Distributed Ledger Technology represents one of the more technically novel adoption decisions that the Security Consulting function will be asked to advise on, combining the genuine governance innovation that the decentralised trust architecture provides with the specific security risks and the regulatory complexities that the technology’s architectural novelty creates for the organisations whose existing governance frameworks the DLT’s distinctive characteristics do not accommodate without the specific adaptations that the Security Consulting function’s advisory must provide. The organisation that adopts DLT without the security governance framework whose design reflects the technology’s specific risk profile will encounter the security vulnerabilities, the regulatory compliance gaps, and the operational challenges that the inadequately governed DLT deployment consistently produces regardless of the implementation’s technical quality.
The Security Consulting function must advise on DLT with the honest assessment that the technology’s genuine governance value, particularly the tamper-resistant audit trail, the automated contract execution, and the distributed trust architecture, does not eliminate the security governance requirement but creates a distinct security governance challenge whose management requires the understanding of both the DLT architecture’s specific security properties and its specific vulnerabilities. The immutability that makes the DLT an attractive audit trail mechanism also creates the data governance challenge whose management the right to erasure’s GDPR requirement creates as the compliance tension between the DLT’s permanent record and the regulation’s deletion obligation. The decentralisation that eliminates the single point of failure also eliminates the central governance authority whose control the organisation’s security governance typically depends upon as the enforcement mechanism.
Understanding DLT Architectures #
The Security Consulting function must advise with the technical awareness that distinguishes the different DLT architectures whose security properties, governance models, and operational characteristics differ materially enough to demand the architecture-specific advisory rather than the generic blockchain guidance that the public awareness’s conflation of DLT with Bitcoin most readily but most inaccurately provides as the reference framework.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
