While digital currencies, particularly bitcoin, are the most common and well-known application of blockchain technology, they are far from being the sole or even the most important use. Blockchain is one of the most important technological advancements of the digital age, and its full potential has barely been tapped. Among the most exciting potential uses for this technology are cyber security and compliance applications.

What Is Blockchain?

At its simplest, a blockchain is a digitized, distributed public ledger. While it was originally developed to keep track of bitcoin transactions, it can be used for any sort of record-keeping, from health records to the requirements of a business contract. Each record (called a block) contains a cryptographic hash of the previous block, a timestamp, and transaction data, and the blocks are linked using cryptography.

Typically, a blockchain is managed by a peer-to-peer network that collectively adheres to a protocol for inter-node communication and the validation of new blocks. Once recorded, blockchain data is immutable. Blocks cannot be deleted, and if data is altered on a single block, those alterations must be verified with the rest of the chain. Hacking one entry in a blockchain ledger requires hacking every single transaction that precedes or follows it – and every change made to a block is appended with a digital signature or timestamp showing who did it and when. Finally, because the blockchain is distributed, it is not and cannot be controlled by a single entity, and there is no central point of access or failure.

It’s not difficult to envision the potential benefits of these features for cyber security and compliance. It would be extremely difficult to breach the data on a blockchain ledger or launch a DDoS attack against a blockchain DNS system. Because the records are immutable, data integrity is assured.

Practical applications of blockchain technology to cyber security and compliance include:

Identity Theft Prevention

Even in our digital age, reliable identity verification remains a problem. We establish we are who we say we are using one or multiple hard-copy documents or electronic records, from driver licenses to Social Security Numbers. All these records are highly prone to theft and forgery; even children are being victimized by identity theft. Using blockchain, we will be able to combine our current forms of identification into a “blockchain ID.” Instead of brandishing documents to verify their identities, people will produce a secure, immutable public key generated by a blockchain ledger. This will allow consumers to verify their identities without having to share their personal data, simplify identity authentication and make it more secure, and prevent identity theft.

Securing Healthcare Records

Just as it can secure our identities, blockchain can be used to secure our personal healthcare records and make sharing them easier and safer. Electronic health records (EHR) systems are major targets for cyber criminals, and there is still no secure, efficient way for healthcare providers to share patient data; patient records are scattered in different systems run by different facilities and providers.

EHR systems built on blockchain technology will benefit both providers and patients. Patients will have a comprehensive and secure record of their healthcare that is continually updated and can be easily and securely shared with providers. Providers will be able to access patient data more quickly, reduce medical errors caused by inaccurate or missing data, and have an easier time complying with HIPAA and other data privacy regulations.

Smart Contracts

Organizations worldwide are losing millions to business email compromise (BEC) scams. The U.S. Securities & Exchange Commission recently investigated a series of BEC attacks where hackers impersonated either a company executive or an outside vendor and convinced unwitting employees to wire money or pay invoices to accounts that the hackers controlled. In some cases, the victims had no idea they’d been tricked until the real vendor contacted them about the invoices being past due. Each organization lost at least $1 million, and two lost more than $30 million.

Smart contracts, also known as self-executing contracts, blockchain contracts, or digital contracts, will help prevent these types of BEC scams. Smart contracts are embedded with an if-this-then-that (IFTTT) code that automatically executes the contract’s terms once its conditions are met; for example, once a vendor completes work or delivers goods to a buyer, the vendor is automatically paid, and changing the payment account data would require validation from the entire chain.

Secure International Payments

Many organizations work with vendors located overseas. Currently, transferring money overseas is slow, cumbersome, expensive, and prone to error and criminal activity. A blockchain-powered payments system produces a secure, immutable ledger showing where the funds are and whose hands they are passing through, every step of the way.

Compliance Audit Trails

The immutability of blockchain records equates to a verified chain-of-trust and proof-of-process for compliance. Organizations can prove that they have secured their customers’ data and that they have followed specific business processes. Auditors and regulators can be assured of the integrity of an audit trail produced by a blockchain-powered system.

For all its promise, blockchain is not a panacea, and many of its potential applications are still theoretical or have kinks that need to be ironed out. However, it’s safe to say that the future of cyber security and compliance will be built on blockchain.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

SEC cyber enforcement action charges Iowa broker-dealer with “deficient cybersecurity procedures”

Des Moines-based Voya Financial Advisors (VFA) has agreed to pay the U.S. Securities and Exchange Commission a $1 million penalty in the wake of an April 2016 breach that affected several thousand VFA customers. The SEC cyber enforcement action charged VFA with not having sufficient written policies and procedures in place to protect customer information, as well as not having a written Identity Theft Prevention Program as required under the Identity Theft Red Flags Rule.

In addition to paying the $1 million fine, VFA agreed to be censured and to seek help from an independent consultant to get its internal cyber security controls in order. The action against VFA is the first SEC cyber enforcement action under the Identity Theft Red Flags Rule.

In the SEC’s press release, Robert A. Cohen, Chief of the SEC Enforcement Division’s Cyber Unit, had some stern words for financial firms and implied that the SEC cyber enforcement action against VFA is a harbinger of things to come as the SEC clamps down on firms that lack appropriate internal security controls: “This case is a reminder to brokers and investment advisers that cybersecurity procedures must be reasonably designed to fit their specific business models. They also must review and update the procedures regularly to respond to changes in the risks they face.”

The financial industry isn’t the only target of the SEC’s focus on cyber enforcement.

SEC Says Insufficient Internal Controls Could Violate Federal Law

Shortly after its cyber enforcement action against VFA, the SEC issued a report detailing its findings on an investigation into nine public companies that had been victimized by business email compromise (BEC) scams. The SEC did not identify the companies it investigated but described them as public firms spanning “a range of sectors including technology, machinery, real estate, energy, financial, and consumer goods,” illustrating that no industry is immune to cyber crime.

Each organization lost at least $1 million dollars (two lost more than $30 million) to BEC scams where hackers impersonated either a company executive or an outside vendor and convinced unwitting employees to wire them money directly or pay invoices to accounts that the hackers controlled. The SEC noted that the schemes where hackers impersonated vendors were more technologically sophisticated than those where company executives were impersonated because the hackers had managed to infiltrate the email systems of the victims’ foreign vendors and gain access not only to vendor email addresses but bona fide invoices. In some cases, the victims had no idea they’d been tricked until the real vendor contacted them about the invoices being past due.

The SEC became involved to determine if the organizations had sufficient internal accounting controls, as required by the Securities Exchange Act, regarding transactions and access to company assets. In the end, the SEC determined not to pursue cyber enforcement actions against the organizations. However, in its report, the agency directed public companies to consider cyber threats when implementing internal accounting controls and warned them that a failure to do so could violate federal securities laws.

The report noted the importance of considering both technological and human vulnerabilities when devising internal accounting controls. In each case the SEC investigated, it wasn’t a technological vulnerability but a human one that caused the BEC scam to succeed. While each organization had payment authorization procedures in place, the scams were successful because the personnel determined that the [phony] electronic communications were, in and of themselves, sufficient to send wire transfers or process invoice payments. Each organization has since made changes to its internal controls to add further redundancy.

The SEC’s cyber enforcement action against VFA, and its report on the BEC scam investigation, indicate that the agency is quite serious about investigating cyber crimes and exercising its cyber enforcement powers when necessary. Organizations cannot assume that their internal controls are sufficient just because they haven’t been hacked – yet. Regular assessments and active monitoring are necessary to ensure that existing controls and procedures still provide protection in a continually changing threat environment.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

NIST 800-171 Compliance Explained

If your company is part of the federal supply chain, you likely need to comply with NIST 800-171. NIST 800-171 compliance applies to contractors for the DoD, GSA, NASA, and other federal and state agencies; universities and research institutions that accept federal grants; consulting firms with federal contracts; manufacturers who supply goods to federal agencies; service organizations that provide services to federal agencies; and these organizations’ subcontractors.

What Is NIST 800-171?

NIST 800-171 is based on NIST 800-53. Complying with 800-171 automatically puts you in compliance with the majority of 800-53. NIST 800-171 is the first government security mandate to apply to both primes and subcontractors.

NIST 800-171 was created to address how government contractors should handle Controlled Unclassified Information (CUI), which is information that is not classified but still sensitive. What information is classified as CUI is defined by each individual federal agency, which must provide details to the National Archives and Records Administration. As a general rule of thumb, data that is considered sensitive under other regulations, such as credit card numbers or Social Security Numbers, would be classified as CUI.

What Are the Requirements for NIST 800-171 Compliance?

NIST 800-171 outlines 110 security controls grouped into 14 “families” of security requirements, including basic and derived requirements:

• Access Control: Limiting system access to authorized users and limiting user access to the types of transactions and functions they are allowed to execute.
• Awareness & Training: Ensuring that your staff knows how to handle CUI in compliance with NIST 800-171 and cyber security best practices.
• Audit & Accountability: Creating and retaining system audit records to identify unauthorized access.
• Configuration Management: Change management and maintaining secure configurations.
• Identification & Authentication: Identifying and authenticating system users and devices.
• Incident Response: Create a plan to respond to breaches and test it.
• Maintenance: Ensuring secure system maintenance.
• Media Protection: Securing hardware, such as portable storage devices, and paper records containing CUI.
• Personnel Security: Avoiding insider threats.
• Physical Protection: Limiting physical access to CUI.
• Risk Assessment: Conducting vulnerability scans and other risk assessments.
• Security Assessment: Monitoring security controls to ensure continued effectiveness.
• System & Communications Protection: Securing organizational communications.
• System & Information Integrity: Identifying and addressing cyber threats.

NIST 800-171 compliance must be continuous. NIST 800-171 compliance isn’t just about passing an annual audit; organizations must maintain their controls year-round.

Is It Too Late to Comply with NIST 800-171?

The deadline for DoD contractors to fully comply, or at least have a “system security plan” in place, was December 31, 2017. While the December 31 deadline was specifically aimed at DoD contractors, all federal contractors must comply with NIST 800-171. If you are not compliant, you risk losing your federal contracts.

Many small and mid-sized organizations missed the December 31 deadline, often because they felt they did not have the resources to comply. However, it is not too late. If you begin compliance efforts now, should your prime contractor, subcontractor, or DoD contracting officer inquire about your status, you can demonstrate that you have a plan to comply and are making progress with it.

Don’t let fears of time and cost stop you. Continuum GRC’s IT Audit Machine (ITAM) greatly simplifies the compliance process and significantly cut the time and costs involved, putting NIST 800-171 compliance within reach of small and mid-sized organizations.

Continuum GRC has also partnered with Gallagher Affinity to offer small and mid-sized federal contractors affordable packages that combine cyber and data breach insurance coverage with NIST 800-171 and DFARS 800-171 compliance services.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.