Blockchain and Cybersecurity
Download as PPTX, PDF•3 likes•6,466 views
The document discusses blockchain technology, explaining its features such as distributed ledgers, smart contracts, and its relationship to cryptocurrencies like Bitcoin, while highlighting its benefits and challenges. It also covers notable cybersecurity breaches, the impact of cyber attacks on organizations, and the importance of vulnerability assessments and penetration testing. The text notes the increasing relevance of cybersecurity measures in protecting against potential threats and outlines common social engineering attacks.
Blockchain and Cybersecurity
- 3. What Is Blockchain? A technology that: • Permits transactions to be gathered into blocks and recorded • Cryptographically chains blocks in chronological order creating a “Trustless system” • Allows the resulting ledger to be accessed by different servers (i.e. a distributed ledger)
- 4. What Is A Distributed Ledger? Centralized Ledger Distributed Ledger • There are multiple ledgers, but Bank holds the “Master Copy” • Each client must reconcile its own ledger against that of the Bank, and must convince Bank of the “true state” of the Bank ledger if discrepancies arise • There is one ledger. All Nodes have some level of access to that ledger. • All Nodes agree to a protocol that determines the “true state” of the ledger at any point in time. The application of this protocol is sometimes called “achieving consensus”
- 5. Trustless System? • Doesn’t mean it’s a system you can’t trust • No trust is required between participants in a transaction • How is this accomplished? – Data is mined into blocks – Together these blocks form a chain – Each block in the chain includes data from the previous block – The resulting “blockchain” is a ledger of transactions that automatically verifies itself
- 6. How Does It Work?
- 7. Using Blockchains Smart contracts • Flexible mechanism that serves as the middleman for all manner of agreements and data exchanges – Identity management – Voting – Digital rights management – Supply chain management – Point-of-sale applications – Healthcare – Currency exchange – Ride sharing
- 8. How Is Blockchain Related To Bitcoin? •Blockchain enables the existence of cryptocurrency •There are more than 1,600 cryptocurrencies today •Bitcoin is the name of the best-know cryptocurrency •Facebook is actively working on creating a cryptocurrency
- 9. Cryptocurrency Benefits and Issues Benefits: • Offers cheaper and faster peer-to-peer payment options • No need to provide personal details • Gaining acceptance as a payment option Issues: • Price volatility – Less buying and selling of goods and services – More speculative trading of the currency itself
- 10. Benefits of Blockchain • Increased transparency • Accurate tracking • Permanent unmodifiable ledger • Cost reduction
- 11. Blockchain Unknowns • Complex technology • Regulatory implications • Implementation challenges • Competing platforms • Cybersecurity
- 12. CYBERSECURITY
- 14. Notable Breaches • Target (2013) – 110 million customers credit/debit card information compromised – Hackers gained access through a third-party HVAC vendor to the point-of-sale card readers – Cost the company $18.5 million, plus additional compliance requirements
- 15. Notable Breaches • Uber (2016) – 57 million Uber users and 600 thousand drivers personal information exposed – Uber failed to disclose the breach for more than one year – Paid the hackers a “bug bounty” fee of $100 thousand to destroy the data with no way to verify the destruction occurred – Valuation dropped from $68 billion to $48 billion
- 16. Notable Breaches • Equifax (2017) – Personal information (including Social Security Numbers, birthdates, addresses, drivers’ license numbers) of 143 million consumers compromised – Caused by a website application vulnerability; using old outdated systems – Setup a dedicated website to take care of consumers – Provided free credit monitoring for one year for all consumers affected – Cost the Company $700 million after reaching a settlement with the government
- 17. Notable Breaches • Capital One (July 30, 2019) – Personal information of 100 million consumers compromised (names, addresses, phone numbers, email addresses, dates of birth, annual income disclosures) – Outside individual gained access to the network by exploiting a misconfigured web application firewall – Will provide free credit monitoring for one year for all consumers affected
- 18. Local Incidents • Texas Lawbook survey states four out of five law firms operating in Texas in 2017 and 2018 were victimized by a cyber attack. • 40% of small and mid-sized companies that experience data breaches are out of business within six months. • Smaller businesses that devote fewer resources to cybersecurity end up with information that is more accessible to cyber attacks
- 19. Vulnerability Assessment • Intended to identify and assign a criticality rating to potential security weaknesses in an organization’s technical environment, but not to exploit the weaknesses • External • Internal
- 20. Vulnerability Assessment • External – Checks for vulnerabilities between the external network and the internet. • Internal – In-depth analysis of the organization’s internal network. – Estimated that approximately 80% of security breaches occur from inside the internal network.
- 21. Vulnerability Assessment • Deliverables – Technical vulnerability assessment report – Recommendations for remediation
- 22. Penetration Testing • Identifies the ease and likelihood with which a malicious attacker could compromise the target environment • Finds weaknesses in the target environment and attempts to exploit them.
- 23. Social Engineering Assessmen • Consist of various methods to determine susceptibility to common people-based attacks to obtain credentials, convince users to circumvent security controls, install unauthorized software, disclose sensitive information, or enable assess to unauthorized areas. • Focus is on humans rather than weaknesses in the IT infrastructure.
- 24. Social Engineering Assessmen • Common scams: – Phishing – Ransomware – Media drops – Tailgating
- 26. CONTACT US Jason R. Cope Goldin Peiser & Peiser, LLP (214) 635-2508 [email protected]