Capability: Network & Infrastructure Services

How does blockchain improve cybersecurity?

Posted on: 4 January 2023
How does blockchain improve cybersecurity?

Cybersecurity breaches are a serious threat to most businesses and can have devastating consequences. A study found that companies typically spent $3.86 million (£2.9 million) per cybersecurity incident.

Exploring advanced technology is one of the solutions to reduce your losses in the event of a breach. Blockchain’s features mark a change of era in cybersecurity. We will use the CIA Triad model, a standard model for information security guidance, to highlight some of the features and assess the security level of blockchain. Some business use cases leverage these features to improve their cybersecurity.

CIA Triad Model

The Model represents 3 pillars of Information Security – Confidentiality, Integrity and Availability. This is a valuable model to guide your team in developing security systems.

Confidentiality
Confidentiality means preserving authorised restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.

  • Encrypted data
    Blockchain technology can provide high-level security control to assure the confidentiality of data. Even if an attacker can access the blockchain network, fully encrypted blockchain data ensures the attacker cannot read or retrieve information properly.
  • Public and private keys
    Public and private keys are a string of letters and numbers generated by cryptographic algorithms, which are hard to decode by current computing power. They are critical to protecting your user information, the confidentiality of data, authentication and authorisation to the network.

Integrity
Integrity means guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity.

  • Cryptographic hashing
    Using cryptographic hashing in a decentralised system creates a barrier for any party trying to alter the data. This ascertains the integrity and truthfulness of the data in your system.
  • Timestamps of data
    Transactions in the system are digitally signed with timestamps so that you can trace them back throughout history.
  • Smart contract
    A smart contract is a computer program that automatically executes when specific conditions between buyers and sellers are met. It permits trust transactions and agreements without an intermediary’s involvement. All these transactions are trackable and irreversible.

Availability
Availability means ensuring timely and reliable access to and use of information.

  • Decentralised data storage
    By storing a complete set of data in a peer-to-peer network, data is still accessible in other nodes if a node is down or attacked. This highly reduces the chance of an IP-based DDoS attack causing operational disruption.

Business use cases in cybersecurity improvement

Lockheed Martin
Lockheed Martin integrates blockchain-based cybersecurity applications into their engineering processes, supply chain risk management and software development efforts.

Ron Bessire, the Vice President of Lockheed Martin Aeronautics Engineering and Technology, believes these new cybersecurity approaches will enhance data integrity, speed problem discovery and mitigation, and reduce the volume of regression testing, which results in reduced schedule risk.

Colorado, the U.S.
In 2017, The Colorado government faced 6-8 million attempted cyberattacks daily. The Colorado Senate passed a bill involving blockchain technology for government record-keeping and cybersecurity. They are confident that the expanded use of blockchains may offer transformative improvements to data security, accountability, transparency and safety across dispersed state departments and jurisdictions.

Barclays Bank
Barclays files two patents that revolve around account security – a blockchain platform which can facilitate cryptocurrency transfers and a private blockchain that streamlines know-your-customer processes (KYC).

They created the “world-first” blockchain platform to handle the documentation to approve fund transactions, which was made through the Society for Worldwide Interbank Financial Telecommunication (Swift). The platform uses smart contracts to track log changes of ownership and payment processes automatically.

The other platform allows the bank to store all customer personal information, verify customer identity and trace their credit history easily in a secure environment.

Philips
Philips calls their blockchain project “verifiable data exchange” – researchers in a network of hospitals and universities can request medical-sensitive data they need for research in the system. User experience revolves around three disciplines: anonymising data, requesting data and fulfilling requests. The system stores a full and immutable trail of how data is used, who has accessed it and who has seen it.

Philips researchers believe the transparent storage of data exchange between the involved parties will create a system of shared risk and responsibility.

Conclusion

While blockchain features continuously evolve in order to strengthen cybersecurity, hacking techniques are ever-developing, creating more and more vicious attacks. For cybersecurity specialists, staying up-to-date with the latest changes is essential. Our next article will examine a number of cyber-attacks coordinated against blockchains.

How CACI can help

Keeping up to date with the latest regulations and cybersecurity trends, our experts can enhance your company’s data management solutions, IT architecture and design, service design, business process service, and cybersecurity.

Get in touch with us today.

Notes:
[1] The cost of a cyber attack in 2021 – IT Governance UK Blog
[2] Executive Summary — NIST SP 1800-26 documentation
[3] Lockheed Martin Contracts Guardtime Federal for Innovative Cyber Technology – Apr 27, 2017
[4] Colorado Passes Bill Advocating Blockchain For Gov’t Data Protection And Cyber Security (cointelegraph.com)
[5] Barclays Seeks Twin Blockchain Patents for Banking Services – CoinDesk
[6] Philips Research Trying to Encourage Healthcare Industry to Utilize Blockchain (newsbtc.com)
[7] Philips will challenge tech giants to bring blockchain to healthcare (thenextweb.com)

 

Blockchain, The Game-changer of Data Governance

Posted on: 29 November 2022
Blockchain, The Game-changer of Data Governance

Data Governance is our priority when designing a data management solution. The significant contradictions between blockchain technology and The European Union’s General Data Protection Regulation (GDPR) arouse vigorous discussions in the industry. In contrast, European Parliament highlights that it can be a suitable tool to achieve some GDPR objectives.

Make sure to read blockchain technology’s features and strategic business values, as we now explore how blockchain technology changes the game in data governance as more governments experiment with new operations.

Contradictions between blockchain technology and GDPR

The study “Blockchain and the General Data Protection Regulation”, written by European Parliament, highlights several paradoxes in the fundament of blockchain technology and GDPR:

  • Data Controller
    GDPR assumption: Data is centralised on at least one or legal person.
    Blockchain technology concept: Data is decentralised to multiple nodes.
  • Data Modification
    GDPR assumption: Data can be modified or erased where necessary to comply with Articles 16 (Right to rectification) and 17 (Right to erasure).
    Blockchain technology concept: Data is immutable and stored in the append-only database to ensure data integrity and increase network trust.
  • Data Process
    GDPR requirement: Personal data to be kept to a minimum and only processes data purposefully specified in advance.
    Blockchain technology concept: Databases grow continuously as new data is added.

The study also underlines different forms of distributed databases. Hence the compatibility between distributed ledgers and the GDPR is determined by a case-by-case analysis that accounts for the specific technical design and governance set-up of the blockchain use case.

The above analysis leads to two overarching conclusions:

  • Blockchain use cases’ technical specificities and governance design can be hard to reconcile with the GDPR. Therefore, blockchain architects must be aware of this from the beginning and ensure their design complies with GDPR.
  • It also stresses the current lack of legal certainty on how blockchain can be designed to comply with the regulation – Not just due to specific features of this technology but also highlights significant conceptual uncertainties related to GDPR.

