Blockchain Needed as Cybercrime Goes Corporate

The early days of cybercrime were a simpler time. What was once largely the domain of individuals — with agendas running the spectrum from curiosity, to mischief, to anarchy, to crime — has become more organized, more specialized, and far more difficult to protect against. Cybercriminals are going corporate, as are state-sponsored organizations.

Fortunately, blockchain technology can provide much-needed assistance by providing immutable root-of-trust hardware identity and reputational tracking. But before looking at blockchain, let’s take a deeper look at the complexity of today’s cyber adversaries.

Call Center Support for Hackers

You don’t have to look far these days to see media reports about the extent to which cybercriminals are mimicking the structure of straight businesses. They have offices, job titles, and departments. They form partnerships and provide service-level agreements.

Some groups that sell hacking tools actually provide warranties and call centers to field questions and help with troubleshooting. Imagine what some of those phone calls must sound like: “Your instructions aren’t clear on how to erase the evidence of my intrusion after I download the stolen data. Could you please help?”

The sheer number of hackers —facilitated by ready-to-run hacking tools available online— is even creating market saturation problems. Free market economics are reportedly sending the price of stolen credit cards down, the same with DDoS services.

Meanwhile, on the state-sponsored side of things, there are reports of Chinese hackers who wear uniforms, sleep in dormitories, and complain that they aren’t making as much as their friends in straight businesses of the private sector. Imagine a desolate hacker thinking: “Mom was right. I should have become a lawyer.”

The problem of hackers and other bad actors is global, and getting worse by the day. The fact that many organizations are beginning to look and act like big businesses simply provides yet another example of the ever-greater challenges that hackers pose to computational resources around the world.

And the IoT Makes it Worse

Against this backdrop of dormitories filled with uniformed state-sponsored hackers and corporatized bad actors offering trainings, warranties, and call centers to gain criminal mindshare and market share, the velocity and sophistication of attacks is expected to continue its steep upward trajectory — aided, at least in part, by the rapid growth of the Internet of Things (IoT).

The IoT, the vast collection of sensors, monitors, and other devices that are deployed in our homes, offices, automobiles, hospitals, industrial settings, and just about everywhere else you can imagine, has become deeply ingrained with the fabric of our daily life.

Gartner estimates that there are already some eight billion IoT devices deployed in the world, with that number expected to more than double to 20 billion by 2020. These billions of devices make attractive targets for hackers and other bad actors, because they generally exist beyond the protective defenses of firewalls. And, because they are resource-constrained, most simply can’t support the kind of security stacks that protect our servers, laptops, and smartphones.

How Blockchain Can Help

Blockchain technology provides a much-needed addition to the world’s security toolkit because its sequential architecture—assembling information in a series of interlocked data blocks—and its public visibility, through decentralized storage, make it ideal for establishing immutable records.

Immutable records, combined with unique device identifiers, ideally involving cryptographic keys, would enable organizations to establish root-of-trust hardware identity for IoT devices. Identity could be tracked from the point of manufacture, through distribution, to the point of device activation, and onward through the working life of the device.

The same blockchain technology can also be used to track a device’s reputation—as reported by the other IoT devices it interacts with. Devices could be configured to validate the reputation of other devices prior to engaging in transactions. Reputation tracking could yield a numeric value, perhaps similar to a FICO credit score. Reputation tracking, combined with machine learning and artificial intelligence (AI), could create a smart ecosystem in which behavioral patterns of a device were known, and aberrations from the norm could trigger an alert.

Users — whether a homeowner with a smart thermostat, a hospital administrator protecting insulin pumps, a city engineer deploying smart city devices, or a plant manager working with industrial IoT—could set their own parameters for reputational ratings, depending upon the security required for the application and deployment environment.

Immutable identity, combined with reputation tracking and machine learning, should give organizations the ability to provide the kind of real-time detection that is essential to securing the billions of devices engaging in trillions of autonomous device-to-device interactions within the Internet of Things.