Blockchain

The promise of blockchain is spurring companies across the economy to experiment with leveraging the technology in their products and internal processes. But given its novelty, bringing blockchain in-house can come with its unique set of security challenges.

Blockchain is digital network of information, complied in a decentralized database shared with users that may have access. Each “block” in a blockchain is a record of information, essentially a entry on a ledger. Companies across the economy, including those in the tech and finance industries have been looking to leverage blockchain for a variety of platforms.

One of the most potentially viable applications is smart contracts, which use blockchain to automatically execute terms, such as transferring funds when a deed is received. But if smart contracts handle sensitive information or funds, users need to make sure that they are coded correctly to ensure the data and capital is managed in the right way.

“Anyone working with smart contracts should absolutely be having an audit done if it's going to handle any kind of operation of importance or financials,” said Yo Sub Kwon, CEO of Hosho, a blockchain security company.

Such audits are necessary, he noted, as “there are so few people writing good contracts right now because the space, the language, the methodology, are so new.”

What's more, if a smart contract manages or transfers cryptocurrency, users also need to take precautions to make sure their digital “wallets”—where cryptocurrency is stored—are safe from cybertheft. “If you're dealing with cryptocurrency, it's very important to have high security measures around the wallet, everything from how the keys are generated to how they are stored, to who has access to backups,” Kwon said.

Beyond cryptocurrency storage and code vulnerabilities, there are operational security issues with using blockchain-enabled technologies as well. Because blockchain, whether public or private, connects multiple different parties, there is a need to ensure security across all users.

With collaboratively using software on the blockchain, whether smart contracts or compliance technology, the problem then becomes one of coordination. “Using peer-to-peer software technologies, you're talking about IT teams and cybersecurity teams having to cooperate with each other across organizations to shield that software from attack and respond to attacks that can occur,” said Amir Azaran, a partner in Loeb & Loeb's advanced media and technology practice.

“So you're going to have to have teams from different organizations working together in a way they haven't had to before, and that's going to be an institutional challenge.”

But it is a challenge that must be overcome. Companies or law firms that use the same blockchain software have to be able to ensure it is not only impenetrable from outside attack, but also restricted only to authorized and trusted in-house users.

“There is absolutely a security issue with who has administrative rights to smart contracts,” Kwon said. “Some of the largest hacks that have happened in the smart contract space have been due to user access or people who have been able to get administrative access when they should otherwise not been able to.”

Indeed, fraud due to unauthorized access of blockchain technologies, such as cryptocurrency wallets, is one of the biggest problems facing the technology. This is mainly because while the blockchain itself is secure, the security of software or transactions on the blockchain are the responsibility of individual users.

For example, “In the world of bitcoin, the consumer is basically in charge of securing their own bitcoin if something goes wrong; if they lose their keys or if someone hacks them, they can't get it back,” said Duane Pozza, assistant director at the Federal Trade Commission, at the CDX Academy Blockchain Brand Innovation Summit in New York on May 11. “The architecture of many of these systems puts it on the consumer to secure it and take a lot of control over it.”