How can blockchain technology achieve GDPR objectives?

There was an ongoing policy debate in European Parliament on this topic. Their report in 2018, Blockchain: A Forward-Looking Trade Policy, pointed out that ‘blockchain technology can provide solutions for the ‘data protection by design provisions in the GDPR implementation based on their common principles of ensuring secured and self-governed data.’ Recital 7 GDPR foresees that ‘natural persons should have control of their own personal data.’ This rationale is based on the data subject rights, such as the right of access (Article 15 GDPR) or the right to data portability (Article 20 GDPR) that provide data subjects with control over what others do with their data, and what they can do with that personal data by themselves.

At the 52nd Hawaii International Conference on System Science in 2019, a group of experts proposed a multi-layer blockchain system which can provide users with complete data transparency and control over their data. European Parliament commented that this solution would help comply with the right to access (Article 15 GDPR) and grant a fundamental right to individuals to access their personal information. This looks like a significant move in blockchain because European Parliament recognises the new standards. We believe more corporates are willing to explore the feasibility of applying blockchain in their business, and experimental cases will be boosted out in the market.

Blockchain applications in European Union

Estonian eHealth Patient Portal
Estonia is one of the first governments to embrace blockchain technology. Estonian eHealth Patient Portal, a blockchain-based infrastructure, has been used by their eGovernment to give individuals more control over their health data. A patient can authorise access to their data. By default, medical specialists can access data. However, a patient can deny access to any case-related data to any care provider, including their own general practitioner/family physician.

MyHealthMyData
MyHealthMyData is a project funded under the EU Horizon 2020 scheme that uses blockchain technology to create a structure where data subjects can allow, refuse and withdraw access to their data according to different cases of potential use. Further research can build on this project to determine whether blockchain technology can achieve GDPR objectives and create a benchmark for the industry.

Blockchain Roadmap of the UK Government

The UK Government is endeavouring to develop blockchain use cases and governance.  A report by the UK Government Chief Scientific Adviser in 2016 acknowledged that Distributed Ledger Technologies could help governments collect taxes, deliver benefits, issue passports, record land registries, assure the supply chain of goods and generally ensure the integrity of government records and services. In the NHS, technology can enhance health care by improving and authenticating the delivery of services and by sharing records securely according to exact rules.

Yet, effective governance and regulation are critical to successfully implementing distributed ledgers. Law will need to evolve in parallel with the development of new technology applications.

HM Revenue and Customs started a trial on social welfare payment distribution in June 2016 to track the distribution of benefits. They are still working with a UK start-up to integrate blockchain technology into supply chains to increase efficiency and security.

Department for Work and Pensions studied the first full production implementation, such as Santander’s One Pay FX, a blockchain-based international payments service to retail customers in multiple countries. The benefits include reducing transaction time, cost and failure rate whilst data is stored on a secure, immutable ledger.

Conclusion

Though there are significant tensions between the nature of blockchain technology and the legal frameworks surrounding data privacy, blockchain technology can be an alternative form of data management system for you to achieve particular data governance objectives, depending on the system architecture. With more governments recognising the benefits brought by blockchain, we believe blockchain technology can be compatible with data privacy law.

Despite the legal framework of GDPR being built on the fundament of a centralised database system, corporates should be more familiar with the regulations; they can face catastrophic data breaches and hefty fines in light of weak security layers. Data breaches of British Airways in 2018 and Marriott in 2020 were considered case studies.

British Airways was fined £20m for a data breach which affected more than 400,000 customers. A subsequent investigation concluded that sufficient security measures, such as multi-factor authentication, were not in place at the time.

Marriott International was fined £18.4m for a data breach that exposed 339 million customer records in 2018, caused by poor data management policies and unencrypted sensitive data. An investigation by the Information Commissioner’s Office found the hotel giant “failed to put appropriate technical or organisational measures in place to protect the personal data being processed on its systems, as required by the GDPR.”

In other words, a robust security system is essential to data protection, not the technology itself.

Other than data privacy law, Financial Stability Board intends to implement its first recommendations on global crypto regulation in early 2023. This powerful regulation may provide more clarity for the crypto businesses on how to set up the blockchain system. Let’s follow the latest news on the regulation.

Our upcoming discussion focuses on how blockchain can improve cybersecurity and impact different business cases.

How CACI can help

Our experts can advise you on the best practice for managing your data under your regulatory requirements. We help large enterprise organisations define and execute data standards, policies and strategies.

Get in touch with us today.

 

Notes:
[1] Blockchain and the General Data Protection Regulation (europa.eu)
[2] Article 16 & 17: Right to rectification (gdpr.org)
[3] REPORT on Blockchain: a forward-looking trade policy | A8-0407/2018 | European Parliament (europa.eu)
[4] BPDIMS:A Blockchain-based Personal Data and Identity Management System (researchgate.net)
[5] Estonian Health Records to Be Secured by Blockchain – Bitcoin News
[6] Personal control of privacy and data: Estonian experience | SpringerLink
[7] My Health My Data
[8] Distributed Ledger Technology: beyond block chain (publishing.service.gov.uk)
[9] GovCoin Systems Implements Social Welfare Payments Distribution Trial for UK’s Department for Work and Pensions | Business Wire
[10] Transforming for a digital future: 2022 to 2025 roadmap for digital and data – GOV.UK (www.gov.uk)
[11] Santander One Pay FX, a blockchain-based international money transfer service – (enterprisetimes.co.uk)
[12] The changing world of payments – DWP Digital (blog.gov.uk)
[13] British Airways fined £20m over data breach – BBC News
[14] Lessons learned: the Marriott breach – Infosec Resources (infosecinstitute.com)
[15] Marriott Fined £18.4m Over Data Breach – Infosecurity Magazine (infosecurity-magazine.com)
[16] FSB ready for rapid rollout of global crypto standards (ft.com)

The Metaverse – Innovate or Die?

Posted on: 24 November 2022
The Metaverse – Innovate or Die?

Metaverse

What is the Metaverse?

The metaverse is a term which describes a collection of virtual worlds that we can work, play, explore and collaborate in. Whilst the term has become a popular buzz word of late, the name ‘metaverse’, itself, comes from Neal Stephenson’s 1992 science fiction novel Snow Crash, a book which envisioned a virtual world in which people would use avatars to interact with each other. Similar, is Stephen Spielberg’s more recent 2018 movie Ready Player One, which saw individuals find salvation from the chaos of reality in the virtual world: OASIS. Currently, there are multiple metaverse platforms in use, all with incredibly different interfaces, user bases and access credentials. The aspirational term ‘metaverse’, refers to an all-encompassing decentralised virtual world, rich in offering, interoperable and governed by the community.

