What is your Cyber Security Risk Profile?

Have I taken all the necessary steps to protect my enterprise against all current and potential future cyber threats? That’s the question that you will be asking yourself and savvy board members will be asking you.

Taking comfort from mitigating the risk, as per Marsh Insurance Brokers there has been rapid uptake of cyber insurance with 25% increase during 2015. As we can see from the analysis from World Economic Forum, there is high likelihood of Cyber Attacks and there is also a Data Fraud or Theft risk.

(Source – UK Cyber Security Report)

Large Companies Risk Profile

From that UK report, when we evaluate the risk profile for larger businesses – it is alarming to see that the cluster of risks that exist towards the upper and right of this 3x3 grid.

(Source: UK Cyber Security Report)

My read is that for most organisation’s that this would be a good indication of the enterprise risks that are in play. One could argue that the relative severity may vary according to the industry and sector.
Further that the probability will also adjust with how mature are your risk management practices.


A simple way to Rate yourself

 

The USA National Institute of Standards and Technology issued a Framework for improving Critical Infrastructure Cybersecurity. In there approach that have
four levels of cybersecurity risk management sophistication:

Tier 1 (Partial) this describes organisations where cyber risk management processes are not formalised and for whom risk is managed in an ad hoc fashion.
For Tier 1 organisations, cybersecurity risk is an IT issue. This is tackled by an internal team with little to no external collaboration.

Tier 2 (Risk Informed) this is where cybersecurity risk management is acknowledged and a concern. However this is still in the main managed by IT, there is a policy in place and there is some movement to working with others at an industry level.

Tier 3 (Repeatable) when there is a comprehensive risk management policies and practices that are understood and implemented across the organisation. Also there are broader industry connections to address cybersecurity risk and sharing of information.


Tier 4 (Adaptive) This is the maturity level of organisations whose cybersecurity risk management is in a continuous improvement loop with lessons learned from personal and third-party experiences. These companies have made cybersecurity risk management part of their corporate culture and they actively contribute risk information to larger industry efforts.


So where did you land?


For most of us, we are at best in the middle a Tier 2 or 3.

The challenge for many organisation’s is then taking this framework and putting this into a practical action plan to improve and move the dial forward. Let me share with you what I believe are 10 commonsense tips.

Here goes:

10 practical tips

1. Identify the real risks (don’t get caught up with any hype)
2. Work with your Management Committee to refine the overall risk appetite and where this fits.
3. Understand most important information and who really needs access.
4. Look at the broader threat landscape to understand where you are most vulnerable
5. Protect the crown jewels
6. Make everyone accountable and role model this

7. Ensure that cyber security remains an ongoing board-level priority.

8. Establish Enterprise Cyber Security objectives and metrics
9. Action at a Portfolio level and not by silos. Hence you have to consolidate the requirements for all aspects of security (PCI, Audit, SOX, information, privacy, physical and BCP)
10. Partner when it makes sense and you need to add capability.

http://www.cso.com.au/article/588781/what-your-cyber-security-risk-profile/

10 Cyber Security Startups to note

Should you have time to wander through some of the myriad of startups that are listed on Angel List or any similar sites, you will find that a growing number of new players.

Each has picked a niche that the incumbent security players are not addressing adequately. As a result the variety of offerings is immense and this is itself educational to how broad the problems are facing CISO’s today.


Enjoy a stroll with these 10.


1. Cyber Security Simulation


Vthreat - this is a startup that provides a SaaS for testing your security. In essence provides a simulation of an attack. What I like about this product is that it allows you to exercise your company’s incident response. At the same time will allow you to validate your team and the controls that are in place.

 

Clearly any simulation tool can never provide 100% assurance, but this is a reasonable starting point.

2. Cloud Endpoint

Thin Air – the ideas of a Cloud SaaS doesn’t sound that interesting. However this is all about smart storage systems that understand corporate policies. What this means is that information that is sensitive such as personal info or credit card information is managed automatically by the platform.
Where I should not have access to credit card information then this masked and redacted. Moreover changes to this access is controlled with mobility enabled functionality to press “1” to allow access or “2” to deny.


3. Gamify (Cyber Security Education)

Apozy – is all about educating your team on what is right and wrong. Based on the common sense understanding that people are the weakest link, how do you educate them on threats and hackers.
The Gamification approach hides the fact that this provides some real value to bringing your team to the right level of awareness.

