Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/3/2019
02:30 PM
Steve McNew
Steve McNew
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Privacy & Regulatory Considerations in Enterprise Blockchain

People who understand information governance, privacy, and security should be active participants on the distributed ledger technology implementation team to ensure success.

Blockchain, or distributed ledger technology (DLT), is estimated by Gartner to create $3.1 trillion of business value by 2030, yet many organizations lack a clear understanding of its applications, the risks and benefits specific to their company and industry, or strategies for achieving optimal return from DLT projects.

The landscape of blockchain applications, considerations for understanding their potential benefits, and the importance of planning in enterprise DLT deployments is vast. Beyond those important aspects of adoption decisions are the specific privacy and security considerations that can arise in an enterprise blockchain implementation. Understanding these factors is critical for an organization to determine whether certain use cases make sense given its unique privacy and security risk landscape. 

Organizations must intimately understand their regulatory requirements around the use, sharing, maintenance, and upkeep of various types of data — including data that may be transferred via a blockchain. While it's not feasible to thoroughly discuss all of the regulatory and legal governance of various types of blockchain implementations here, it's important to call out a few to keep in mind. Most multinational corporations are now governed under the General Data Protection Regulation, which introduced strict principles for how the personal data of EU citizens is collected, processed, and stored. HIPAA is a regulatory consideration for potential blockchain implementations at healthcare organizations, and "know your customer" rules will affect the extent to which financial services institutions can use blockchain. If you're utilizing cryptocurrency or tokens as part of your implementation, there are many tax and anti-corruption guidelines and laws to follow.

Understanding the requirements and ensuring those are baked into the workflows and technologies around blockchain use are essential best practices. Below is a checklist of considerations to review when evaluating data privacy and regulatory limitations for blockchain implementations.  

  • Work closely with the legal and/or compliance team to map out which regulations govern your organization. Lean on leaders in other business units to help you understand the risk profile the organization has established with regard to these regulations.

  • Ensure that the plan for any pending blockchain implementation aligns with the organization's overall risk tolerance, which will affect decisions, workflow, and policy around the new technology and its use.

  • Examine what information will be stored on or passed via the blockchain, and whether that data set includes assets that would be considered high-value or sensitive, and therefore treated with special care and attention. Similarly, consider the capability of the blockchain application to restrict access to sensitive or confidential information entirely or within a data set, based on user access and permissions. It's also important to include the ability to identify and remove each block, often referred to as "pruning," so that the data on it may be managed and disposed of as part of the organization’s routine data-disposal program, if applicable. 

  • Leverage support from blockchain experts to guide permissions around the type of blockchain being used. Organizations can choose from public, private, or permission-based blockchains, and the various characteristics of each may either align or clash with the organization's regulatory requirements. Among early adopters, most are using a private or permission-based blockchain; in those scenarios, the team must establish controls over who has access to the ledger, to ensure data is not transferred to unknown entities.

Like the introduction of any new technology or system, blockchain use must be vetted across key stakeholders within the organization, to ensure applications are woven into existing information governance (IG) frameworks and programs. Cross-functional collaboration is a key best practice in IG and should extend to blockchain deployments to avoid compliance and privacy pitfalls. Internal or external resources that understand IG, privacy, and security should be active participants on the DLT implementation team to ensure success.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Steve McNew is a Senior Managing Director within the Technology practice of FTI Consulting and is based in Houston. He helps clients evaluate and implement blockchain solutions, and builds cost-effective and defensible strategies to manage data for complex legal and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15160
PUBLISHED: 2019-08-19
The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
CVE-2019-15150
PUBLISHED: 2019-08-19
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.
CVE-2017-18550
PUBLISHED: 2019-08-19
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551
PUBLISHED: 2019-08-19
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552
PUBLISHED: 2019-08-19
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.