The powerful combination of the emergence of 5G, offering us the infrastructure and connectivity needed for access, the advance of computing and processing power needed for availability and affordability, powerful blockchain technologies, in addition to the seismic emergence of cryptocurrencies, NFT’s, wallets and exchanges, means that a new Goldilocks zone has emerged, whereby the conditions for an entirely new economy to thrive within the metaverse are just right. Enter, Web 3.0.

How can companies leverage the Metaverse now?

“The metaverse will likely infiltrate every sector in some way in the coming years, with the market opportunity estimated at over $1 trillion in yearly revenues.” J.P Morgan

As with previous technology paradigm shifts, such as the birth of the internet, the metaverse is poised to transform almost every aspect of society. So, as we sit at the edge of the Web3 precipice, it is important for companies to understand, accept and embrace the new technology epoch and how they can fully leverage its presence.

Five key areas to currently observe: Talent Acquisition, Branding, Digital Products, Training and Work Structure.

1. Talent Acquisition
With driving demand and heavy investment being placed into the technological infrastructure of companies, there has been an uplift in the talent demand for many of these skilled roles. Jeremy Dalton, global director of metaverse technologies for PwC, said: “For recruitment, we are already using a metaverse platform, Virtual Park, to interview job candidates and offer them the ability to meet our people and find out more about our culture, values and opportunities”, since launching two years ago, they have reached roughly 20,000 users, a much wider talent pool than could have typically been accessed previously.

2. Branding
The social side of the metaverse is just as vital as the commercial side. Consumers will soon be able to make purchases of goods and services (including land) in both the physical world and the metaverse. Brand loyalty will become increasingly dependent on how well a company adapts and translates their current offerings onto the metaverse. As with all major technological shifts, the metaverse will gain traction slowly over time, 3D imaging for example, made its debut in the late 1800s, as well as games like Second Life, an alternate-reality video game which took 4 years to get its base to a million users (Fortnite then built upon this and after initial release in 2017 is now used by roughly 125m users worldwide). The metaverse will force companies to consider how their brand appeals to early adopters and stays relevant to their traditional customer base. This could have major implications on how a company defines and markets themselves to potential customers.

3. Digital Products

One of the ways multiple businesses are enriching the consumer experience of their brand via the metaverse, is by creating digital products and therefore generating new revenue streams. Luxury fashion brand Gucci opened a virtual space ‘Gucci Garden’, based on the philosophy of their creative director, Alessandro Michele and went on to sell a digital version of their ‘Queen Bee Dionysus’ bag on the Roblox marketplace for $4,115, more than the price of the bag’s real-world equivalent of roughly $3400.

Nike, a leading brand in the metaverse, acquired a non-fungible token studio, RTFKT, that produces digital collectibles (including digital sneakers) to merge culture and gaming. Previously RTFKT collaborated with teenage artist FEWOCiOUS to sell real sneakers paired with virtual ones, selling 600 pairs and NFT’s in six minutes and netting over $3.1 million. In addition to NFT’s, events are also able to be held in the space and are quickly gathering momentum; fashion shows, book launches and film premieres are all possibilities. In 2020, hip-hop star Travis Scott, earned millions of dollars by his avatar appearing on Fortnite, performing in concert and then sold virtual goods around it such as Travis Scott gaming skins.

4. Training/development
The rise of virtual and augmented reality has made huge waves within the gaming world, one popular example being Pokemon Go, and Anthony Wong, marketing director of Attensi (gamified solution training), believes that the same principles used for gaming, can be applied to learning and development in workplace training. Adding this new dimension to information sharing could transform business processes from onboarding sessions to simulation training/testing for complex practical roles. L&D practitioners will now need to be mindful of up to four generations, all equipped with multiple learning styles and consider how best to encourage fun, fast and ultimately more fruitful learning, essential in maximising growth potential.

5. Work Structure

Post covid, the majority of companies have moved to a hybrid structure of working, with many meetings and collaborations taking place across multiple technology platforms. The emergence of the metaverse could see companies pivot again, interacting using hands-free devices, avatars and new tools rather than only laptops and phones.

Frank Diana, managing partner and futurist at Tata Consultancy Services (TCS), likens the workplace shift to the metaverse to the transition from typing pools to having an entire workforce typing into personal computers. “What if there are boundary-less 3D collaboration tools in the metaverse and the team could transport themselves to the Louvre Museum for inspiration?” Diana asked. “If working remotely in the metaverse provides both increased productivity and better collaboration, today’s office model gets totally upended.”

Matterport, a tech company whose 3D modelling software digitally replicates physical spaces, has been developing digital twin workflows that lets employees collaborate, learn and engage remotely. For example, architects can virtually collaborate with clients by remodelling ideas to make faster decisions, retailers can virtually collaborate on store layouts to discover problems or opportunities sooner. Current 2D models of working are posed to advance with haste to 3D virtual environments, allowing workers to interact in immersive ways, consumer relationships to develop and companies to foster their company culture.

Metaverse Tech

Whilst it’s easy to assume the metaverse is a faraway galaxy when compared to our immediate reality, many companies are already harnessing its power and proving the benefits of virtual worlds. Zwift for example, an MMO cycling game meets training tool established in 2014, has a 4 million subscriber base and through use of minimal kit; a bike, smart trainer and viewing device such as your phone or TV, riders can move through virtual imaginings of real-world routes across cities like London and New York and can also ride through the imagined worlds built by Zwift, such as Watopia.

Riders can input their height and weight data and this in addition to ANT+ and Bluetooth connectivity, then allows Zwift to calculate performance and show standings in comparison to other users. Since 2016, the company has also held world championships which have produced athletes who have gone on to secure real pro team contracts. Loes Adegeest, the 2022 winner, currently rides for UCI World Tour Team, ICBT and gained 5th place in general classification of the Lotto Belgium Tour. Zwift are proof that companies can both excel and profit by embracing virtual reality and their data sets around improvement to users health and social dynamics has cemented its status as a leading pioneer in the space.

Challenges and Risks firms face from the metaverse

Consider first, whether it makes sense to be engaging across these platforms. As the metaverse isn’t yet a single entity, but instead a collection of technologies, many would argue investing whilst still in its infancy could pose many financial and reputational risks to businesses. Privacy and safety concerns around hacking, impersonation and importantly, data use, rank highly among consumer fears, whilst the commercial, legal, and regulatory implications of the metaverse for businesses are enormous. If we were to take intellectual property, for example: What are the limits of IP, piracy, ownership, and patents in the virtual world? Are there digital land rights? How do brands deal with counterfeit digital products? Do you need a license to practice law in the metaverse?