 

4. Machine Learning for Data Loss Prevention


Check Recipient – This about avoiding the oops, I didn’t mean to send that to that competitor. Despite the reference to AI it is not scary or complex, the machine learning operates in the background to prevent you sending email to the wrong person(s).

 

The message is analysed against the social network and your normal inbox with textual analytics.

5. Secure Office 365 Documents

 

Vera – this has been described as “Snapchat for files and documents”, but forgetting that connotation this allows a user to apply security to any file for Office 365 users.

Simply right click on the file to choose encrypt and this is then sent to a 3^rd party with the security policy, which is de-encrypted on arrival as an email. Also 365 office files can be protected in Sharepoint or Onedrive.

Any usage of this file is tracked and you can stop access with a recall button, this can be revoked on your mobile phone.

6. Malops - Detection of Attacks
Cybereason – we can never be 100% sure that we are able to detect any attack. This startup was started by former Israeli intelligence officers and it is all about being able to detecting attacks as the happen, what they have termed as Malops (Malicious Ops)

The assumption is that you can’t prevent the hackers but you want to be able to identify malicious activity. Cybereason profiles everything in the environment and cross compare, but it does require an installation on every device.

7. and 8. Document Security


Doc Send and Doc Tracker – there are two new startups with similar offerings. As we are aware that most data (85%) is still stored in documents we need to have stronger security on this once it leaves our premises.

These solutions allow you to track: who opened, who read, how long on each page and was it forwarded to others.

 

 

Doc Tracker has the same functionality but also allows you to remotely destroy the document.

9. IP Protection 


Shield Square and Distill Networks – For some CISOs, there is also the ancillary responsibility for managing brand trust.

   

Distill Network is a startup works to protect websites from BOT attacks, it runs on a virtual cloud or a private enterprise server. It is able to detect and stop, competitors from price scraping your websites. Also will allows you to protect your brand logos and images from scraping.

Shield Square provides similar functionality to protect your IP from malicious bot traffic. The value proposition for using such products is that it stops competitors in eCommerce space from copying your prices, with the tool providing ‘fake’ prices to the bots.

10 . Uber for Security People

SleathWorker.com – there is a shortage of IT Security staff in Australia and I have been asked nearly every month to recommend for a role. When you can’t find a resource or your team is short staffed then you will need to be able to find some suitable resources.

The alternative is to engage a 3^rd party managed service, which will come at a cost. What we need is a Uber offering of skilled resources that are able to provide this as a service.

 

http://www.cso.com.au/article/588082/10-cyber-security-startups-note/

My Performance Review the CISO

How to write performance management plan for my CISO?

The end of year is approaching and you that time of the year is around for you to evaluate your CISO. As this is an article for CSO magazine, this is probably an article that you have to decide for yourself is it one that you share with your boss.

This is always a conversation that you approach with a degree of confidence but also with a sense of uncertainty. What your boss rates you for your efforts over the last year may be aligned with your own thinking, but this is the only time that you find out.

For me, a performance review plan is a combination of “Hard Things and Soft Things”. These are “hard” tangible deliverables, which include team-based outcomes. Plus the “softer” aspects which includes how the CISO has driven a positive culture within the enterprise.


Hard Things

1. Accountable for Information Security Portfolio

The CISO is tasked primarily with delivering timely projects, increasing efficiency and (above all) reducing costs. Some CIOs like to take short cuts, and perhaps take on more risk than is prudent. The CISO can influence the CIO and help him realise that security wants to help him get to his objectives as quick as possible, while also maintaining management's preferred risk profile.


In this regards you are accountable for the whole portfolio, of delivering on efforts to improve the risk position of the enterprise. Being able to achieve, the deliverables while looking for synergies across these projects is the key.

What you need to do is to convince your boss that you have been a professional CISO is who is prepared to take information security risk management judgements on the basis of in-depth business and technology knowledge. Indeed you are managing business risks as a overall portfolio.


2. Responsibility for Enterprise Information Security

It is likely that despite whatever efforts you have made that there have been incidents and perhaps breaches. The CISO owns all the problems with the position.

You have to actively manage staff, external resources, culture and performance. Importantly, be held responsible for security incidents and all the fun challenges that arise. Invariably you the CISO would have been involved in responding to a major security incident, and then developing strategies and plans to minimise the risk of that type of incident from happening again.

 

How you have managed external bodies is critical and your diligence in closing external or internal audit issues relating to information security will be examined.

As the person ultimately responsible then you will also be judged as to how comphensive has the Enterprise Information Security Strategy been articulated and bought in by the Board. The key will be has this taken the enterprise beyond just compliance to establishing a security risk profile appropriate and aligned with the risk appetite of senior stakeholders.


3. Managing Information Security Budget

There are two parts, the first is the simpler aspect of meeting budget – despite all the challenges and unplanned crisis that occur. A greater degree of difficulty is that the CISO needs to be the advocate for the security strategy and get funding from the CFO and all stakeholders in the C-Suite, audit committee etc. This is never a easy task to gain funds, when there is only a negative ‘stick’ argument.

As the CISO you will need to have an "elevator pitch" ready and tailored for each stakeholder, usually with a small select number of detailed funding proposals for each financial year.


Soft Things

  

In this regards your behaviour as a Leader and how you operate are in the broader context is what your boss will be looking to evaluate. Most critical is that at all times your integrity and ethics are unquestionable.


4. Managing Trust and Reputation

You are in the business of trust and reputation. This means that within the enterprise that you are seen and heard in that context, Furthermore that you are operating in the external domain in networking with others to further the cause of Information Security.

Having visibility and a good reputation within the information security community, also means that you are a thought leader who understands the latest trends and threats. Your boss wants a leader that has good self awareness and not a recluse.


5. Crisis (Noise) Management

While major visible security incidents don't happen that often, you will have a key role in managing these during and after the event. It is true that such incidents can cause major disruption, brand damage and financial loss, and likely all of the above.

Your role will be to ensure that there is good crisis communication to both internal and external parties. This is not an easy position and often the standby statements, will just not be sufficient.


6. Strategic Partnering

During the year it is likely that you are making key strategic corporate purchasing and partnering decisions. As the strength of your own security is greatly effected by these decisions then you should be demonstrating how this provides enhancement of the risk profile, while also showing that you are removing legacy solutions.

As the CISO, you will have made these decisions using a good transparent process and your friends in Procurement will be singing your praises.

Summary for the Year 2015

Now that wasn’t too hard was it? Good luck with your conversations.

It would be interesting to hear from you how many of these Hard and Soft measurements are actually in your Performance Review??


http://www.cso.com.au/article/589801/my-performance-review-ciso/

What warranty protection does my anti virus provide ?

CAREFULLY READ THE FOLLOWING LEGAL AGREEMENT BEFORE YOU START USING THE SOFTWARE

Now, honestly who has read these statements?

There is an implied warranty that if you are buying an Antivirus that you get a level of protection and updates for new threats. Conversely if you have chosen the freemium offering then you take your own chances with regards to new virus and malware risks.

But what is your real protection that you get and how do you know if you are protected?

Wait, I’m not sure that I accept those conditions? Sorry it is too late as by clicking or installing the software that is already a past event.

CLICKING THE “I AGREE” OR “YES” BUTTON OR OTHERWISE INDICATING ASSENT ELECTRONICALLY, OR LOADING THE SOFTWARE, YOU AGREE TO THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT.


A Real Case Example
 
Let’s take an example of these clauses and without naming the software company. This protection is quite limited, in this case I would have paid $49.95 plus GST and that would be the extent of what I could recover.

YOU AGREE THAT IN THE EVENT THE RIGHTHOLDER AND/OR ITS PARTNERS ARE FOUND LIABLE, THE LIABILITY OF THE RIGHTHOLDER AND/OR ITS PARTNERS SHALL BE LIMITED BY THE COSTS OF THE SOFTWARE. IN NO CASE SHALL THE LIABILITY OF THE RIGHTHOLDER AND/OR ITS PARTNERS EXCEED THE FEES PAID FOR THE SOFTWARE TO THE RIGHTHOLDER OR THE PARTNER (AS MAY BE APPLICABLE).

 

Not that attractive or worthwhile to pursue this particular organisation. To double check this I examined another major anti virus contract terms and found them to be amazing consistent. Here is another example:

IN NO CASE SHALL ABC OR ITS LICENSORS’ LIABILITY EXCEED THE PURCHASE PRICE WHICH YOU PAID FOR THE APPLICABLE SERVICE PERIOD

 
You also need to Act Fast


This is also the case that the time window is working against you to discover an issue with the average elapsed time to discover a breach being 200+ days.

