share
Distributed ledger technology has become popular due to the hype around cryptocurrencies. Many companies developed blockchain cybersecurity solutions, vying with each other to talk about a secure decentralized future, sealed with cryptographic signatures, and showed impressive slides with infographics and powerful slogans—corporations one after another published news about the development of a corporate blockchain or cooperation with promising startups. Now the bitcoin exchange rate has dropped noticeably, the price has dropped, and it has become possible to calmly see how things are with the actual use of the blockchain technology to protect against cyberattacks, focusing on the practical side of the issue.
Blockchain Briefly
Blockchain is a distributed public registry that does not have a single storage and management center, operating at the expense of millions of users around the world connected to the same network. Each user can add information to the blockchain, which is protected by cryptography. Also, each user is obliged to check the new information for authenticity (confirmation of work) before adding it to the chain. The whole process is carried out using three keys: public, private and the recipient’s key. These keys allow a chain member to verify the authenticity of the information.
The Role of Blockchain in Cybersecurity
Cybercriminals are acting with increasingly sophisticated methods, trying to steal valuable information: financial data, medical records, personal data and intellectual property objects. To do this, using advanced spyware, they resort to highly profitable strategies, such as completely blocking the operation of the enterprise with DDoS attacks or monetization of data access.
Due to its distributed nature, there is no place in the blockchain through which it can be hacked or any single point of failure. Therefore, it provides higher security than other existing operational structures built on the basis of databases. Let’s consider with you how the blockchain provides security.
Removing the Human Factor From the Authentication Process
With the help of blockchain technology (technology for cybersecurity), enterprises can authenticate devices and users without resorting to the use of passwords. This makes it possible to eliminate human interference in the authentication process as one of the possible attack directions.
The use of a centralized architecture and simple authorization mechanisms is a disadvantage of traditional systems that are already outdated. It is not so important how much money an organization invests in security. All efforts will go nowhere if its employees and customers use ordinary passwords that are easy to steal or crack, which has already been proven by time. Using blockchain technology provides reliable authentication of a new generation and, at the same time, solves the problem of a single point of attack, thus protecting its users from cyber attacks.
With the help of blockchain technology, the security system in an organization can improve the authentication infrastructure that is used to authenticate devices and users. Thus, the system does not issue a password for each device but a separate SSL certificate. These certificates are managed on the blockchain, which makes it almost impossible for attackers to use fake certificates.
Decentralized Storage
Blockchain users can send their data from any computer on the network. To do this, it is necessary to ensure the serviceability and security of the circuit. For example, if someone is not the owner of the data element (for example, an attacker) and intentionally decides to change the block, then all copies of this block in the system will be analyzed, and the one that differs from the others will be identified. If the system detects such a version of the block, it will simply exclude it from the chain, recognizing it as false.
The structure of the use of blockchain technology (cybersecurity technology) is organized along a special chain so that there is no single place to store information and a single central authority responsible for its storage. Each user of the network stores (blockchain networks) part or all of the blockchain applications. All users of blockchain networks are responsible for verifying and storing data, so it is impossible to delete existing information and add false information.
Protection Against Phishing
According to Trend Micro research, the exploitation of human weaknesses has become the main vector of modern cyber-attacks. The popularity of phishing among cybercriminals is explained by its high efficiency and relatively low costs. The main task when creating a fraudulent letter or website is to convince the potential victim of the legitimacy of what is happening because only in this case she will readily perform the targeted action of the attack.
There are various ways to confirm the authenticity of the letter. For example, the Binance cryptocurrency exchange offers its users to add a special anti-phishing code to letters from the exchange as such a solution. A fair question arises: why does the crypto exchange not use blockchain solutions for protection, preferring a primitive secret code that is relatively easy to forge? There are, for example, a wide set of blockchain security solutions that use a distributed registry to classify phishing and legitimate URLs.
Thus, it can be stated that despite the availability of blockchain security solutions to protect against phishing, they have not yet received much distribution due to the lack of obvious advantages.
Tracking Changes in the Blockchain
Each transaction added to a personal or public blockchain receives a timestamp and a digital signature. This means that companies have the ability to track the history of any transaction up to a certain period of time and find another participant in the transaction using his public key.
This characteristic is closely related to ensuring the impossibility of waiving obligations under a user-initiated transaction. This increases the reliability of the system since each transaction is cryptographically linked to the user.
Each new transaction added to the blockchain leads to a change in the global state of the registry. At the same time, each previous iteration of the system is saved, forming a history log that is completely traceable.