This presents a new arena for hackers and new opportunities for criminal behaviour. How will misconduct be monitored, reported and remedied? What recourse do victims of avatar identity theft have? Are financial transactions protected? There is currently little regulation in place. Lastly, technical challenges such as computing power, interoperability and connectivity (bandwidth), present difficulties most companies simply aren’t ready nor equipped for. A true ecosystem of virtual worlds, where a person’s digital assets can be carried from one world to another, will require significant preparation and collaboration from large tech players, which could potentially conflict with their own nature.

That being said, the other end of the spectrum would be that companies face an even greater risk by failing to innovate. Similar to the Zuoara’s documentation of the mass extinction of companies who failed to embrace the “subscription economy”, innovation and the rapid progression of these technologies should not be ignored. A recent study by McKinsey found that the average lifespan of companies listed in Standard & Poor’s 500 was 61 years in 1958. Today, it is less than 18 years. McKinsey believes that, in 2027, 75% of the companies currently quoted on the S&P 500 will have disappeared.

In these evolving times, businesses are advised to exercise caution when investing in the metaverse and to facilitate early conversations between IT, compliance, legal, finance, and security.

How CACI can assist companies within the metaverse space

According to a recent Bloomberg report, the metaverse is on track to have a market size worth $678 Billion by 2030. For business, the implications of an immersive, persistent and decentralised digital world could be enormous. Since 1962, CACI has been aiding companies identify emerging technologies, utilise their strengths and build protective solutions from potential threats. Whilst the metaverse is still very much an evolution rather than a revolution, its foundational elements lay within connectivity, processing power, data storage and security. Drawing on the advanced capabilities of 25,000 skilled professionals worldwide, we offer a spectrum of services across the entire metaverse continuum to aid mission led enterprising companies in their pursuit of innovation:

metaverse business approach
Source: PwC 2022 Business and consumer metaverse survey, July 2022

“…what attracts human attention is change. …if the temperature around you changes, if the phone rings — that gets your attention. The way in which a story begins is a starting event that creates a moment of change.” – Robert McKee

Contact us here to get in touch about any of our services.

Notes:
[1] Opportunities in the metaverse (jpmorgan.com)
[2] Metaverse Market Size Worth $678.8 Billion by 2030: Grand View Research, Inc. – Bloomberg

Should you invest in blockchain technology?

Posted on: 8 November 2022
Should you invest in blockchain technology?

Blockchain technology has revolutionised an array of fields including financial services, supply chain, healthcare and the Internet of Things. In the first of a series of blogs exploring blockchain, we look at the key areas to consider before deciding to invest in blockchain – an overview of the technology, its business applications and strategic business values.

What is a blockchain?

A blockchain is a shared, decentralised database that uses Distributed Ledger Technology (DLT) to store data in a succession of segments called blocks. After the latest block is filled, it is cryptographically connected to the previous completed block. The data chain created is called a blockchain.

How does it work?

What types of blockchain are there?

Public blockchain
A public blockchain is non-restrictive and permissionless. Any internet user can register on a public blockchain platform and become an authorised processing and storage node. All nodes in the network have equal rights to access, create, and validate the data in the blockchain. Bitcoin and Ethereum are the most well-known public blockchain platforms dealing with cryptocurrency.

Private blockchain
A private blockchain works in a restrictive environment and is governed by one organisation which determines node access, executes the consensus protocol and maintains the shared data. A private blockchain typically runs within an organisation’s network to cope with highly confidential data and is held securely. Audit management and asset control are common use cases of private blockchain.

Hybrid blockchain
A hybrid blockchain combines characteristics of both public and private blockchains to control access to specific private data held on a public blockchain. For instance, property companies use hybrid blockchains to run systems privately but disclose certain transaction information to the public.

Consortium blockchain
Consortium blockchains are a type of private blockchain managed by multiple organisations rather than one entity. Supply chain management, especially for food and medicine, is an ideal application for this type of blockchain – from sourcing to delivery, all parties involved in the supply chain can form a consortium to track the product status.

The advantages of blockchain

Decentralised trust
Users no longer rely on centralised intermediaries to complete transactions. By storing data in a peer-to-peer network, every node has the same data and authority to view all transactions. There is no single point of control.

Enhanced security
Cryptographic hashing, which converts arbitrarily large amounts of data into a short unique string of text, plays a crucial role in blockchain security. A hash value is automatically calculated for each block and consists of the block’s ID number, user ID number, previous block’s hash value, timestamp and other details. Employing hashing in this manner makes it impossible to change any data held in the block, metadata about the block, or its position in the chain without having to recompute that and every subsequent block in the chain.

High level of data integrity
From the verification process to storing transactions, data is verified by a consensus algorithm specific to the blockchain protocol. Any invalid data is rejected, protecting the chain from human error. The integrity and security of blockchains make them immutable, transparent and unimpeachable.

Disadvantages of blockchain

Uncertain legal and regulatory environment
Blockchain technology is still developing and the principles of existing regulations may not accommodate the fundamentals of blockchain. For instance, General Data Protection Regulation (GDPR) assumes data is centralised on at least one legal entity, while blockchain decentralises data storage to an anonymous network of nodes. Blockchain technologists should study the regulations thoroughly before implementation.

Novel cyber-attacks
Blockchains are not immune to cyber-attacks and all new technologies have undiscovered vulnerabilities. Attacks such as the following are effective against blockchain:

  • a 51% attack – where more than half of the nodes computing a chain are influenced by a bad actor
  • a Sybil attack – where a single entity creates multiple dummy nodes to wield disproportionate voting power
  • DDOS – where nodes are flooded with connections which block out legitimate traffic

There are no quick solutions to safeguard your systems, blockchain technologists can implement careful plans on system architecture and design to pre-empt cyber-attacks.

High energy consumption and data storage cost
Older blockchains, such as Bitcoin, validate blocks using a Proof of Work consensus algorithm in which all the nodes compete to compute a completed block in exchange for an administrative payment. Only one node can win resulting in all the partial computations being wasted. This amounts to a tremendous waste of electricity. More modern blockchains employ Proof of Stake, which is much more efficient, but migrating from one protocol to the other is extremely complicated. Blockchains ledgers – the data chain – are replicated at least in part to every node. By 2021, the Bitcoin ledger had reached 433GB [1] and the Ethereum ledger close to 1TB [2]. Given node counts in the thousands, even partial replication represents vast duplication across the world.

Considerations before you implement blockchain

Business needs
Before you implement blockchain technology, we strongly advise your team to evaluate existing business models and needs. Businesses that require a high level of data integrity and traceability are more likely to apply this. Investing in blockchain technology is worthwhile if the application transforms your user experience, democratises governance or reduces overall cost; but it is fundamentally a distributed database.

