Cybersecurity for Enterprise Blockchain Solutions

Transcript

do let's uh let's kick up this uh online event and um yeah as i said i'm jerome bailey i'm a board a member of the crypto valley association welcome everybody to this um online event dedicated to silver cyber security for enterprise blockchain solution um as you know the hurt of the crypto value association uh is its working groups we have seven uh different working groups within the association and it's really where the the members uh our members or individual members of people gather to create um the real added value of the association uh this association crypto valley create many

two main types of content paper blueprints with best practices and event online and on site and today it's really big day for our association because it's the first time that two different working groups worked together um the cyber security working groups and the enterprise blockchain working group they worked together to produce this blueprint on enterprise blockchain solution cybersecurity and yes thank you to every all contributor that will be in this panel tonight um also thank you to the corporate members which made this uh project possible like

anubum fortinet sysac and excellence yeah if it's your first time you attend a cva online event enjoy get the most of the panel and of course ask don't legit to ask your question uh during the interactive um session um and yeah if you uh find it useful for you feel free to to join on cryptovalet.swiss everybody is um is welcome and uh yeah now i ended to over to marcus perrissa with a co-chair of the cyber security working group to you marcus there goes my advice line first line already thanks jerome

i'm marcus perez the co-chair of the cyber security working group at crypto valley association the mission of our cyber security working group is to increase trust in crypto assets and blockchain through the development and publication of best practices and when we got started three years ago we laid out three main areas that we do this in first we published about the safety of digital assets focusing on custody and private keys second we released important information about the security of decentralized applications smart contract development but it's always we've never succeeded in actually doing

something around secure blockchain applications and finally with the help of the enterprise blockchain working group when we joined forces we've had all of the knowhow that it takes to release a secure cybersecurity best practice for enterprise blockchains so here we are thanks everybody who contributed and by the way we are recording the session i see a few people ask this in chat okay thank you very much marcus i take over my name is denis vlad i'm the chairman of the chair of the enterprise blockchain working group and i'm very honored to uh lead this panel tonight and i feel as well very honored because

we have today except the one person who could not make it all the authors of this blueprint that we did together uh today and um and i quickly want to introduce everybody we have on one side from katarina lazotta heller who is working as partner at lexcellence which is a legal company for legal and compliance questions and is as well the president of the swiss polish blockchain association and we have uh natalie leonard with us a security um expert from the company

sysec which operates uh computing solutions enabling the secure collaboration between companies in the cloud and including as well the production of all these data in in the cloud environment then from our partner corporate partner at novo we have michelle sally and moritz kuhn i think i know known name as provider of consulting security consulting software solutions and identity access management solutions here and and frederick uh

malaya partner at forty nick uh fortinec an international provider for security solutions in the borderless for borderless networks for large enterprises governments and service providers and last but not least gianluca toddy from from italy who is from alicia gada and which is as well doing compliance international regulation solutions in the blockchain space with us they all contributed to the paper and i'm very happy so you see in the chat as well the link to the paper it will be as well published tonight actually

on the uh on the uh crypto valley website and very good reading but let's start with the panel discussions and i would like to start with you freddie rick and um just ask you a little bit from from your perspective i mean what are the key challenges in the enterprise uh blockchain space concerning cyber security thank you dennis happy to be here so yeah we see multiple multiple fights when it comes to enterprise blockchain the first one in term of challenge we see a real challenge when it comes to access

control and privacy we know that it's important that every participant in the blockchain must be protected from unauthorized access so this this whole problematic of access control and privacy uh is widely covered in the blueprint because uh it's it's one of the the key challenge the second challenge we see is about managing the keys uh when we talk about blockchain obviously we talk about uh having the right crypto capabilities to uh to ensure integrity so here there is a whole topic when it comes to securing the key management we see also a challenge when it comes to a

distributed denial of service which is a type of attack which could compromise the efficiency and the speed of the blockchain uh exchanging blocks along the chain and last but not least it's more human factor here uh when it comes to private blockchain at the enterprise level um we see that when when hackers sees that enterprise are deploying this kind of technology it's it's really a source of interest for them trying to hike the system because they know that there are some uh let's say some interesting interesting um

