As the world rapidly shifts the underpinnings of complex global commerce to online platforms, blockchain and its distributed ledger technology may offer a compelling approach to minimizing cybersecurity risk. Because of how the blockchain is designed, transactions and related data are immutable, secure and decentralized, and may be impervious to security breaches that might affect data stored in a single, centralized place. How might companies incorporate blockchain to secure data?

This article will discuss blockchain generally and its potential cybersecurity-related functions, security considerations when placing assets on the blockchain, and whether existing laws and regulations will have to be changed to foster new blockchain technologies.

What Is Blockchain?

In a “blockchain” or distributed ledger network, individual transactions are grouped into “blocks.” As a block of transactions is verified, the block is distributed to all the participants on the network (often referred to as “nodes”), and is logically and irrevocably linked to the block before it (creating the “chain”). In this way, all of the nodes have a full and complete copy of every transaction ever conducted through that network. Unlike centralized ledger networks, the chain can be updated with a new transaction by any node on the network, with all nodes' copies of the chain being identical. In short, the principal innovation is a method to digitally send something of value without a trusted intermediary or institution. Moreover, the blockchain allows for the automatic execution and settlement of business rules without human intervention through “smart contracts.”

There are public or “permissionless” blockchains (such as that underlying Bitcoin), where anyone can be a node on the network, and the transaction ledger can be accessed by everybody. Security is accomplished through wide distribution and the use of cryptography to secure data. For developing commercial applications, the preferred implementation is a private (or “permissioned”) blockchain implementation, with limited or pre-selected participants authorized to transact on the network. In either case, however, no single entity or node controls the ledger—the network itself verifies the transactions through a “consensus mechanism.”