Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/3/2019
02:30 PM
Steve McNew
Steve McNew
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Privacy & Regulatory Considerations in Enterprise Blockchain

People who understand information governance, privacy, and security should be active participants on the distributed ledger technology implementation team to ensure success.

Blockchain, or distributed ledger technology (DLT), is estimated by Gartner to create $3.1 trillion of business value by 2030, yet many organizations lack a clear understanding of its applications, the risks and benefits specific to their company and industry, or strategies for achieving optimal return from DLT projects.

The landscape of blockchain applications, considerations for understanding their potential benefits, and the importance of planning in enterprise DLT deployments is vast. Beyond those important aspects of adoption decisions are the specific privacy and security considerations that can arise in an enterprise blockchain implementation. Understanding these factors is critical for an organization to determine whether certain use cases make sense given its unique privacy and security risk landscape. 

Organizations must intimately understand their regulatory requirements around the use, sharing, maintenance, and upkeep of various types of data — including data that may be transferred via a blockchain. While it's not feasible to thoroughly discuss all of the regulatory and legal governance of various types of blockchain implementations here, it's important to call out a few to keep in mind. Most multinational corporations are now governed under the General Data Protection Regulation, which introduced strict principles for how the personal data of EU citizens is collected, processed, and stored. HIPAA is a regulatory consideration for potential blockchain implementations at healthcare organizations, and "know your customer" rules will affect the extent to which financial services institutions can use blockchain. If you're utilizing cryptocurrency or tokens as part of your implementation, there are many tax and anti-corruption guidelines and laws to follow.

Understanding the requirements and ensuring those are baked into the workflows and technologies around blockchain use are essential best practices. Below is a checklist of considerations to review when evaluating data privacy and regulatory limitations for blockchain implementations.  

  • Work closely with the legal and/or compliance team to map out which regulations govern your organization. Lean on leaders in other business units to help you understand the risk profile the organization has established with regard to these regulations.

  • Ensure that the plan for any pending blockchain implementation aligns with the organization's overall risk tolerance, which will affect decisions, workflow, and policy around the new technology and its use.

  • Examine what information will be stored on or passed via the blockchain, and whether that data set includes assets that would be considered high-value or sensitive, and therefore treated with special care and attention. Similarly, consider the capability of the blockchain application to restrict access to sensitive or confidential information entirely or within a data set, based on user access and permissions. It's also important to include the ability to identify and remove each block, often referred to as "pruning," so that the data on it may be managed and disposed of as part of the organization’s routine data-disposal program, if applicable. 

  • Leverage support from blockchain experts to guide permissions around the type of blockchain being used. Organizations can choose from public, private, or permission-based blockchains, and the various characteristics of each may either align or clash with the organization's regulatory requirements. Among early adopters, most are using a private or permission-based blockchain; in those scenarios, the team must establish controls over who has access to the ledger, to ensure data is not transferred to unknown entities.

Like the introduction of any new technology or system, blockchain use must be vetted across key stakeholders within the organization, to ensure applications are woven into existing information governance (IG) frameworks and programs. Cross-functional collaboration is a key best practice in IG and should extend to blockchain deployments to avoid compliance and privacy pitfalls. Internal or external resources that understand IG, privacy, and security should be active participants on the DLT implementation team to ensure success.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Steve McNew is a Senior Managing Director within the Technology practice of FTI Consulting and is based in Houston. He helps clients evaluate and implement blockchain solutions, and builds cost-effective and defensible strategies to manage data for complex legal and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
CVE-2019-4409
PUBLISHED: 2019-10-18
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...