uh let's say interesting things behind the blockchain to be to be broken so for four areas where we see we see a real challenge here in terms of cyber security yeah uh thank you moritz and then michelle you you call also actually a chapter um on membership and identity management and uh freddie was just referring as well to that that it's a key challenge in in enterprise blockchain solutions um what what do you what is your view on that what are the challenges and what is the the difference between an enterprise blockchain solution and a traditional public blockchain

let me take let me answer that question um the basic difference is that participants in an enterprise brokerage solution um have to be registered and identified and that leads to a number of challenges um quite obviously traditional identity management and we have to manage these identities of the participants it doesn't doesn't work in in such a solution um a central identity provider is exactly what we don't want but also a federated identity management does not scale especially if you have many members so we have to find a way to

manage identities in this in this distributed system um we also have to find a way um how we distribute control over a common trust anchor so we normally need an enterprise brokerage solution we need a trust anchor to start with and of course we don't want to give control over this trust anchor to one party we have to distribute that and then we have to find a way to model and represent both membership as well as privileges in a way of distributed verifiable claims in such a system i would say when it

comes to identity management these are the core problems um we have to solve thanks thank you um katarina um you you you've brought into the paper the more the legal view which is uh an important uh uh aspect to to when we talk about uh security and and cyber security because that has always as well attached to um data protection law the gd pr uh the european general data protection regulation is of course impacted in

in by by these security aspects so can you please tell us a little bit what your key findings concerning gdpr and its impact on enterprise blockchain solutions is thank you hello everybody firstly i need to say one thing there is also um another working group which is represented here today it's not only enterprise but also regulatory group where i'm from so thank you very much for inviting me to join the the panel and also to to to contribute by there by the paper and in fact i also chair task force in our regulatory and working group which is

basically dealing with data everything which is related to data data protection and then before i will tell you a little bit what the what the gdpr problems and challenges around blockchain are i want to make sure that we understand few things firstly when i'm we're talking about privacy in blockchain i want you to understand that we're talking about compliance requirements which are put in certain data protection regulations and not necessarily talking today about privacy which sometimes is invoked especially in relation to cryptocurrencies when certain people understand the way how

they protect their identity towards requirements of aml related regulation like an anti-money laundering regulation so we will be talking today about gdpr and issues of problems which are which which arise from the from the from from from gdpr and data protection regulations and then we need to understand four definitions which are very very important to understand the whole idea firstly we need to know what is data subject data subject is every natural person like you all guys and our guests today online whose data are basically

uh processed let's put it like this so that's important because the data are protected by the by certain regulations second we have definition which is called data controller is somebody who defines the purpose of why the data shall be processed that's important as well second we have data processor this is somebody organization which process the processes the data on behalf of data controller and finally we have something what is called data and data which is protected which the gdpr is dealing with this personal data is basically the data which relates to any kind of information

which identify um all relates to every person which might be identifiable basically so those four definitions are very important to understand what we'll be talking about when i told you we have this data controller so it means that we have somewhere central function and this is the first finding we have clash between blockchain and gdpr requirements because gdp requirements like every known data protection related regulations on the world um in force now relates to kind of centering organizations centric requirements there must be somebody who is responsible for

compliance when in relation to blockchain is by definition we have decentralized organization and this is more true in relation to open to public blockchain and less true i would say or maybe that's not the wrong the right um term but it's it's a little bit different situation in enterprise based blockchain when we have somebody who as um frederick said at the beginning we have situation that we have registered users meaning somebody letting those people in into this blockchain and somebody is executing some kind of governance about them so

there is the first finding there is tension between gdpr requirements and blockchain because one is centric another is by definition decentric but it's a little bit different than in in relation um to to um to blockchain enterprise based blockchain then we have issue of jurisdiction where actually our notes are located which low shall we apply then we have issues which are related to so-called right to be forgotten is it really possible to erase data is it really possible that our the personal data

will disappear from the blockchain then the whole idea about blockchain is to make sure that the data will stay and nobody can decide outside of the consensus about basically erasing or deleting the data so there are many many different tensions basically challenges but still a very fascinating topic and let's see how the legislation will develop here thank you uh katrina you you mentioned something the data and data protection and data probability i mean one thing i found at this blueprint very interesting is that we looked at the cyber security uh topic in enterprise blockchain solutions from a

very different angles to it and you had the data protection aspect and and jaluka actually was looking at a totally different aspect to it which is as well important in cyber security which is actually that how you bring in especially in enterprise solutions uh the the data into the blockchain enterprise blockchain solutions it's always about transactions and exchanging uh data between members in there but this data that is all you often as well certificates goods um services that are there and they need somehow to be digitalized and already that could be an action for fraud uh in there and and look at so so what

are what are that that aspect of your chapter what were the key challenges in issuing digital assets actually yes i think first of all the point is uh looking what is native digital so if something is native digital is created already as a digital asset like a piece of music or or a digital heart this of course is born digital and can be with the proper mean transfer to another owner or transfer is value to someone else another situation is when you have a real physical asset like a piece of land or a house or something like that so you have to

transfer this piece or create a like a digital twin which represents that goods and then be able to transact that good into the digital world which of course bring a lot of new uh power or a lot of new option uh also from the commercial or market standpoint because goods with before were pure physical can be transact or can be uh can expand their market as well uh uh around the world so this is brings new uh of course uh um chance for for for uh for for business or for people to uh have uh or participate in this but it brings also new challenges to protect

what is behind this good or if the good is properly represented so for the digital asset it might be easier to because it's born digital and it can be a sign if is for example is born inside a platform which takes care of doing the proper assessment and the proper checks it can be then fully tracked for a physical good of course right now you have also to deal with local legislation and lock a rule and implement the practice in order to to because at the end it comes down to who is the owner and where is the good and who is now owning it so and for that of course you have to to have a proper infrastructure to track

that yeah okay okay well natasha you you were probably the one that that wrote the chapter that i at least um understood uh the most little about it because it is really about the hardcore of the of the idea of the security i mean you are a security researcher just recently um finished your master degrees and and and in that cyber security space what what do you see as key challenges for the enterprise space now coming from the security okay i think like the

first big challenge is how to secure the the key and all the the cycle of the keys the generation the the use and um after that if we lost the key the backup uh because um if an attacker of your private key you can use it to do some transaction or sign whatever so i think security management was is the most challenging um

challenging in us in a security way then is uh we want to able uh deny of of service we wanted the availability of the blockchain of time and not that an attacker tried to to i don't have to say that but to yeah just like the other idea of the blockchain to be sure that we have the block shell available when when we want and uh theoretically another challenge

is the privacy to make sure that the only that the people want to access the direction of access and not the other people that's as well a good bridge actually over to moritz and michelle again because that was core part of your chapter uh the identity identity on the authentication management actually or of an enterprise blockchain and and here i think it is as well a key challenge that especially in enterprise solutions where you you know where actually you have dedicated members in the blockchain that are

collaborating to deliver an enterprise uh joined value chain so suppliers and buyers and uh and and and probably as well uh notaries that are that are coming in or intermediaries that do certain certain jobs like harbors or shippers and and so on so many parties are participating in such enterprise blockchain solutions and so what what would be you know it's the things that you see we would say we need to consider very um as very important in the identity and access management area

who wants to take it michelle or moritz uh i think i will take it or what do you mean please go ahead okay so i would think that the important things is if you have a lot of candidates that as maurice said uh earlier that you have a trust anchor do you have one entity that is most essential that you can trust that could be for uh if you need some heavy processes like kyc to be sure that one person is the person that should be and if you have one central per uh central trust anchor everyone can correlate with

that one to be sure that's the right person and you can just add more person with the trust anchor you just have to make sure that the consortium is agrees with that okay um we just have a question in uh in the chat and uh and i just wanted to say if you have a question this will be an interactive session and the audience should be as well possible to place questions please type it into the q and a session and i will then read it out to uh to the people and there was a question about uh uh were as well antitrust violation issues addressed in the white paper

uh from johannes and i well i think we have not a dedicated chapter to the antitrust violations there but um we probably looked at it from different different topics i mean antitrust could be as well looked at it for from from from different uh different angles that could be the topic that uh januka uh was looking at okay how can we do antitrust in in capturing and digitalizing uh digital assets etc uh but we looked at as well at it from a from a governance perspective um because when you when you when you define here

cybersecurity uh standards and and business rules for example in a in a blockchain in an enterprise blockchain then this needs to be as well uh defined in an improper way in an in a neutral way for the participants we heard before from michigan for example uh the the the organization model of um of consortiums which a lot of enterprise solutions have there and of course there you certainly start with antitrust okay a consortium that decides okay who can actually participate in the network and who is not allowed to participate in the

network and how how you manage these kind of aspects and that has been as well uh captured in in a in a chapter uh on governance and how to how to manage actually the governance um in in an enterprise blockchain solution and especially there and that is probably even as well important as the anti-trust violation risk that you have which is probably not a cyber risk there but of course you have a huge counterparty risk that you need to manage in these enterprise blockchain solutions as well because often in enterprise blockchain solutions

if it is a digital asset as john lucas said before um you can probably do the transactions really immediately between the different parties but as soon as you have another good a physical good that gets exchanged and you have actually the shifting of rights that are um shifted in an enterprise blockchain solution then that's where a counterparty risk actually happens because somebody needs to ensure that you are as well really receiving those those physical products at the end uh what are your thoughts on that general cut yes i think this is not an easy question first of all and this also probably a part of the setup of this

enterprise solution to define who is able to uh take this uh rule or or make the rule how the things are transacted or how the verification of the the goods is is made so probably is um yeah part of this uh uh situation for uh as well uh uh i mean in in the industry for example you might also consider to integrate that via some uh tool or some for example if you are looking to to get information on an inducer process you can have some iot which takes the information so this is something that of course is not possible to to tweak

but yeah on on things which rely on an initial physical uh presence of a good or or of um as you said before a land or house or a physical asset of course right now uh probably you need to also deal with the the local legislation and the local authority uh or involve them in the process to to make this more uh i mean safe or at least reliable nowadays all the same so we need in one way as well a little bit of even in a decentralized network we need some kind of centralized yeah let's say governance structures and

and legal uh backbone actually uh to make sure uh which brings me back to you katarina what what other challenges in enterprise blockchain solutions from a from a legal advisor perspective uh learning cybersecurity aspects as well do you see that we need to consider different they are different challenges basically and one thing is what i started mentioning the rights to be forgotten if you go through the gdpr regulation you won't actually find them right to be forgotten israelite the term we just called it every data

subject every of us has a right to that his or her personal data will be erased basically so they will disappear and then we have a one challenge which relates to the how we make sure on blockchain that the data will be really rest so is there is a erasure basically possible at all so that's the that's not only technical question but this also governance and legal question they are in the meantime many cases of court of justice of european union which says what could be actually considered the data are really erased how you want to make sure that between that this those different notes that it will be really erased on

every single note and in relation to this to to to somehow close um blockchain um network like enterprise network it's probably easier again to to to comply with those regulation and also to find somebody who is responsible for that erasure but um they're very different outcomes it does not necessarily has to be erased it could be put beyond used it could be anonymized um french legislator has the view that it could be basically the private key might might be destroyed and then we have the the razor of data so it's the one challenge basically that we don't have a common

approach how to make sure that the data are actually erased second one we have another issues um let's also let's come back to the question of um of the anti-trust issue i brother would say it was probably a question of competition not necessarily anti-trust to invoke anti-trust and law regulated regulations it needs a lot it needs to have a very strong position on the market needs to have monopoly basically situation on the market but here is the issue on competition or maybe discrimination why we letting one some certain people to be in in this permission blockchain and certain not what's the governance what the

conditions so that's another issue another one all over existing at the moment our financial and market law related regulations uh bank law and security laws all of kind of um you know whenever you take somebody's money or virtual as virtual assets in under you power of control there will be certain regulations invoked which relates to financial market authorities and their way how they treat the regulation we have issues related to copyright laws we have perhaps one license of use and then

the copyright related content is spread to all of on all of the nodes and then if we have a judgment saying hey you need to raise the the content then you have a problem ask the administrator of blockchain of enterprise based blockchain to make sure that the content will be deleted on every and single node so different legal challenges but it's also very fascinating times we living now and let's see what what we will see and come next basically yeah you said an important thing with the the right to be forgotten and which is what brings us to the thing that you have not only the

onboarding aspect which i think we're going to talk in a second uh about it but we have as well the off-boarding aspect into enterprise uh blockchain solutions and that is something that uh michel and morris have as well covered in their in their section um that the the revocation of privilege in a blockchain and the off-boarding or an enterprise blockchain solution um can be an issue or is an issue that we as well need to take care about uh cyber securities and katarina already mentioned a couple of points that we need to consider what is your view michelle or moritz what else do we need to consider there

what we what we want to achieve is we want to map privileges of the participants to individual credentials um to represent for example a membership or that a participant is an insurance a regulated entity allowed to sell liability insurances for example or that a participant is a medical doctor and we want to have these um these credentials um for three things we want to have them to be sure about the identity and the authenticity of the counterparty and these transactions

we want to be sure that our counterparty in a transaction is a valid member of this enterprise production solution and we want to be able to check if this counter party has these required privileges depending on the role or roles that this counterparty plays in this transaction and now what we need we need a way to to react to certain scenarios when it comes to revoking privileges um the easiest probably is if if some participant terminates the membership then we have normally a lot of time to really handle this revocation of the credentials um another scenario is if we have to temporarily

revoke privileges say if the credentials of a participant have been compromised and then of course we have the scenario where we either temporarily or permanently suspend membership say in the case where a participant has conducted a preach of the governance and we have to react to that and especially in the second two scenarios we have to be able to act fast and to act without the collaboration of that participant so we have to design the system in a way that we can achieve that that we can make sure that we can in the transaction verify the aspects are set and that we can revoke those credentials and to

prevent further harm and i think you as well and now that's more to michelle i think and you wrote as well that for such identity management and authentication of the users in in in enterprise blockchain solutions you were referring them to self sovereignty identity ssis and [Music] what are they already you know can you quickly explain us a little bit where you see then the benefits of using uh such a solution in enterprise blockchain solutions yeah sure one thing maybe is

you maybe heard of ssi with the eid the swiss eid project where they want to give digitized id card of swiss people based on ssa principle but in other case ssa is really a new generation of identity management and a solution that would make the digitalization easier for everyone and essentially it's that the identity is now centered around the user so user represents a digital identity and manages some self

to make an example it really feels like processes that we already have for example for the swiss passport if you want one you go to a government hrc say check your identity give you your physical passport but then if you want to show or present your identity you can give the passport to someone he checks it and it's all right now if you check with the ssi process you start exactly the same go to the government agency say check your identity this time you receive your judgeship passport that you can store on your smartphone so

you have to manage it yourself and you have the power to show to other or not your identity and if it's the case you can just open your smartphone and for example let someone order scan your qr code the main the first benefit and that's also one of the novelty is that unlike federated identities someone can check your identity within having to contact the government it's really like in the analog process where you just check the passport you don't want to call the government just to check if it's really you or not so with ssi you can just validate the

identity or a claim without contacting the person that gave it to the user and secondly what is really an important point to facilitate that is based with privacy by design is that you can do you can choose which information you want to share with others so in case if you want to check if someone is 18 or more you have the first possibility to just share that information you don't have to share every information that is on the passport so you only share your age and in addition you can also ask if a person is overrating you don't have

to send the birth date so you can just say is he or she more than 18 years old yes no and the last benefit that i see is that the protocols of ssi are standard standardized and everyone basically has the same identity resource which means that integration becomes very easy if you have an enterprise blockchain solution and you want to add an enterprise and all its employees you could just wait list the claim that you are an employee of that new enterprise

and then basically you just added an enterprise to the whole um enterprise blockchain solution or another part we talked about right to be forgotten maybe some information don't need to go to the blockchain so you can think of like the the eid that's one information that the user can keep by himself and when for example if you want to migrate users from enterprise a to b the user can just share the data again with enterprise b and revoke the data that it shared with enterprise a [Music]

frederick i mean that says you you manage fortinet some of really large networks um that area and the access and uh identity management i mean that must be a a permanent topic in your in your in your field what are your experiences there and uh are you as well applying ssi solutions that are successful or what what do you know what you can yeah yeah in my interactions with our customers of course uh access to the network and access to resources is a paramount uh concern

so we we we have multiple solutions in our let's say you know in our ammunition here when it comes to uh protecting access to uh to confidential data and ensuring the verticity of the of the of the different let's say different users are accessing the blockchain um big big source of concerns here um now we see also that it's a multi-dimensional problem here we see also i wanted to to discuss in my introduction to discuss about dealing with service we see we see also this as a big big threat when it comes to uh to enterprise uh blockchain

because due to the nature of the blockchain which is a distributed uh architecture those those architectures are very very um exposed to deal of service maybe i should explain a little bit what it's all about distributed distributed service it's it's an attack it's an attack which is floating uh with volumes with packets the different systems or the different endpoints into the chain which is slowing down the processing of the transactions in the blockchain and and this is this is something that we see more and more we have our our threat intelligence specialist looking at looking at that and and we see that those solutions or

those those type of attacks are more and more prevalent when it comes to enterprise uh blockchain for enterprise okay thank you we have the a couple of uh questions in in the in the qa section as well and one is um well when we when we uh come back to i mean quickly about uh concerning roberto the question are there any ssi products that that are worse to to know and that that he could play around a little bit with it so i don't know misha if you can recommend there something then you yeah sure i mean um one thing that i didn't

mention are also a bit the challenges that come with ssi currently and that perhaps give a more clear view but the components that you have now are mostly fought for prototyping which is essentially a good thing because you can check how does ssa integrate in your process how will the usability be of your products if you integrate ssi and how the do your user accept it because it's it's not similar to the things that we already have and you have the first

iteration of standards as i said that you can use for prototyping in ad novum we have some parts if you want to contact us we can try to set you up with the components and you also have uh wallets that are uh that you can download for the google play or the apple store to play with okay yeah and then we have another question in in the q a session and please if you have questions your audience then please please write them in and kiran actually asks who would be when we come back to the digital identity here who would be as well

liable if somebody was stealing at the digital identity and what would happen then there and what would be the costs for something like that and something like that would happen i know somebody wants to take that question i will take from the legal perspective maybe because it's important to do that you guys will understand the difference between enterprise blockchain and open blockchain like put it like this and the definitions with it which i told you at the beginning i told you there is somebody who is called data controller data controller is the centering organization which is responsible to make sure that we have compliance with data protection regulations

including security of data and on the open blockchain is very difficult to say who is the liable part basically because we have all of those nodes operator of nodes and they may be even treated as joint controllers as though all of all of them will be liable if such bridge insecurity will happen obviously if if this is possible to prove that there were lack of there was not enough security and in place now when we look on this enterprise enterprise blockchain we may think okay we have somebody who is making sure that the governance is around one

is within one organization then we will have one mostly data controller and that person the one who is organized the whole enterprise blockchain might be keep liable for bridge breach of security in such case in relation to the cost i can only say what could be the fees what might be the what could be the damages they all in relation to the to the defines they are in gdpr they might be quite high but um in relation to to other costs let's say the technology related costs i cannot comment on on that stuff basically

so perhaps somebody else will take it from here i mean the the well probably from another angle um from it i mean uh natasha you you your chapter i mean you you you talked as well about protecting keys that was it that was the main main topic and um i mean the key is as is in some of the use cases it is really the the one that identifies you [Music] and it is like you're your actually identity in the network that you are allowed to execute a transaction that

you are allowed to to access certain information etc etc and i mean can you really say i mean this the question from kieran was also you know okay how can we really make sure protection and who takes the liability so probably from a technical perspective if somebody would like to access my keys and breaches and enterprise blockchains system of protecting the keys first of all what are the kind of measures how you how you really can protect it i mean you wrote about multisig and multi-party uh computing in in your document and and second of all

who takes actually the reliability uh for for that they are then protected when such security measures are implemented um okay so yeah i i speak about multi-sig and multi signature sir sorry sorry i just um i can hear you anymore that's it you're saying something great uh

can you just uh repeat the question because if um i mean first of all i mean the key is like your identity in the network and the first part of the question was of course okay what kind of measures do you see for protecting the key i mean what are the different write in your chapter about software-based solutions hardware-based solutions or a combination of both and then the question is of course and that comes back to the question of of kiran a little bit um if you have then a breach and somebody someone is going to steal your your things i mean who would be then liable from a technology perspective

about it okay so if will start with the two technology two uh solution that uh i spoke on the paper software base and artwork base so an advertised histories is the offline stories option for the key it is a physical that allows you to store your private key like a usb key or accession or whatever and when we need to do to sign a transaction uh we have to connect the hardware to the

to the computer and copy past the key uh if you know if an attacker get control of your computer you will not able to steal the private key there i think the hardware base is storage is the most crystallized option but it will take longer to do the to do to sign the transaction then the second option is the software-based uh key storage is like it's an application that will be manage your key um is offer is often online

