Blockchain Maturity Model Feedback Request – Security
The GBA is developing the Blockchain Maturity Model (BMM) and we need your input.
We are currently working on the section of the model related to security. Below is an extract of the model and we ask you to read it and provide your feedback in the form below.
Background
The purpose of the model is to provide a set of criteria for any blockchain solution. The BMM forms the basic layer of criteria. GBA Working Groups are also developing supplemental criteria that is domain-specific. For example:
The BMM has two types of requirements and expectations for assessment. They are Generic requirements and domain-specific requirements. Generic requirements refer to the set of elements that a blockchain solution should have for it to be a reliable solution. