliated zombies (any group, such as a mining club, that can perform 51% of the transactions causes the chain to fail).

Hybrid Public/Private systems introduce vulnerabilities into the whole system from the vectors present in the respective parts.

Sincerely,

Eric B.

Re: BlockChain Security

rslade — Fri, 17 Aug 2018 17:28:53 GMT

The real issue is that, however it started out, blockchain has now become kind of a marketing term: it means whatever the vendor selling it to you thinks it means. (Which is not necessarily what you need it to mean.)

At base, it is an amalgamation of two ideas. Digital signing of transactions, and a distributed database of those transactions and signatures.

Beyond that, we have implementation details. And those, as always, are where the problems arise.

Are you really serious about the signatures? Are you doing confidentiality, or just the authentication? How serious is your signature algorithm? What about key management? Have you got all the bits you need for a full PKI? Are you using a heirarchical model or web of trust?

And these are only the beginning of the questions. On the signature side.

How are you going to distribute the transaction ledger? Is it going to be full everywhere? Is it going to be full anywhere? How can it be accessed and checked? Will a complete examination of the register identify an individual even if a single transaction doesn't?

So, ultimately, the answer to your question is "no." There isn't any nugget. There isn't any cheat sheet. The hygiene depends upon what you build or buy.

And that's why BLOCKCHAIN IS NOT THE ANSWER.

(Blockchain isn't even the question. Even if the answer is "no.")

Re: BlockChain Security

Caute_cautim — Mon, 20 Aug 2018 01:00:47 GMT

And one of those is the actual partners themselves.

Re: BlockChain Security

h_s_shekhawat — Mon, 20 Aug 2018 03:19:30 GMT

Hi Chuxing,

Nice article, thanks for sharing.

I am not able to find the part 2 of this series, appreciate if you can share the link for that too.

Thanks,

Hemant Shekhawat

Re: BlockChain Security

rslade — Tue, 21 Aug 2018 18:52:57 GMT

Cheat sheet on blockchain.

Re: BlockChain Security

CraginS — Tue, 21 Aug 2018 22:26:01 GMT

Blockchain Can Save the World!
(Oh, Wait, wasn't that Cloud Last Year?)