The verifiability of blockchain security provides companies with a certain level of reliability and transparency at each iteration. From the point of view of cybersecurity, this gives network participants additional guarantees that the data has not been tampered with and they are authentic.
Blockchain Provides Protection Against DDos Attacks
Distributed denial of service (DDoS) attacks are attacks aimed at disrupting the normal traffic of a network, service or server by overloading the target with Internet traffic.
DDoS attacks are based on the fact that the target is a point of receiving information, which can be easily overloaded if it is flooded with a large number of points sending information. Blockchain technologies can eliminate the need for a centralized server.
Hackers wishing to use DDoS attacks against a decentralized network must disperse the attack traffic. This, in turn, will significantly reduce the probability of success of their DDoS attacks.
IoT Security
The number of IoT devices is constantly growing: in 2019, the number of IoT gadgets exceeded 26 billion units. According to Gartner estimates, in 2020, there will be 26 times more of them than there are people on Earth. Given the ubiquitous penetration of the Internet of Things into our lives and the increasing dependence on devices, their security becomes critically important.
Meanwhile, the actual state of affairs leaves much to be desired. Passwords hard-wired into devices, lack of cryptographic protection and firmware vulnerabilities make IoT an ideal target for hacker attacks. Using blockchain applications solves many problems related to the Internet of Things, for example, the problem with authentication and connection.
The registration of each IoT device in a distributed registry and the granting or exclusion of access rights using blockchain transactions enables all network participants to verify the legitimacy of connections and requests. As a result, the connection of unauthorized devices and the interception or substitution of data using a man-in-the-middle attack is a thing of the past. This is how the Litecoin-based cloud blockchain application Uniquid works. In addition to protecting against unauthorized connections, it provides fault tolerance of the authorization process due to the absence of a dedicated server.
Another direction of using blockchain in IoT/IIoT is the protection of supply chains. The registry makes it possible to track all stages of production and movement of components of a finished product, medicine or food, excluding the possibility of theft or forgery. But these cases are marginally related to cybersecurity.
Blockchain solutions for IoT are offered by various companies, but most of the implementations are experimental in nature.
There Are Several Reasons for Such Indecision of Customers:
- risks and complexity of using new solutions;
- the requirement to upgrade or replace incompatible equipment;
- the need to refine existing software systems.
Thus, despite expectations, IoT security with the help of blockchain has not yet managed to gain significant popularity.
Enabling the Use of Digital Identities
The use of passwords is a generally accepted method of verifying the identity of users. One of the main disadvantages of passwords is that they are stored in a centralized system.
Thus, even very strong passwords can become ineffective if the system in which they are stored is hacked. Blockchain security technologies allow you to create decentralized digital identities that do not depend on any third party.
For example, some firms allow its users to create a personal identification based on the blockchain while at the same time ensuring their privacy.
Protection of Applications for Private Messages
Private messaging apps are used by millions of users every day. Skype alone has 300 million monthly users. WhatsApp has more than 1.5 billion active users. Although many believe that most modern private messaging applications are secure enough, this is far from the case.
For example, numerous Internet sources have announced that contractors are checking audio recordings of Skype conversations without obtaining the permission of the participants of the conversations. Microsoft has publicly acknowledged this practice, stating in its privacy policy that Microsoft uses “both automated and manual (human) methods of processing” personal data collected via Skype. Decentralized applications for working with private messages using blockchains allow their users not only to encrypt their messages but also to divide each message into small fragments of data and store these fragments in different places. This means that no third party will have access to the messages. If a third party wants to have such access, it needs to overcome serious obstacles, namely, collecting fragmented and encrypted data from blockchain nodes and searching for the secret key needed to decrypt it.
Blockchain technologies allow you to implement innovative features in private messaging applications. For example, the email application can be used to prioritize each message exchanged through the application and categorize the messages received. This allows users to focus only on important messages and ignore messages with a low value, which are most likely to be spam messages.
Conclusion
Blockchain has qualities that allow it to be used for cyber defense. However, today the technology does not have a sufficient degree of maturity to move from the category of fashionable novelties to the mainstream.
Blockchain applications perfectly ensure the integrity of information but do not provide noticeable advantages in the field of confidentiality and accessibility compared to other technologies.
In addition, the implementation of a distributed registry requires solving issues related to the organization of mining for transaction authentication, as well as the development of standards, APIs and frameworks for manufacturers of IoT devices.
Do not forget that, like any technology, the blockchain may contain implementation errors, the operation of which may lead to loss of control over the data entered in the registry.
With that said, it can be stated that blockchain is not a panacea against cyber attacks, and therefore traditional means of protection are still an obligatory component of the information security infrastructure.
