1. Blockchain It Isn’t Just for Bitcoin Anymore
ISACA San Antonio/South Texas
February 27, 2018

2. About the Speakers Erica Smith Jeff Reich
Started off in IT/Information Security
Over 15 years in the IT Audit field
CISM, CISA, Security +
Jeff Reich
Almost 40 years in the industry
ISSA Distinguished Fellow
ISSA Hall of Fame
CISSP, CRISC

3. What is Blockchain? Created by the entity Satoshi Nakamoto
By allowing digital information to be distributed but not copied, blockchain technology created the backbone of a new type of internet. Originally devised for the digital currency, Bitcoin, the tech community is now finding other potential uses for the technology.

4. Claims Around Blockchain
“The blockchain is an incorruptible digital ledger of economic transactions that can be programmed to record not just financial transactions but virtually everything of value,...”
Don and Alex Tapscott, “Blockchain Revolution” ( revolution.com/)

5. Is It Used Only For Bitcoin?
Other cryptocurrencies use it
Ethereum
Ripple
Litecoin
Dash: Digital+ cash
NEM
Ethereum Classic
Monero
Zcash
Decred: Decentralized Credit
PIVX: Private Instant Verified Transactions

6. Is It Used Only For Cryptocurrencies?
Blockchain is a technology, Cryptocurrencies are an asset class
Large implementation of the ethereum blockchain was used in May 2017 to deliver cryptocurrency to Syrian refugees to be used at food markets
Other industries have begun efforts to design and implement blockchains, some include
Vote Integrity - FollowMyVote.com
Cloud Storage - Storj.io and factom
Digital Identity - ShoCard

7. Why Has It Become So Popular?
It’s sexy
Popularity of cryptocurrencies have raised its profile
Technologists have discovered ways to use it to provide
Identification
Availability
Non-repudiation
Decentralized growth

8. How Cryptocurrencies Work
There will never be more than 21,000,000 Bitcoin
Released through Block Halving
50, then halved every ~210,000
Last halved July 9, 2016
Currently 12.5/Block
Blocks are mined
Very CPU-intensive

9. How Cryptocurrencies Work
Mining is legal, in many places
Not all miners use legitimate methods to mine
Mining, and Fraud, and Theft, OH NO!

10. Blockchain Basics
P2P
Nodes
Validation
Transaction
Ledger

11. Blockchain Basics
Source:

12. Uses For Blockchain Technology
Google Docs and MS Word
Industries

13. What is Trust? What is trust? Examples of ways society gains trust
“Firm belief in the reliability, truth, ability, or strength of someone or something” - Oxford American Dictionary
Examples of ways society gains trust
Lawyers
Real Estate Agent
University Degrees

14. Building Trust in a Distributed Ledger
Blockchain employs a Distributed “Shared” Ledger Technology often referred to as a DLT
Full node has a complete and validated copy of the entire blockchain
Transactions or records are encrypted using hashes and Public/Private keys and digitially signed to ensure the authenticity

15. Building Trust In A Ledger
Every record submitted to Blockchain goes through a review process by Distributed Operators, called “Consensus”
Practical Byzantine Fault tolerance
Proof of work algorithm
Delegated proof of stake algorithm
If a corrupted block is transmitted from a node it will be ignored

16. Can Blockchain Be Broken?
In 2016 the “DAO” was hacked
Cost: Nearly $80 Million
Root Cause: Vulnerability in the Blockchain code
Enigma Project Scam
Cost: Nearly $10 Million
Root Cause: Administrator account was hacked
NiceHash Market Breach
Cost: Nearly $78 Million
Root Cause: Trusted Employee’s computer was compromised

17. Auditing and “Controlling” Blockchain
Audit focus needs to shift from post transaction to more operating effectiveness
IT General Controls just as crucial as ever
Strong management of administrator credentials
Patch Management
Key Management
Vulnerability Identification & Remediation
Understand how Blockchain is deployed in your environment

18. Auditing – Back to the Basics
ABC’s- aren’t just for kindergarten
“Smart Contracts” otherwise known as self-executing contracts
Review of the rules around the contracts
Rules and Penalty Criteria

19. Blockchain - Closed vs Open Networks
Two types of Blockchain Networks
Open Blockchain (Internet)
Closed Blockchain aka Permissioned Blockchain (Intranet)
Strong Access Management controls
Accessible only by those who have permissions
Transactions are only edited by approved administrators

20. Securing the Blockchain Infrastructure
Migration from Mainframes to the Distributed Platform (Windows/Linux)
Segmentation of the Network
Ensuring firewalls to help segment the network
Cloud environment
Governance and oversight

21. Blockchain – The Future
Is not just for the financial sector anymore
2016 saw Blockchain being investigated organizationally as “Proof of Concept” technology
Maturing protocol with vendors developing commerical off the shelf applications for wide spread deployment
Are you Ready?

22. Questions? Jeff Reich: jreichcissp@gmail.com
Erica Smith: