Banking & Financial Services. White Paper. Understanding the Operational Risks in Blockchain Implementations

Transcription

1 Banking & Financial Services White Paper Understanding the Operational Risks in Blockchain Implementations

2 About the Author Uma M Somayajula Uma M Somayajula is a Domain Consultant with the Risk Management practice of the Banking and Financial Services (BFS) business unit at Tata Consultancy Services (TCS). She has around 15 years of experience in strategy consulting and developing IT solutions for enterprise risk management. Somayajula's areas of interest include risk framework development, integration, and analytics across highly regulated domains, including banking and financial services.

3 Abstract Introduced as an alternative approach to digital payments, blockchain technology is being adopted for a wide range of financial transactions and instruments. Operational risks arising from information security deficiencies have impeded blockchain implementations at large, especially in the banking industry. Newer versions of blockchain protocols and applications are being designed to de-risk individual implementations. Once the challenges are effectively addressed, the blockchain technology will provide a dynamic and secure environment for financial transactions. This paper is part of a series that will address derisking of blockchain implementations in scenarios such as payment systems, securities trading, and so on. In this paper, we discuss the information security requirements, which form the majority of operational risks in blockchain implementations.

4 Contents Adopting Blockchain Technology in Financial Transactions. 5 Ensuring Information Security is Paramount 5 Inheritance and Other Legal Issues in Blockchain Implementations 8 Blockchain is the Way Forward 9

5 Adopting Blockchain Technology in Financial Transactions. Blockchain provides a mechanism to process transactions without the risks and costs associated with third-party authorization. Variants of blockchain technology Bitcoin, Litecoinn, Ripple, SatoshiDice, CIPHREX, and Ethereum¹ that have emerged over the last couple of years, have addressed the information security issues to a large extent. However, these developments have been mostly based on specific application needs, be it for payment systems or currency exchanges, or digital asset transactions. The open-access, transparent ledger system is an inherent feature of the blockchain technology. The blockchain can be configured to be a 'private' permissioned ledger within a closed group of pre-authenticated entities, or an 'open' permission-less ledger where the entity is unknown to the existing entities on the chain. It can be configured on any type of network: intranet or extranet or, on network servers connected to the internet. The block chain allows new applications to be built, addressing a combination of traditional payment and storage systems and smart contracts accessing digital assets. Table 1 lists the potential areas where blockchain technologies can be applied. Currency exchange or payment transactions Programmable money or conditional payments Digital assets transactions Peer to peer data storage Digital currency, clearing, settlement and reconciliation Enabling crowdfunding or donations Digital bonds, peer-to-peer mortgages, gift coupons Compliance with Know Your Customer (KYC), identity management, and Anti- Money Laundering (AML) regulations Micro-payments Multi-signature accounts Digital content distribution Cloud storage of information assets Trading, securities and derivatives (not fully operational yet, due to rate determination issues) Treasury securities operations through smart contracts Intellectual property protection or application Secure accounting ledger operations (front and back offices) Table 1: Applications of Blockchain Technology in Banking and Financial Services Industry (Source: TCS Internal) Ensuring Information Security is Paramount Risk management in financial institutions encompasses credit risk, market risk, liquidity risk, country risk, IT risk, and other business or organization-specific risks. Operational risk arising from information security breaches is a key concern, as financial transactions have a heavy digital information bias. Let us look at the information security aspects that financial institutions need to focus on in order to ensure reliability and security of financial transactions (see Table 2). 1 Institute of International Finance, CMM Research Note The Internet of Finance: Unleashing the Potential of Blockchain Technology (April 2015), accessed April 8, 2016, 5

6 Information security requirements Identity and access management (Authentication) What it means Identification of transacting parties source to destination Vulnerabilities or issues addressed Identity thefts, dictionary attacks, session hijacking, phishing, and so on Authorization Segregation of duties Fraud from unauthorized access to, and modification of, information Non-repudiation Confidentiality Integrity Availability Traceability Regulatory compliance Undisputable accountability of the transacting parties The guarantee that the information or data remains private to the provider and the recipient The guarantee that the information has not been tampered with, either at rest or in transit Transactions can be performed at all times, since the required information is available round the clock Audit trails to trace the path of transactions; admissible in a court of law for digital forensic investigations Compliance with financial regulations and international law for transaction settlements Counter denial or proxy transactions Sniffers, money laundering activities or other unauthorized activities Illegal creation and modification of transactions; man-in-the-middle attacks; insertion attacks Denial of service attacks on the network Internal fraud, system abuse due to design flaws and implementation loopholes Penalties and legal complexities Table 2: Information Security Requirements for Financial Transactions (Source: TCS Internal) Addressing information security requirements with blockchain technology can help address these vulnerabilities. Identity and access management: Every block that is generated has to be signed by a digital signature with the RSA hash function. Verification of the public key by the nodes (miners) on the network ensures the authenticity of the block. This provides a 'community of KYC effort', thereby minimizing the possibility of fraudulent transactions and eliminating instances of forgery. The propagation of the blockchain is inherently dependent on this authentication mechanism. However, uninterrupted network connectivity during a transaction is important. In case the connection is lost at some node, the concerned node will have to 'wait' until its ledger is updated before transacting the block. During this wait period, denial-of-service attacks are a possibility. Additionally, if the IP of a node is masked intentionally, identity can be hijacked and a system breach can occur. 6

7 Authorization: The blockchain technology involves 'block-wise' authorization of transactions enabled by the distributed ledger feature. This is ensured by 'incentive provisioning' from the block value itself. Once done, the authorization is realized by the receiver, eradicating double spending and duplication frauds. Here again, constant network connectivity is important. If it is lost at some node, the authorization process could be delayed. During this wait period, IP spoofing attacks could flood the network with 'false' authorizations. Organized financial crime groups could attempt such frauds, which could corrupt the entire block. Non-repudiation: In a blockchain-enabled process, the non-repudiation mechanism is inbuilt in the block, as it carries the chain of custodian links. Double spending of a block can result from the authentication of forked coin or blockchains on the network, when some nodes are slow. Therefore, a minimum number of transactions are enforced to make a new fork authentic. This ensures that there is enough time for the false forks to be dropped. This reiterates the role of infrastructure on which the network operates in ensuring the security of the system. However, due the advent of quantum computing and its use in multicore personal computers, double spending is still a major concern. This is because it takes just an infinitesimal amount of time to flood the network with spoofed messages that falsely authenticate a block, corrupting it. This leads to failure in providing protection for nonrepudiation to the block source itself. Confidentiality: Financial firms need to provide the highest level of data privacy to all stakeholders in a transaction. The crypto hash digital signature used in generating blocks ensures confidentiality of information from the source to the destination. This safeguards the interest of all the involved parties, enhancing the 'trust' factor in the execution of financial transactions. However, the open transparent ledger provided by the blockchain is a privacy-related concern, as the spending of the block by an individual is visible to all. This defeats the purpose of confidentiality with respect to the transaction. Another prime concern is that blocks can be spilt and transacted to generate new blocks, to mislead tracking. Doing this covers the explicit path from the source to the destination and masks the spend tracks. This is a downside as it opens up avenues for money laundering activities and fraud where the intent is to cover spending tracks. Integrity: Firms need to ensure robust system controls that do not allow illegal creation, copying, or modification of information. The blockchain technology, by its nature, ensures that data or information in the datagram is not altered or tampered with, during any stage of the transaction. Availability: There needs to be round-the-clock access to information to enable seamless execution of transactions. The blockchain technology works on a distributed ledger system. This ensures the availability of blocks at all times, even if a few nodes on the network are down or sections of the network are slow. Corruption of the chain by IP masking introduced with the intent of creating excess blocks could impede the availability of the network or blocks. Such attempts will result in slowing down of networks (denial of service attacks) in trading, surveillance, and other activities, for either the advantage or disadvantage of involved parties. 7

8 Traceability: The blockchain technology inherently fulfills this requirement since the custodian details of blocks are available at all times. This can be used for digital forensic investigations, thereby eliminating the need for an added layer specially for auditing of transactions. Since the custodian and transaction trails are independent of a third party, disclosure-related fraud can be effectively overcome. However, IP spoofing creates difficulties in making the trails traceable for forensic investigations or to be presented as evidence in a court of law. Regulatory compliance: Compliance with regulations and industry standards is of utmost importance to financial institutions. This area is yet to mature for the widespread adoption of blockchain technology. The currency traded on the blockchain is fiat currency. Various governments are working on introducing legislations and guidelines to facilitate blockchain adoption in a controlled fashion. For instance, the European Bank Authority (EBA)² is working on a regulation that deals with the reduction of the risk of financial crime while using blockchain technology. The EBA seeks to initially set up appropriate supervisory practices for the virtual currencies sector, and then follow it up with necessary regulatory practices. 3 The Financial Action Task Force (FATF) has noted the potential risks of using virtual currencies money laundering and terror financing. References to 'digital money' have been incorporated in directives such as the Payments 4 Services Regulations 2009, the Electronic Money Regulations 2011, and the Money Laundering Regulations. The Financial Conduct Authority (FCA), Bank of England (BoE), Prudential Regulation Authority (PRA), Payments Systems Regulator (PSR), and HM Treasury are yet to release specific guidelines. 5 In the US, the government has provided guidance for adopting Bitcoin. FinCEN has issued guidance on 'convertible virtual currencies' that can either be substituted for real currency or have an equivalent value in real currency. It defines the applicability of the Bank Secrecy Act, in the context of digital currencies. The New York Department of 6 Financial Services (NYDFS) published license requirements for virtual currency businesses in June Inheritance and Other Legal Issues in Blockchain Implementations Implementing blockchain technology also brings up other issues. For instance, lost blocks are actually 'lost'. They can never again be available in the money supply chain both in private and open networks. This can happen if the private keys generating the block are lost, pass phrases are forgotten or, the hard disks of individual computing systems or nodes are corrupted. 2 European Banking Authority, EBA Opinion on virtual currencies (July 2014), accessed April 8, 2016, Opinion+on+Virtual+Currencies.pdf 3 FATF, Guidance for a Risk-based Approach to Virtual Currencies (June 2015), accessed April 8, 2016, RBA-Virtual-Currencies.pdf 4 GOV.UK, Digital currencies: response to the call for information (March 2015), accessed April 8, 2016, 5 FinCEN, Guidance on Application of FinCEN s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (March 2013), accessed April 8, 2016, 6 New York Department of Financial Services, NYDFS ANNOUNCES FINAL BITLICENSE FRAMEWORK FOR REGULATING DIGITAL CURRENCY FIRMS (June 2015), accessed 8 April 8, 2016,