Integration concerns
Given that most organisations rely on legacy systems to run their business, careful technical analysis is essential to ensure that blockchain systems can integrate successfully with the existing estate.

Privacy issues
Logical layers in a blockchain system are the key to complying with privacy regulations. Stakeholders should examine the interactions between different layers – how the data is stored, accessed and transacted in the system.

Cost and revenue analysis
Enormous investments in setting up a blockchain system – such as infrastructure, data storage and maintenance – often create barriers for organisations to get involved. However evaluating its strategic business values can change your mind. Let’s take some examples from The Blockchain 50, named by Forbes [3] :

  • Allianz streamlines cross-border auto insurance claims in Europe. Processing time for insurance claims has been reduced from several months to minutes and costs have fallen 10%. The quick claim procedure absolutely contributes to a high customer satisfaction level and customer retention. No wonder Allianz has led in the claims category with a satisfaction score of 76.04%, according to Brokerbility’s survey. [4]
  • Boeing builds a digital aircraft record system to help airlines keep up with required maintenance, saving 25% on maintenance costs, potentially worth up to $3.5 billion (~£2.96 billion) annually.[5]
  • De Beers has registered over 400,000 gems worth $2 billion (~ £1.6 billion) to provide immutable records of a gem’s origin, to track it along the supply chain and improve jewellery retailers’ confidence in procurement. [6]

Scalability
As more nodes join a blockchain network, latency and convergence can increase. Compare the transaction speed between Bitcoin, the oldest and biggest public blockchain network which can only process 7 transactions per second, and Visa, a centralised electronic payment network which can handle more than 24,000 transactions per second [7].

Scalability is a challenge in setting up a public blockchain, but there are several options to enhance it:

  • Data Sharding – Data sharding splits an extensive blockchain network into smaller, more easily managed parts called shards. A node does not need to rely on the whole database to verify and process a transaction. Instead, all nodes work in parallel, resulting in more efficient transaction throughput.
  • Off-chain data storage – Transactions can be completed on the blockchain network, and data is stored in the off-chain environment to reduce the on-chain storage requirements.
  • Scalable consensus mechanisms – The Proof of Work consensus protocol in Bitcoin provides a high-security mechanism but a long transaction time. Proof of Stake consensus mechanism is a possible solution to speed up transaction time and higher scalability.

Conclusion

To decide whether to invest in blockchain technology, your team should ascertain whether your business needs will be best met by using this approach and explore cost and revenue impact as much as possible. Equally, you should consider the disadvantages of blockchain technology such as potential cyber-attacks, high energy consumption and scalability concerns to decide how to address each of them. Blockchain technology is not the only way to perform full data transparency or traceability – well-managed centralised databases can solve it.

Blockchain technology changes how we trust and solve problems in a traditional database system, like disintermediation and data security enhancement. It can optimise the operation in low-trust environments where users rely on third-party checks.

An insight written by McKinsey Digital [8] analysed the monetary impact in more than 90 use cases; they estimated that approximately 70 per cent of the value at stake in the short term is cost reduction, followed by revenue generation and capital relief. Cost can be taken out by removing intermediaries and administrative efforts on housekeeping, as well as improvements in transparency and fraud control.

Specific industries that capture the most significant revenue from blockchain are Automotive, Healthcare, Property, Public Sector and Technology, Media & Telecommunications. We believe the value of blockchain will enable brand-new business models and revenue streams over time.

This is the first blog in our new series which aims to help you understand the different aspects of blockchain technology. Over the course of the series, we will discuss how blockchain impacts data governance, cybersecurity and cyber-attacks.

How CACI can help

Equipping your systems with blockchain-compatible elements is a key initial step. Our services enable you to ensure that the foundations are correct and our experts can advise you on network design, architecture, service design, business process, data governance and cybersecurity solutions. Get in touch with us today.

 

Notes:
[1] Blockchain Explorer – Search the Blockchain | BTC | ETH | BCH, statistics as of 23 Oct, 2022
[2] Ethereum Chain Full Sync Data Size (ycharts.com), statistics as of 24 Oct 2022
[3] Forbes Blockchain 50 2022
[4] Allianz tops the ranks in Brokerbility’s insurer partner satisfaction survey (insurancetimes.co.uk)
[5] Boeing supports TrustFlight aircraft maintenance project using blockchain – Ledger Insights – blockchain for enterprise
[6] De Beers group introduces world’s first blockchain-backed diamond source platform at scale – De Beers Group
[7] Small Business Retail | Visa
[8] The strategic business value of the blockchain market | McKinsey

7 Steps to Strong Cloud Security

Posted on: 13 October 2022
7 Steps to Strong Cloud Security

 

Demand for cloud-based offerings has accelerated due to the COVID-19 pandemic, with the importance of flexibility and agility now being realised. Without adapting, businesses risk being left behind, but what are the benefits and how do you know if it’s the right solution for you?

We shared the key advantages of cloud adoption and challenges in cloud security in our previous blogs.

In our final article in this series of blogs, we share the key steps to strengthen your organisations cloud security.

As more businesses adopt cloud technology, primarily to support hybrid working, cybercriminals are focusing their tactics on exploiting vulnerable cloud environments. Last year, a report found that 98% of companies experienced at least one cloud data breach in the past 18 months up from 79% in 2020. Of those surveyed, a shocking 67% reported three or more incidents.

This issue has been exacerbated by soaring global demand for tech talent. According to a recent survey, over 40% of IT decision-makers admitted to their business having a cyber security skills gap.
It’s a vulnerable time for enterprise organisations, and cloud security is the top priority for IT leaders. Here we consider the critical steps you can take now to make your business safer.

1. Understand your shared responsibility model

Defining and establishing the split of security responsibilities between an organisation and its CSP is one of the first steps in creating a successful cloud security strategy. Taking this action will provide more precise direction for your teams and mean that your apps, security, network, and compliance teams all have a say in your security approach. This helps to ensure that your security approach considers all angles.

2. Create a data governance framework

Once you’ve defined responsibilities, it’s time to set the rules. Establishing a clear data governance framework that defines who controls data assets and how data is used will provide a streamlined approach to managing and protecting information. However, setting the rules is one thing; ensuring they’re carefully followed is another – employing content control tools and role-based access controls to enforce this framework will help safeguard company data. Ensure your framework is built on a solid foundation by engaging your senior management early in your policy planning. With their input, influence, and understanding of the importance of cloud security, you’ll be better equipped to ensure compliance across your business.

3. Opt to automate

In an increasingly hostile threat environment, in-house IT teams are under pressure to manage high numbers of security alerts. But it doesn’t have to be this way. Automating security processes such as cybersecurity monitoring, threat intelligence collection, and vendor risk assessments means your team can spend less time analysing every potential threat, reducing admin errors and more time on innovation and growth activities.

4. Assess and address your knowledge gaps

Your users can either provide a strong line of defence or open the door to cyber-attacks. Make sure it’s the former by equipping the staff and stakeholders that access your cloud systems with the knowledge and tools they need to conduct safe practices, for example, by providing training on identifying malware and phishing emails.
For more advanced users of your cloud systems, take the time to review capability and experience gaps and consider where upskilling or outsourcing is required to keep your cloud environments safe.

5. Consider adopting a zero-trust model

Based on the principle of ‘Never Trust, Always Verify’, a zero-trust approach removes the assumption of trust from the security architecture by requiring authentication for every action, user, and device. Adopting a zero-trust model means always assuming that there’s a breach and securing all access to systems using multi-factor authentication and least privilege.
In addition to improving resilience and security posture, a zero-trust approach can also benefit businesses by enhancing user experiences via Single Sign-On (SSO) enablement, allowing better collaboration between organisations, and increased visibility of your user devices and services. However, not all organisations can accommodate a zero-trust approach. Incompatibility with legacy systems, cost, disruption, and vendor-lock-in must be balanced with the security advantages of zero-trust adoption.

6. Perform an in-depth cloud security assessment

Ultimately, the best way to bolster your cloud security is to perform a thorough cloud security audit. Having a clear view of your cloud environments, users, security capabilities, and inadequacies will allow you to take the best course of action to protect your business.

7. Bolster your defences

The most crucial principle of cloud security is that it’s an ongoing process and continuous monitoring is key to keeping your cloud secure. However, in an ever-evolving threat environment, IT and infosec professionals are under increasing pressure to stay ahead of cybercriminals’ sophisticated tactics.

A robust threat monitoring solution can help ease this pressure and bolster your security defence. Threat monitoring works by continuously collecting, collating, and evaluating security data from your network sensors, appliances, and endpoint agents to identify patterns indicative of threats. Threat alerts are more accurate with threat monitoring analysing data alongside contextual factors such as IP addresses and URLs. Additionally, traditionally hard-to-detect threats such as unauthorised internal accounts can be identified.

Businesses can employ myriad options for threat monitoring, from data protection platforms with threat monitoring capabilities to a dedicated threat monitoring solution. However, while implementing threat monitoring is a crucial and necessary step to securing your cloud environments, IT leaders must recognise that a robust security program comprises a multi-layered approach utilising technology, tools, people, and processes.

Get your cloud security assessment checklist and the best cloud security strategies in our comprehensive guide to cloud security.

The 9 Biggest Challenges in Cloud Security

Posted on: 10 October 2022
The 9 Biggest Challenges in Cloud Security

Demand for cloud-based offerings has accelerated due to the COVID-19 pandemic, with the importance of flexibility and agility now being realised. Without adapting, businesses risk being left behind, but what are the benefits and how do you know if it’s the right solution for you?

We shared the key advantages of cloud adoption in our previous blog. This time around, we identify the biggest challenges of cloud security.

Cloud adoption has become increasingly important in the last two years, as businesses responded to the Covid-19 pandemic. Yet, a 2020 survey reported that cloud security was the biggest challenge to cloud adoption for 83% of businesses. [1]

As cybercriminals increasingly target cloud environments, the pressure is on for IT leaders to protect their businesses. Here, we explore the most pressing threats to cloud security you should take note of.

1. Limited visibility

The traditionally used tools for gaining complete network visibility are ineffective for cloud environments as cloud-based resources are located outside the corporate network and run on infrastructure the company doesn’t own. Further, most organisations lack a complete view of their cloud footprint. You can’t protect what you can’t see, so having a handle on the entirety of your cloud estate is crucial.

2. Lack of cloud security architecture and strategy

The rush to migrate data and systems to the cloud meant that organisations were operational before thoroughly assessing and mitigating the new threats they’d been exposed to. The result is that robust security systems and strategies are not in place to protect infrastructure.

3. Unclear accountability

Pre-cloud, security was firmly in the hands of security teams. But in public and hybrid cloud settings, responsibility for cloud security is split between cloud service providers and users, with responsibility for security tasks differing depending on the cloud service model and provider. Without a standard shared responsibility model, addressing vulnerabilities effectively is challenging as businesses struggle to grapple with their responsibilities.

In a recent survey of IT leaders, 84% of UK respondents admitted that their organisation struggles to draw a clear line between their responsibility for cloud security and their cloud service provider’s responsibility for security. [2]

4. Misconfigured cloud services

Misconfiguration of cloud services can cause data to be publicly exposed, manipulated, or even deleted. It occurs when a user or admin fails to set up a cloud platform’s security setting properly. For example, keeping default security and access management settings for sensitive data, giving unauthorised individuals access, or leaving confidential data accessible without authorisation are all common misconfigurations. Human error is always a risk, but it can be easily mitigated with the right processes.

5. Data loss

Data loss is one of the most complex risks to predict, so taking steps to protect against it is vital. The most common types of data loss are:

Data alteration – when data is changed and cannot be reverted to the previous state.

Storage outage – access to data is lost due to issues with your cloud service provider.

Loss of authorisation – when information is inaccessible due to a lack of encryption keys or other credentials.

Data deletion – data is accidentally or purposefully erased, and no backups are available to restore information.

While regular back-ups will help avoid data loss, backing up large amounts of company data can be costly and complicated. Nonetheless, 304.7 million ransomware attacks were conducted globally in the first half of 2021, a 151% increase from the previous year.[3] With ransomware attacks surging, businesses can ill afford to avoid the need for regular data backups.

6. Malware

Malware can take many forms, including DoS (denial of service) attacks, hyperjacking, hypervisor infections, and exploiting live migration. Left undetected, malware can rapidly spread through your system and open doors to even more serious threats. That’s why multiple security layers are required to protect your environment.

7. Insider threats

While images of disgruntled employees may spring to mind, malicious intent is not the most common cause of insider threat security incidents. According to a report published in 2021, 56% of incidents were caused by negligent employees. [4]

Worryingly, the frequency of insider-led incidents is on the rise. The number of threats has jumped by 44% since 2020.[5] It’s also getting more expensive to tackle insider threat issues. Costs have risen from $11.45 million in 2020 to $15.38 million in 2022, a 34% increase. [6]

8. Compliance concerns

While some industries are more regulated, you’ll likely need to know where your data is stored, who has access to it, how it’s being processed, and what you’re doing to protect it. This can become more complicated in the cloud. Further, your cloud provider may be required to hold specific compliance credentials.

Failure to follow the regulations can result in substantial legal, financial and reputational repercussions. Therefore, it’s critical to handle your regulatory requirements, ensure good governance is in place, and keep your business compliant.

9. API Vulnerabilities

Cloud applications typically interact via APIs (application programming interfaces). However, insecure external APIs can provide a gateway, allowing threat actors to launch DoS attacks and code injections to access company data.

In 2020, Gartner predicted API attacks would become the most frequent attack vector by 2022. With a reported 681% growth of API attack traffic in 2021,[7] this prediction has already become a reality. Addressing API vulnerabilities will therefore be a chief priority for IT leaders in 2022 and beyond.

Check out our comprehensive guide to cloud security for more

 

Notes:
[1] 64 Significant Cloud Computing Statistics for 2022: Usage, Adoption & Challenges
[2] Majority of UK firms say cyber threats are outpacing cloud security
[3] Ransomware attacks in 2021 have already surpassed last year
[4] – [6] Insider Threats Are (Still) on the Rise: 2022 Ponemon Report
[7] Attacks abusing programming APIs grew over 600% in 2021

The Top 6 Business Benefits of Cloud Adoption

Posted on: 4 October 2022
The Top 6 Business Benefits of Cloud Adoption

Demand for cloud-based offerings has accelerated due to the COVID-19 pandemic, with the importance of flexibility and agility now being realised. Without adapting, businesses risk being left behind, but what are the benefits and how do you know if it’s the right solution for you?

In the first blog of our Cloud Security series, we explore the key advantages of cloud adoption.

1. Flexibility

Cloud infrastructure is the key to operational agility, allowing you to scale up or down to suit your bandwidth needs. The pay-as-you-go model offered by most cloud service providers (CSPs) also means that you pay for usage rather than a set monthly fee.

2. Reduced cost

Kind to your cash flow, cloud computing cuts out the high hardware cost. Not to mention the cost-savings of reduced resources, lower energy consumption, and fewer delays.

3. Disaster Recovery

From natural disasters to power outages and software bugs, if your data is backed up in the cloud, it is at a reduced risk of system failure as the servers are typically far from your office locations. You can recover data anywhere to minimise downtime by logging into the internet’s cloud storage portal.

4. Accessibility

We’ve all heard that the office is dead. Workers want the ability to work anytime, anywhere. With cloud (and an internet connection), they can.

5. Greater collaboration

Cloud infrastructure makes collaboration a simple process. The cloud can drastically improve workplace productivity, from online video calls to sharing files and co-authoring documents in real-time. These cloud-native applications are designed to make our lives more efficient through greater collaboration.

6. Strategic value

Ultimately, businesses that have adopted the cloud typically experience greater cost efficiencies, faster speed to market, and enhanced service levels. Adopting the cloud not only reimagines business models and builds resilience but also enables organisations to be agile and innovative, for example, adopt to DevOps methodologies which can prove to be an essential element for businesses looking to get ahead of their competitors.

But what about security? A 2020 survey reported that cloud security was the biggest challenge to cloud adoption for 83% of the business.[1] While the pandemic accelerated cloud adoption, rushed application and the resulting lacklustre security have only intensified security concerns as cybercriminals increasingly target cloud environments.

Check out our comprehensive guide to cloud security for more information.

 

Note:
[1] 64 Significant Cloud Computing Statistics for 2022: Usage, Adoption & Challenges

How to create a successful M&A IT integration strategy

Posted on: 11 March 2022
How to create a successful M&A IT integration strategy

IT integration woman looking at laptopFrom entering new markets to growing market share, mergers and acquisitions (M&As) can bring big business benefits. However, making the decision to acquire or merge is the easy part of the process. What comes next is likely to bring disruption and difficulty. In research reported by the Harvard Business Review, the failure rate of acquisitions is astonishingly high – between 70 and 90 per cent – with integration issues often highlighted as the most likely cause.

While the impact of M&A affects every element of an organisation, the blending of technical assets and resulting patchwork of IT systems can present significant technical challenges for IT leaders. Here, we explore the most common problems and how to navigate them to achieve a smooth and successful IT transition.

Get the full picture

Mapping the route of your IT transition is crucial to keeping your team focused throughout the process. But you need to be clear about your starting point. That’s why conducting a census of the entire IT infrastructure – from hardware and software to network systems, as well as enterprise and corporate platforms – should be the first step in your IT transition.

Gather requirements & identify gaps

Knowing what you’ve got is the first step, knowing what you haven’t is the next. Technology underpins every element of your business, so you should examine each corporate function and business unit through an IT lens. What services impact each function? How will an integration impact them? What opportunities are there to optimise? Finding the answers to these questions will help you to identify and address your most glaring gaps.

Seize opportunities to modernise

M&A provide the opportunity for IT leaders to re-evaluate and update their environments, so it’s important to look at where you can modernise rather than merge. This will ensure you gain maximum value from the process. For example, shifting to cloud infrastructure can enable your in-house team to focus on performance optimisation whilst also achieving cost savings and enhanced security. Similarly, automating routine or manual tasks using AI or machine learning can ease the burden on overwhelmed IT teams.

Implement strong governance

If you’re fusing two IT departments, you need to embed good governance early on. Start by assessing your current GRC (Governance, Risk and Compliance) maturity. A holistic view will enable you to target gaps effectively and ensure greater transparency of your processes. In addition to bringing certainty and consistency across your team, taking this crucial step will also help you to tackle any compliance and security shortfalls that may result from merging with the acquired business.

Clean up your data

Managing data migration can be a complex process during a merger and acquisition. It’s likely that data will be scattered across various systems, services, and applications. Duplicate data may also be an issue. This makes it difficult to gain an updated single customer view, limiting your ability to track sales and marketing effectiveness. The lack of visibility can also have a negative impact on customer experience. For example, having two disparate CRM systems may result in two sales representatives contacting a single customer, causing frustration and portraying your organisation as disorganised. There’s also a significant financial and reputational risk if data from the merged business isn’t managed securely. With all this in mind, it’s clear that developing an effective strategy and management process should be a key step in planning your IT transition.

Lead with communication

Change can be scary, and uncertainty is the enemy of productivity. That’s why communication is key to a successful merger and acquisition. Ensuring a frequent flow of information can help to combat this. However, IT leaders should also be mindful of creating opportunities for employees to share ideas and concerns.

If you are merging two IT departments, it is important to understand the cultural differences of the two businesses and where issues may arise. This will help you to develop an effective strategy for bringing the two teams together. While championing collaboration and knowledge sharing will go a long way to helping you achieve the goal of the M&A process – a better, stronger, more cohesive business.

