Blockchain As A Security Brick For Software Applications - Owasp

BLOCKCHAIN AS A SECURITYBRICK FOR SOFTWAREAPPLICATIONSBLOCKCHAIN [FOR] SECURITY WEBINAR – OWASP - 5/12/2020

WHO’S WHO Head of Life-Insurance & Post-Trade Software Development 18 years experience : System Engineer, DBA , DATA Architect ,Software Dev Manager & Blockchain Enthusiast since 2014 My N/SBELHADJ/12/5/20202

AGENDA Blockchain Definition (Technical/Conceptual)Blockchain or How to clone Physical transaction to Digital transactionDistributed Database vs Distributed LedgerBlockchain & Internet OF VALUEBlockchain Security DesignBlockchain Security for IOTICO Dapp 3

BLOCKCHAIN DEFINITION (TECHNICAL) Append-only Distributed Database (Ledger) shared between multiple nontrusting writers without the need for a Trusted Central Authority. The data integrity of the Ledger is guaranteed by a Distributed LHADJ/12/5/20204

BLOCKCHAIN SOLUTIONS3 BASIC COMPONENTS:1. A data model that captures the current state of the ledger.2. A language of transactions that changes the ledger state.3. A protocol used to build consensus among participantsaround which transactions will be accepted, and in what order,by the 0205

BLOCKCHAIN OR HOW TO CLONE PHYSICALTRANSACTION TO DIGITAL TRANSACTIONImenSamiImenSami Easily Verifiable. No need for a third-party to validate the transaction. He can even add to his account whenever he wants. Imen does not have the money anymore and Sami He can impose high commissionshas it in his hands. Instant transfer of the assetHTTPS://WWW.LINKEDIN.COM/IN/SBELHADJ/ What if the third trusted party duplicates the asset?What If his service is hacked : service unavailable(SPOF) The end user does not have the 12/5/2020means to check by6himself

BLOCKCHAIN OR HOW TO CLONE PHYSICALTRANSACTION TO DIGITAL TRANSACTIONBlockchain TechnologyTrusted third-partySamiDali Same Rules Consensus Algorithm Single source of TruthImenImen What if the third trusted party duplicates the asset? He can even add to his account whenever he wants. He can request high fees What If his service is hacked : service unavailable(SPOF) The end user does not have the means to check byhimselfHTTPS://WWW.LINKEDIN.COM/IN/SBELHADJ/Sami The Ledger is no longer owned by a single entity Validation and verification of the Ledger is no longer a monopoly Consensus rules guarantee the security of the Ledger12/5/2020 The end-user can even participate in maintainingthe Ledger 7(the purestversion of the BC) Actors are incentivized to act "ethically"

DISTRIBUTED DATABASE VS DISTRIBUTED LEDGERNodes of a distributed database trust eachother and collaborate with each other topresent a consistent, secure truth to the rest ofthe world.Paxos, Raft, Distributed DatabaseIt’s All About the TrustBoundary!!!PoW,PoS, HTTPS://WWW.LINKEDIN.COM/IN/SBELHADJ/Distributed Ledger (Blockchain)Nodes of a distributed ledger(Blockchain) can not trust each other and somust independently verify data they receive fromeach other and only share data they are happy to bebroadly shared.12/5/20208

BLOCKCHAIN DEFINITION (CONCEPTUAL)Blockchain is a paradigm shift in the way we approachdesigning economic systems involving multiple peers withdivergent interests ( zero-sum game) but find it profitable to bepart of the same system.The traits of such systems are : Decentralized , governed by rules but without rulers : Protocolsinstead of Platforms. Trust is derived from the network not from hierarchy (Trustless). Transactions are secured by 12/5/20209

BIG SHIFT IN BUSINESS MODELS DESIGNSBusiness models are increasingly based on the reduction of intermediariesPlatform EconomySharing EconomyP2P 0202010201510

BLOCKCHAIN & INTERNET OF VALUE Blockchain is the last Brick in the Internet protocol that allowed Internet to moveValue between 011

EMBEDDED SECURITY IN BLOCKCHAIN DESIGN Internet was designed without security as a priority Only aresilient network!! Blockchain protocol was designed with security EMBEDDED in itsCORE (BFT in practice, identification , encrypted transactions, ) Internet security was implemented at the Application protocol Level. Blockchain security is implemented at the low level protocol 2012

DAPPS SECURITY REQUIREMENTS Identification & Authentication Cryptographic identity Data Integrity Encrypted transactions coupled to CommonConsensus mechanism Data Confidentiality Zero-knowledge proof / Homomorphicencryption Data Ownership/Control Distribution of 13

BLOCKCHAIN SECURITY FOR IOT The Distributed character of IOT networks makes it a good candidate forBlockchain technology Blockchain, which is most familiar for bitcoin and Ethereum, offers anintriguing solution for IoT security. Blockchain contains strong protectionsagainst data tampering, locking access to Internet of Things devices, andallowing compromised devices in an IoT network to be shut 014

ICO DAPP 15

DApp reference 2/5/20201616

StepsStep 1 : Setting up the environmentStep 2 : Writing the Smart ContractsStep 3 : Compiling and deploying(migrating) the SmartContractsStep 4 : Testing the Smart ContractsStep 5 : Creating the Front-endStep 6: Using the 1717

Creating the /20201818

Step 6 : Interacting with the 1919

BLOCKCHAIN SECURITY FOR IOT The Distributed character of IOT networks makes it a good candidate for Blockchaintechnology Blockchain, which is most familiar for bitcoin and Ethereum, offers an intriguing solution for IoT security. Blockchain contains strong protections against data tampering, locking access to Internet of Things devices, and