9 Another concern is the inheritance aspect of currency on the blockchain. How will blocks that represent financial property pass on in the legal sense, to heirs? If the private key in public key infrastructure (PKI) remains undisclosed due to requirements of information security, how will the next of kin, retrieve it? Is it possible to enable the datagram in a block for key escrow? A related concern would be whether there could be individual and joint holdings. Blockchain in financial transactions also brings up issues on conversion to commodity, cross-country exchange rates, and so on. Blockchain is the Way Forward Blockchain technology provides an efficient and innovative solution to traditional payment systems, institutional cross-border payments, trading exchanges, and monetary transactions. As the protocol versions strengthen, the financial sector is looking to leverage it to reduce costs while improving efficiencies and transparency. Customized applications are spurring governments, regulatory bodies, business houses, trading exchanges, and banks to adopt this technology. Features like de-centralized storage and shared responsibility are particularly driving this adoption to contain financial crime. However, careful thought and strategic planning should go into each implementation using blockchain, to de-risk from the process and architecture perspectives. Doing so will make the technology a force to reckon with in the global financial landscape. 9

10 About TCS' Banking and Financial Services Business Unit With over four decades of experience in partnering with the world's leading banks and financial institutions, TCS offers a comprehensive portfolio of domain-focused processes, frameworks, and solutions that empower organizations to respond to market changes quickly, manage customer relationships profitably, and stay ahead of competition. Our offerings combine customizable solution accelerators with expertise gained from engaging with global banks, regulatory and development institutions, and diversified and specialty financial institutions. TCS helps leading organizations achieve key operational and strategic objectives across retail and corporate banking, capital markets, market infrastructure, cards, risk management, and treasury. TCS has been ranked #1 in the 2015 FinTech Rankings Top 100 of global technology providers to the financial services industry, by both, FinTech Forward (a collaboration of American Banker and BAI) and IDC Financial Insights. TCS has also been recognized as a 'Leader' and a 'Star Performer' in Everest Group's 2015 PEAK Matrix report for Capital Markets Application Outsourcing (AO), as well as a 'Leader' in the 2015 PEAK Matrix report for Banking Application Outsourcing (AO). Contact Visit TCS Banking and Financial Services unit page for more information bfs.marketing@tcs.com Blog: Drive Governance Subscribe to TCS White Papers TCS.com RSS: Feedburner: About Tata Consultancy Services (TCS) Tata Consultancy Services is an IT services, consulting and business solutions organization that delivers real results to global business, ensuring a level of certainty no other firm can match. TCS offers a consulting-led, integrated portfolio of IT and IT-enabled infrastructure, engineering and TM assurance services. This is delivered through its unique Global Network Delivery Model, recognized as the benchmark of excellence in software development. A part of the Tata Group, India s largest industrial conglomerate, TCS has a global footprint and is listed on the National Stock Exchange and Bombay Stock Exchange in India. For more information, visit us at IT Services Business Solutions Consulting All content / information present here is the exclusive property of Tata Consultancy Services Limited (TCS). The content / information contained here is correct at the time of publishing. No material from here may be copied, modified, reproduced, republished, uploaded, transmitted, posted or distributed in any form without prior written permission from TCS. Unauthorized use of the content / information appearing here may violate copyright, trademark and other applicable laws, and could result in criminal or civil penalties. Copyright 2016 Tata Consultancy Services Limited TCS Design Services I M I 04 I 16