For these Anti Virus Warranties there is also a limitation of 1 year to make any claim against the warranty:

No action, regardless of form, arising out of the transactions under this Agreement may be brought by either party hereto more than one (1) year after the cause of action has occurred, or was discovered to have occurred, except that an action for infringement of intellectual property rights may be brought within the maximum applicable statutory period.


No coverage for Terrorists?

It is somewhat hard to believe but there is also an exclusion that relates to being a terrorist. But also if you happen to be Sir Richard Branson and involved in a rocket launch then you also are excluded by warranty terms from using such anti virus software:
 

USE OR FACILITATION OF ABC PRODUCT IN CONNECTION WITH ANY ACTIVITY INCLUDING, BUT NOT LIMITED TO, THE DESIGN, DEVELOPMENT, FABRICATION, TRAINING, OR TESTING OF CHEMICAL, BIOLOGICAL, OR NUCLEAR MATERIALS, OR MISSILES, DRONES, OR SPACE LAUNCH VEHICLES CAPABLE OF DELIVERING WEAPONS OF MASS DESTRUCTION IS PROHIBITED


What about Updates?

 

You may recall that I noted the implied warranty that if you are buying an Antivirus that you get a level of protection and updates for new threats. I really struggled to find any reference in the warranty documents that talked to service level and that updates to new viruses would be provided within any time window.
Clearly these Anti Virus companies would get significant flak from their customers and lose creditability fast, if they are not able to act quickly.
But this is not part of the standard warranty protection at least at an expressed level.


I want out, so how can I do this?

Now that I’m aware of the terms and conditions, actually I’m not sure that I want to accept this. So what can I do?

IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS, CLICK THE “CANCEL” OR “NO” OR “CLOSE WINDOW” BUTTON OR OTHERWISE INDICATE REFUSAL, MAKE NO FURTHER USE OF THE SOFTWARE, AND CONTACT YOUR VENDOR OR CUSTOMER SERVICE, USING THE CONTACT DETAILS IN SECTION 11 OF THIS LICENSE AGREEMENT

Whoa, I have to do what again?……it is easy to click agree but there is a complicated process if you don’t agree and then it’s likely that you won’t get any joy around changing the T&C’s.

That fabulous expression “Caveat Emptor” really applies.

http://www.cso.com.au/article/590994/what-warranty-protection-does-my-anti-virus-provide/

Is your shop Secure by Design?

In a recent coffee chat with Jeff Jacobs CISO at IAG he talked about how, their team was making inroads into being ‘Secure by Design’. We reflected on how that advanced thinking re-positioned IT Security into being part of the process and not a milestone to tick.

Jeff went on to explain how his team was involved in all the agile scrum standups as a regular team member. While clearly this created added pressure around resource allocation, you can easily see the benefits of being involved early.

In contrast, where is your shop?


Applying an Agile Framework

In most enterprises there is an increasing focus on using an agile approach to deliver software. The basis of agile is that we build software using an iterative approach, instead of the normal ‘waterfall’ method. During this switch it has been the norm that the actual approach to managing security has not adjusted to this new reality.

The velocity of delivery has fundamentally changed and at the back end, just prior to ‘going live’ there has been pen testing and security review. Clearly this is better than doing nothing, but is not going to be the ideal approach.

Invariably some vulnerabilities and issues will be uncovered and this leaves the business product owner having to either accept a risk or the developer an additional task to figure out if there is a viable workaround. No-one wins and the CISO is the big bad wolf, who doesn’t understand the importance of this business initiative and is getting in the way of progress.


Building Security into the process

The alternative is that we build security into the application and not around the technology. By definition, agile is about being able to morph and change one’s approach – thus this means we have to apply security principles into the actual build process.

This means that stories that are developed as part of the agile process to depict “a day in the life of”, will by default build-in security controls. It places a responsibility for the developers working on user stories to understand the overarching security requirements of the new system.

Taking a practical example this would mean that the software engineer would need to consider all the new components and integration points, including any new cloud technologies. What else does it take to achieve this goal?

Coders are accountable to write “secure code”

Firstly take the onus off the CISO and the security team, instead change the focus so that security is part of the deliverable and the developers are expected to write ‘secure code’. This means that it is no longer acceptable for a software engineer to say that Personal Information, PCI etc is someone else’s responsibility.

Therefore any new software routines needs to be built with security in mind – both secure at rest and in transit.


CISO or delegate are part of the project

Essentially this means you must have a “security expert” on every project. This person is on the team from day 1 and provides a security lense and hopefully is also engaged for their broader business expertise as well.

The advantage is that you bring to bear the security experience to the table and it will ensure that the user stories are robust and include security requirements. This also means that proactively the knowledge of current vulnerabilities and any new potential ones is understood and factored into the new design.

Specifically, there can be attention to security sensitive aspects in relevant user stories. This will include authentication, data entry and manipulation.


Security Testing by pieces

Agile development is iterative by nature and not end-to-end. On the other hand IT security requires a more complete holistic review. Thus integral to this is usually to get evidence of regression and test automation.

The Security professional will be seeking that there is a good validation of the design and a comprehensive review of controls. Thus even with the involvement of security from day 1 it is still going to be a challenge to take the pieces and understand the total picture.

However the critical element is that once a new vulnerability is understood, then an automated test can be developed to ensure that this is never repeated.


A Persona covers all needs


To be ‘secure by design’, means that the customers that we are designing for include the ‘persona’ that one would expect for the new system. In agile development these personas are used as proxies for the customer. By definition a persona is:

“archetypical user of a system, an example of the kind of person who would interact with it” [1]

 

The customer experience is what every enterprise is striving for. A great or at least good experience and it’s hard to think about a user that would realistically want the system to be insecure by design.


http://www.cso.com.au/article/591067/your-shop-secure-by-design/

All I want for Xmas is to hire some Cyber Security Professionals

As I talk to CISO and Heads of IT Security there is a clear consensus that there is a shortage of cyber security professionals. It is also the case that most of the CISO are resigned to building their own talent, by growing these from internal transfers.

In contrast, Commonwealth Bank have taken the lead with a partnership with UNSW to develop a centre for Cyber Security. CBA have had a industry reputation for having an insatiable appetite and for taking staff from many of their competitors. It is good to see them taking a positive and practical step to address what is an acute shortage.

Yes, all I want for xmas is to find some good security professionals.

 
Demand exceeds Supply

There is a global shortage of information security staff despite the increased focus due to the much public attacks. This shortage is believed to be around 1 million professionals, and this is echoed in Australia with IT salaries being inflated to keep up with demands.

At the same time job insecurity is at an all time high, so we would be also witnessing some conservatism to taking on a new challenge at this time. [1]

In a Greythorn 2015 salary survey security roles were the 4^th highest most valuable skill set that hiring managers were looking for, this is after Cloud, BI and Project Management. (Interestingly the next most valuable is Big Data)

I would for one, expect that the ideal candidate is also able to well manage information, and their ability to do analytics would be highly desirable. However in a time of severe shortage, I can’t be that choosey.


Highly paid

We are seeing that getting my Cyber Security staff for xmas is going to be costly and just take a few examples. Senior Security Architects in Australia were paid $160k interestingly the same rate as Network Architects where they have some cross skill opportunities.

IT Security Manager paid up to $170k while Network Manager are only paid $150k. The danger is that we create an elitist group and as this becomes well known and these teams have to work together, the tension will naturally become greater.

Yes, Cyber Security staff are highly paid but the price to pay is worth the cost.
 

 

Grow my own by next Xmas?

I can hire a candidate but it is likely that they will be more expensive and create salary range relativity issues that are hard to address. So taking the harder road is about identifying existing staff and growing my own.

Realistically it can’t be done in a hurry - What’s it take to become a Cyber Security professional?
Well it not about doing a course (not yet anyway despite the CBA initiative). There are some good skills and attributes that will be useful:

• Network management capability
• Mobile app development skills
• PCI knowledge
• Analytics mindset
• Curiosity
• A degree of paranoia

It is fair to say that there is a clear lack of clarity of what good looks like. A good CISO can quickly tell, but it’s hard for HR or a Recruiter to really be able to screen these candidates easily. These lack of standards are not unusual and this situation is also the case in all other IT domains.

 

Ok, perhaps I will change my wish - All I want for Xmas is no breaches for 2016.

http://www.cso.com.au/article/591062/all-want-xmas-hire-some-cyber-security-professionals/

Who’s blocking the blockchain?

It’s no surprise that the distributed ledger underpinning Bitcoin has caught the attention of both banks and regulators.  The hype around the blockchain is becoming deafening.

Just this week, both Westpac and the Commonwealth Bank have run sessions on the blockchain during the Sydney leg of an international series of conferences on the technology’s potential.

Bitcoin was the genesis of the blockchain. The cryptocurrency uses the technology essentially as a distributed ledger for transactions.  However, around two years ago, there started to appear a number of companies that were working on blockchain-based applications separate from Bitcoin.


Friend or food?

As a virtual, decentralised currency, Bitcoin represents a challenge for governments and regulators.
Banks have a vested interest in the status quo; the system they operate within is highly regulated and it has taken a significant investment to get them to this point of operation.

But now there has developed a clear separation between Bitcoin, which uses the blockchain, and the blockchain, which can be used without Bitcoin.

The blockchain is used to store information about transactions. When you consider this at 10,000 feet, this is essentially what a bank’s core systems have been built to provide.

In essence, the blockchain is both a threat and opportunity for the banks.


Blockchain is digital banking

In some respects the blockchain is employing concepts and technologies that already exist, so what’s really new?

 

Shared ledger: Systems of record existed before the blockchain.
Cryptography: The basis of current commerce.
Smart contracts: We had this with Workflow technology
Consensus (of the nodes that validate transactions): This is new!

Fundamentally this is taking money and banks into a true digital era. What I mean by this is that most large banks have been innovating on the edges with new interfaces, UX etc.

Blockchain is using all of these technologies together and that is a key difference.The blockchain is all about technologies that are all massively compute-technology-intensive with compliance and auditing built in from scratch.


Jargon

There is significant jargon in this space: Sidechains, coloured coins, smart contracts and more. I’m not going to attempt tackle them in this article.

What should be understood, however, is that there are public and private blockchains. The private ones are permissioned with known participants, while the public ones are what are called permission-less and involve untrusted third parties.

You can store just about any information on a blockchain: Names, addresses, ID, passport, photos. In fact you could store your whole life on this medium and then employ it to validate yourself when you need to fill in forms or identify yourself.

It is expected that employing private blockchain technology to provide point solutions will be the starting point for most of the banks that are interested in the technology.

There will be a natural resistance to tackle public blockchains as this requires much greater coordination and regulatory approval.


Regulators should be friends

Regulators have yet to endorse blockchain, but neither have they condemned it as inappropriate.
There has been a strong belief that this lack of being a declared safe playground held back the technology, with the uncertainty slowing uptake.

However, this no longer the case: There is an explosion of blockchain use cases with more than 50 ways to apply this technology in innovative fashions. Over the last few weeks I’ve heard three to four pitches from new startups that are in this space.

Regulators are naturally conservative, but the power of the blockchain has great potential. Just imagine a bank having a private blockchain system used adjacent to their core banking or payments applications.

Right out of the box a blockchain has a built-in audit trail. You can trace or interrogate the data, and theoretically this would allow a regulator to perform their own searches of the data set.

That is, frankly, a scary thought for many banks but the transparency it could bring would be welcomed by regulators.


A win-win for regulators and banks?

There is a significant cost for every bank to be compliant with growing regulatory requirements – AML, FATCA, APRA and so on. Compliance costs have been a major component of strategic project spend at banks.

It is not a surprise to hear that a major bank spends $100 million to $200 million on regulatory compliance for just one small requirement.

 

This is clearly required to keep things running effectively, but each new layer of regulatory compliance adds an incredible burden and the required investment doesn’t add a single dollar of profit.

Embracing the blockchain for private in-bank use to replace existing legacy can yield immediate benefits for a bank — and immediate benefits for regulators.

It was my ‘ah ha’ moment that this is a win-win.

We have to be careful when making these kinds of changes — the implications are significant — but it is almost undeniable that the benefits will outweigh the costs both in the short and longer term.

What’s blocking the blockchain?

It is a question of ‘what’ not ‘who’ is blocking the blockchain. The ‘what’ is that adoption will take time; the systems are complex and perhaps a tad fragile. But there are benefits in to be realised when it comes to cost savings and efficiency.

Moreover the banks are embracing this threat. They realise that if they don’t, they will go the way of Kodak.

I’ve heard it said that the blockchain will be as big as the web. If that is the case then we will are witnessing a massive and significant event.

http://www.computerworld.com.au/article/590571/who-blocking-blockchain/