How we can help

From assessing your existing IT infrastructure to cloud migration, data management and driving efficiencies through automation, we can support you at every step of your IT transition.

Transitioning your IT following M&A? Contact our expert team today.

Eight crucial steps for Telcos to get TSR ready

Posted on: 1 February 2022
Eight crucial steps for Telcos to get TSR ready

Following the introduction of the Telecommunications (Security) Act into UK law in late 2021, all telecommunications providers will soon need to comply with ‘one of the toughest telecoms security regimes in the world’ or risk financial penalties up to £10m.

With the clock counting down for Telcos to enter a new era of security, we consider the critical steps for providers to prepare for the regulatory road ahead.

1. Identify your gaps

Understanding your current state is the first step in achieving a successful transformation. A full audit of your security strategies, plans, policies, and effectiveness will expose your weaknesses and gaps, enabling you to take the right actions to protect your business and ensure compliance.

2. Prioritise your most pressing threats

While gathering data can provide better visibility of your network, taking reactive action to lower your risk isn’t the most efficient approach. Establishing levels of prioritisation will ensure your resources are being used to reduce risk in the right areas.

3. Get the right people in place

From gap analysis to operating model design, programme delivery, and reshoring, it’s likely you’ll need more people in place and new competencies developed. Getting the right partnerships and people now is key to getting ahead.

4. Incorporate legacy issues into your planning

Today’s telecommunications industry is built on multi-generational networks, and legacy systems continue to underpin critical infrastructure. While extracting these systems is not going to happen overnight, dealing with your legacy infrastructure should be an integral part of planning your implementation of the new Telecoms Security Framework.

5. Implement transparent designs

Failing to disclose evidence of a breach could result in a £10m fine, so built in transparency and traceability are key to your programme. Consider the likely information requests that are to come to ensure your design changes enable clear tracking and reporting.

6. Embed a security-first focus

Mitigating the risks facing the UK’s critical national infrastructure is the driving force behind the TSRs, and telecommunications providers will need to ensure that this mindset is embedded in the everyday. Buy-in from the business is core to any cultural shift, so align your leadership with a shared, cross-functional vision and get some early delivery going to build gradual momentum.

7. Prepare for more legislation

In November 2021, the Government announced The Product Security and Telecommunications Infrastructure Bill (the PSTI) to ensure consumers’ connected and connectable devices comply with tougher cybersecurity standards. As cybersecurity evolves, so will the threats to organisations, and telecommunications providers must be prepared for more regulatory oversight.

8. Embrace the benefits of built-in security

Ultimately, security that is built in rather than bolted on will enable providers to offer better protection and performance for customers, as well as foster trust with greater transparency. While the industry may not have been seeking the Telecoms Security Act, its passing prompt action to remove the constraints of old and reimagine and reshape to seize the opportunities of a new era.

For more information about TSR, download The impact and opportunities of the Telecoms Security Requirements report.

7 key things you need to know about the Telecoms (Security) Act

Posted on: 27 January 2022
7 key things you need to know about the Telecoms (Security) Act

The introduction of The Telecommunications (Security) Act into UK law late last year marked the arrival of a new era of security for the telecommunications sector, where everyone – from executive to employee – is responsible for protecting the UK’s critical network infrastructure against cyber attacks.

However, embedding a security conscious culture from top to bottom requires significant resource and expertise to steer towards success. With the clock already counting down, telecommunications providers are under pressure to begin their TSR compliance journey whilst ensuring that existing change programmes stay on track. Here, we consider the key considerations for communications leaders to ensure successful navigation and utilisation of the obstacles and opportunities that lie ahead.

Clear visibility is critical

Protecting your network, applications and data has never been more critical. However, blind spots, missing data, and the risk of dropped packets make management and protection of these challenging, not to mention the scale and complexity of many providers’ hybrid network infrastructure. Nonetheless, providers must ensure they are able to monitor security across the entirety of their network and can act quickly when issues arise.

Security and service quality will need to be carefully balanced

Whilst enhancing security is the ultimate goal of the Act, this cannot be at the cost of network performance. Outages themselves can put providers in breach of the regulations.

Security scanners are a key line of defence for network security, helping to identify known vulnerabilities which can be exploited if the correct mitigation steps aren’t followed, so ensuring you have a robust vulnerability management process is critical. Incorporating the right vulnerability scanning tools and following the required change management processes to correctly implement tools will help to secure your network whilst minimising any potential performance impact to your existing infrastructure or service outages.

Auditing abilities are a new superpower

Demonstrating compliance with the new legislation may pose a significant challenge to providers, particularly as they attempt to flow down security standards and audit requirements into the supply chain. However, implementation of robust auditing processes to identify and eliminate weaknesses and vulnerabilities are a must for keeping providers on the right side of the regulations.

Knowledge is power

With any significant legislature change comes a period of uncertainty as businesses adapt to change, so getting to grips with the new regulation changes ahead of the game is key. Many providers have already begun the search for talent with the technical skills and experience to deliver their TSR programmes; however, with the jobs market at boiling point, some providers may find utilising external partnerships provides a more practical route to successful delivery as well as a means to upskill and educate internal teams.

You’ll be tested

In 2019, OFCOM took over TBEST – the intelligence-led penetration testing scheme – from DCMS and has been working with select providers on implementation of the scheme. Whether through TBEST or not, providers will be expected to carry out tests that are as close to ‘real life’ attacks as possible. The difficulty will be in satisfying the requirement that “the manner in which the tests are to be carried out is not made known to the persons involved in identifying and responding to security compromises.”[1] Providers may need to work with an independent vendor to ensure compliant testing.

Costs are still unclear

While the costs for complying with the new regulations are still undermined, an earlier impact assessment of the proposed legislation carried out by the government indicated that initial costs are likely to be hefty: “Feedback from bilateral discussions with Tier 1 operators have indicated that the costs of implementing the NCSC TSR would be significant. The scale of these costs is likely to differ by size of operator and could be of the scale of over £10 million in one off costs.”[2].

Culture may challenge change

Technology will, of course, be at the forefront of communications leaders’ minds, yet the cultural changes required to successfully embed a security-first mindset are of equal importance and must be considered in equal measure. Change is never easy, particularly when there is a fixed deadline in place; however, delivery that is well-designed and meticulously planned is key. Ultimately, the onus will be on leaders to craft a clear vision – achieving network security that is intrinsic by design – as well as mapping out the road to get there.

Looking for more information about TSR? Download The impact and opportunities of the Telecoms Security Requirements report.

 

[1] The Electronic Communications (Security Measures) Regulations 2021 [draft] 

[2] The Telecommunications Security Bill 2020: The Telecoms Security legislation