which is a dirt from for the attacker it will be easier for a neck maker to have access to your to your wallet because there are more door to enter but it is easier uh it is um the software absent is i think easier and um it's the best when we do like frequent transaction because we can automate automize uh the transaction uh

there is like no really like the no not really the best solution because this like everything else is the murder of compromise like it depends if of the frequency of your transaction the importance and or the parameter so now for the second part of the question that who will be in charge in the technic point of view if your key are still um that's a really good question and

i didn't go in this detail but i think it will depends on the context if it is the user that i don't know like an attacker try to fish fish and the user by mail or whatever and the users uh respond to the phishing i think it will uh it is the user that is in fault but if for example there is a back door in the software of the storage and the foot will be for in my point of view will be for the

the one that creates the software i mean you say absolutely right and that's probably as well and a question to the entire panel here um what uh i mean the thing is we have an enterprise blockchain solution we have certain standards of of of how do cyber security protection works we have rules how we onboard customers we have rules how we offer customers everything's provided in in a governance model um but then yeah the question is really

who is actually the owner of behind the enterprise uh blockchain solutions and what is the best model uh for for providing uh enterprise blockchain solutions what was the general fault here to to everybody in the panel uh on that one what is the best governance model behind an enterprise blockchain solution from your perspective is it the consortium or is it more a democratic setup with multiple words and multiple design and voting mechanisms what's your thought on that topic i would just start with uh one thought i

just have is that if you start with a democratic view for the governance you just could have the risk that if one of the partners really don't agree with what you want and basically he is in the minority could just think of just terminating the partnership and then just going um away differently from the consortium where you try to find the best average solution for everyone on the other side consortium tend to then uh the biggers are overruling the smaller ones as well in certain consortium i

don't know if you uh who has experience in working with consortiums from you from from my point of view um openness and [Music] having very clear rule that in the end enable all the participants to have equal power in in such a in such a system is something that's very important right we heard about antitrust questions and answers um so on the one hand this openness makes it very difficult and sometimes very slow

right in such an um and such a collaboration such a system to move for ahead but i think it's an important piece and it's it's essential to have that um that's one of the aspects let me take one if possible it's very again challenging topic actually at the crypto valley annual conference last october i guess on november it was um fred gregort from the new ceo of cardano was talking a little bit about not a little bit a lot about how the cardano system will work about the democratization voting openness and everything is great as long as we're

not coming to critical points like defense like weapon like chemical issues like now pandemic and so forth and so on so we have this beautiful approach openness lets everybody work vote on everything everybody should have access to everything but then where it starts who decides who has access to those critical points and issues and at the conference the questions those questions were left open because nobody has solution to that but i think we all agreed in sitting in in the in the online

or in the room that there must be some different rules which apply to those critical points and um different rules which apply to the less critical issues and um i i also don't have a answer to that but i think we all agree that it's valid point that not everybody should have access to every issue be it consortium be it kind of company be it just simple joint venture whatever but there are certain very important topics where probably only very few people shall decide on them yes that is this i mean that is always

key a key topic so we are already at the end of our hour to introduce the the the document i would really again uh thank everybody of you to participate i mean it has become quite a quite a condensed blueprint in its information but very broad as well i mean we cover in that in that document quite many aspects of the cyber security aspect so membership and identity management then as well the entire data protect data privacy issue that you mentioned katarina then details cyber key storage that is

key and important and of course how you get assets digital assets may it be digitally produced may it be as well physically goods behind it how you get them into the blockchain and out of the blockchain as well again and then on one topic that we have not covered today and that that angela's angela blanca um was writing um on it from the from um from geneva she was then talking about interoperability i mean that's another key topic about enterprise blockchain solutions don't only work with one network work with multiple networks uh coming there together and uh frederick

is happily nodding i think that's one of the most difficult indeed it's a recurrent challenge here interoperability yeah absolutely and last but not least a small chapter about the governance which is really one of the key things and i think as well as and who should know it better as we swiss when you have a really democratic system it is very complex well in that terms i would like to thank everybody uh very much for this uh for this talk today and the the the document is now published so um

we can as well now take the next one and and think about an expert that we're gonna write it was really pleasure uh doing that and um i would like to thank everybody for tonight's session and uh talk soon you vietnamese thank you everybody thank you bye everyone thank you