Skip to content

Information Security

Blockchain Benefits in Australia: Beyond the Hype

This post was originally published on Medium here.

On the morning of a date sometime in March 2011, thousands of Iranian internet users logged into their Gmail accounts, completely unaware that they had just given their passwords to a hacker. The Dutch company, DigiNotar’s commercial certificate authority servers had been attacked, granting the hacker virtually unprecedented powers to commit identity fraud. Although the identity of the hacker is still unknown, they issued a series of fraudulent certificates for popular services such as Google’s Gmail. Because these certificates were signed by DigiNotar’s certificate authority, they were virtually undetectable, and trusted unquestionably by web browsers and their users.

Even after the breach was discovered, it remained difficult to establish exactly when the attack had occurred and exactly what personal information had been compromised, making it almost impossible to detect and contain the full extent of its consequences. Users around the world were affected, the attack shook the foundations of today’s digital infrastructure, and the situation eventually required the Dutch government’s intervention. Whilst steps were taken to prevent future attacks of this nature, it became painfully clear just how much of the day-to-day functioning of the internet depends on blind assumptions that trusted third parties are, in fact, trustworthy.

The 2011 attack was the “I told you so” moment that cryptography experts had predicted many years earlier. The reliance of users and devices on the services provided by “trusted third parties” like DigiNotar means that it is only a question of when such an attack might happen, and the basic problem of how to protect centralised trust services persists.

Introduction to Blockchains

In October 2008, a paper released under the pseudonym Satoshi Nakamoto proposed an elegantly eccentric mechanism for doing away with trusted third parties altogether. Bitcoin was an entirely novel digital currency whose integrity is ensured by its storage and the storage of all its financial transactions on a decentralised ledger called a blockchain. Nakamoto’s system is at once transparent and “trustless” because it replaces trusted third parties with a decentralised consensus algorithm.

To explain this rather abstract concept, it is useful to draw an analogy with actual systems of government and distinguish between merely (geographically) distributed systems and fully decentralised systems such as Bitcoin and its underlying blockchain.

Systems like DigiNotar support critical internet activities, and their functions are at once distributed and centralised; despite the geographic distribution of their components, their functional hierarchy remains centralised. Their design principles are “authoritarian” because the stability of their systems depends entirely on the authority of “governing” nodes.

These nodes are rather like the generals of an army: all commands directing the actions of their subordinates are transmitted through them. Their orders must be taken as indisputable and authoritative: they are the crucial organising links in the chain of command that guarantees the smooth, disciplined function of the system.

Protecting Data Without Trusted Third Parties

Some experts claim a decentralised, consensus-based blockchain would provide a DigiNotar-like certificate authority without the Achilles heel of vulnerable trusted third parties. Bitcoin has from the start been proposed both as a currency and a digital payments system. For those close to Bitcoin, the term trusted third party is used derisively, and usually when referring to existing financial institutions such as banks and organisations running financial trading markets. So it is not surprising that the financial sector, both domestically and abroad, have been the most sized by blockchain hype and fear of obsolescence.

Here Australia has followed the global trend, with the ASX scrambling to adopt this technology as a replacement for the CHESS post settlement platform. The main question here most non-technical users find themselves asking does is how do blockchain protect and simplify the lives of internet users? The age-old dilemmas of societal trust, public accountability and information ownership have until now largely been relegated to the domains of jurisprudence and political theory and it is here where we must take a step back. Data remains the key asset in this information age. Who defines and classifies it, who is responsible for it as it passes between individuals, businesses and national governments? Who should be held accountable? How do existing demarcation of legal jurisdiction apply to information on the internet?

Regulatory frameworks, as expected, have not kept abreast of technological innovation. A key response has been the European Union’s, updating the General Data Protection Regulation directive which is due to come into effect in May 2018. This new regulation broadens the definition of personal data and protections afforded to EU citizens, making it necessary for any company, regardless of nation of incorporation or physical location of this information.

This legislative trend However has not been reflected in Australia, with a recent federal high court ruling restricting the legal definition of personal data as it applies to existing privacy acts.

This court decision is paradoxical, given Australia’s love of technology, from contactless payments, to the long-running the debate over the GST-free threshold for online shopping, or Australia’s unenvious world leadership in the number of annual data breaches. Even in online government services, the Centrelink overpayments glitch belies Australia’s leadership, as the United Nation’s survey in e-Government services places us in second place globally.

Beyond Human identity

But what about blockchain uses in major Australian industries outside of finance? Blockchains are essentially a generic tool to store transactional data in a distributed, decentralised ledger — and control who has access to that ledger. The liberal Australian legislative environment and the challenges of providing necessary network infrastructure in the harsh, remote areas makes where industrial mining and agriculture tend to operate make the benefits of decentralised, peer-to-peer blockchains a natural fit, rather than applications in finance to replace consumer banking services. This feature also makes blockchains incredibly appealing to the doctors and hospitals that need secure access to a patient’s entire health history. “Now is probably the right time in our history to take a fresh approach to data sharing in health care,” says John Halamka, chief information officer at Boston-based Beth Israel Deaconess Medical Centre.

In the Internet of Things (IoT) would also reap huge benefits of the decentralised storages of device information on blockchains, particularly in agriculture and mining sectors where network connectivity is rare and intermittent. Whilst human identity remains malleable and context-dependent, connected electrical devices have a much simpler identity and this is where the Blockchain could be of use. Blockchains could provide industries with a mechanism for independently verifying the authenticity, integrity, and ownership of the technology devices necessary for large-scale industrial projects in these sectors. Some examples include the use of blockchains in connected devices in the mining industry such automated mining vehicles and the Digital Agriculture Program. Certified owners could issue command and control diktats to their devices: anything from a software upgrade to a new control routine. The devices would then “organically” distribute this command to peer devices within range. The authenticity of these commands could be verified by each participating node, and once confirmed, the device could transmit the command to neighbouring devices. Conversely, devices in remote areas which have been compromised by an unauthorised attacker would be blacklisted on the decentralized blockchain. Other devices would not trust it or accept any new orders it attempted to issue.

Dilemmas of trust and accountability are not everyday concerns to most citizens, yet a cohesive society rests on a sound legal system and a government which makes enforces it and is guided by it in protecting citizens rights. Blockchains are too complex technically to provide immediate, tangible benefits to consumers and are instead more appropriate in industrial applications. Such as in the dominant Australian industries: mining, agribusiness and healthcare.

 

 

The Best Cyber Security Tip yet? Don’t Have Secrets and to Hell with Intellectual Property

Medium Link

As anyone who’s undergone security clearance vetting knows, the main objective is ensuring that the candidate can’t be black mailed. That they don’t have some secret which can be used as leverage against them. This simple principle has broad implications, from intellectual property to piracy to a naughty browser history. Let’s examine privacy consent in positive and negative contexts.

When we talk about the right to privacy, what do we actually mean? Let’s not confuse contexts with legality and secrecy. It’s perfectly legal to purchase sex toys, but would you want your parents or your work colleagues knowing your adult toy purchasing preferences, or you porn browsing history? Most certainly not! That’s context. That’s what Incognito Mode is for.

The right to privacy is the right not have information about your activities be misused by leaking or doxxing. In short, the right to maintain context boundaries. This is the dark stuff, this is where the law must protect you. Negative freedom, freedom from having your information exfiltrated from differing contexts for the purpose of doing harm.

The European Union’s General Data Protection Regulation on the frontier here. Consent is key. Data can be a toxic asset, and we don’t want data about our browsing activities, purchasing habits or sexual preferences misused.

But data privacy rights isn’t just about negative freedom. It’s also about positive freedom; freedom towards. How reassuring is it to find that others have encountered the same problems we have and have already come up with a useful solution? This works on an individual level such as “which internet service provider gives me the best plan and customer service?” or “how do I solve problem X?”, to more general problems such as “how do I integrate this API with that service to solve challenge Y?”.

I work in technology consulting, and I’ve come to the conclusion that organisations aren’t all that unique. Organisations and businesses have common challenges, yet much like humans, they think they’re unique and their problems are special. Psychologists will say the same. Sorry snowflake, you’re not special, you’re just like everyone else!

The secret is differentiating common problems from special problems. How do we distinguish common problems from special problems? By sharing your problems with others, and by never thinking that the solutions you come up with are special and necessitate secrecy. Value lies in relationships and implementation details, not in intellectual property secrecy.

Have you ever successfully interviewed for a job by stating you have a cache of secret approaches to problems? Didn’t think so. You got the job by demonstrating you can work well with others and you have a good understanding of the knowledge domain you’re being hired for.

The devil is in the the details; in actually making something work. But the patterns, the tool set for approaching the problems are probably common knowledge in your industry.

So, to hell with secrecy! Actually implementing the solution requires the skill of the seasoned consultant. Re-inventing the wheel by keeping secret caches of code, of patterns, of diagrams, is both counter-productive and ineffective if not downright stupid.

It’s counter-productive because someone probably has already figured an approach to the problem you face, it’s stupid because your solution hasn’t been road-tested and it could also be risky because you’ve failed to take into account issues that the collective intellect has already come across and resolved.

So let’s put the fantasy of the lone genius in their garage who will come down from the mountain to regale us with their pearls of wisdom to rest for good. Most of the problems an individual or an organisation faces are faced by other individuals or organisations, so it’s safe to assume that the solutions to most of these problems can and have already been solved collectively. So when faced with a problem or challenge, start with the assumption that the problem has already been faced by others previously, and that a working solution has already been attempted. And if not, it’s a problem which merits collective troubleshooting, and the crowd will probably be better at figuring out a solution than some individual. And for god’s sake, share the solution, the pattern, the approach, with everyone. Actually implementing it to fix a specific problem will be a far greater challenge than coming up with that magical idea in the first place.

So share often, ask others, and don’t keep it a secret!

Data Loss Prevention in the Post-Snowden World – Technology’s deep ties with society and the normative

AAEAAQAAAAAAAAZWAAAAJDEwMDUxMzQxLTU3MDEtNDhkZS04ODk4LWU1NjE3Mzg0YWI0OA

Originally a Linkedin post, thus the tailored tone.

Before looking to technology to prevent a Snowden event, it is important to understand what motivates those behind insider threats. Before looking at expensive DLP solutions or encryption technology that will inevitably impact the end user experience and frustrate employees, one must understand what motivates whistleblowers, and understand the difference between whistleblowing, sabotage and burglary. What causes an employee to grow so dissatisfied and disgruntled that they sabotage their own organisation and livelihood?

Let’s leave aside briefly the non-trivial privacy concerns that Snowden raised and imagine he was an employee in a large organisation. Snowden was not a saboteur nor a burglar, the motivations behind his actions were not driven by financial or retaliatory intents. On watching the many interviews and documentaries, is it clear that Snowden is an independent, analytical thinker with an above-average intelligence, a person of strong personal values who places high importance on ethical behaviour. He also clearly has a passion for his work as an information security professional. Regardless of what one thinks of his motivations or politics, he has shown no signs of mental instability or resentment for his former organisation. He sounds more like a model employee. What led him to commit those actions whose results he was well aware would lead to the loss of a well-paid job and a comfortable life?

It is clear that he felt his employer was engaging in unethical and illegal practices, and he either had no way to raise his concerns without fearing repercussions, or he did raise them and was ignored. Taking the Snowden affair as an analogy, imagine he worked at Enron, or at Volkswagen. No one is suggesting that Volkswagen should have used better software development techniques to make their fraudulent car software harder to detect. No one is suggesting that Enron should have been more clever, and made their embezzlement and deception more ‘sustainable’, perhaps with the use of better big data and BI solutions. Yet this is exactly the reasoning we hear coming from information security vendor marketing shills. As if a technical solution can fix what is mostly caused by toxic work environments and bad management, even if it is made possible due to insufficient information security practices and processes.

Protecting critical data with good technical solutions and processes is still important, as there are many more cases of data theft were the motivations of the attackers are guided by self-interest, much like regular burglary. To again use an analogy, it is one thing to defend your home and family from burglars, it is quite another thing if you consider your family members a threat. Organisations are not the same of course, and the trust levels are lower too. This is the normal societal trust hierarchy, with close family being at the pinnacle, and work colleagues being just a couple rungs below, yet the analogy holds. What solution presents a better value proposition for dealing with a situation of internal family conflict, a hidden camera system or family counselling?

To consider technology in isolation from the normative and the societal is of little use in real-world risk management and information security. Investing in treating employees with respect, better pay and working conditions, better corporate governance, ethical business practices and more tolerance for atypical but original thinkers will probably provide a better return on investment than clunky systems which with enough determination – due to the need to balance security and usability – can usually be circumvented by determined attackers. For every Snowden there are hundred unimaginative employees who might lack the initiative for whistleblowing but also lack the originality and proclivity for independent, analytical thinking that are critical requirements for an organisation’s survival. Snowden’s skills and aptitude are exactly those skills of tech workers that has the tech giants tripping over themselves to find, poach and retain.

If employees feel valued and respected, if the work they do fills them with pride, if independence and critical thinking are encouraged, if business practices are ethical, then the best employees will also be the organisation’s best allies. Leaving time for management to focus on defences against burglars and criminals rather than on finding ways to make it harder for the most valued employees to do interesting things.

%d bloggers like this: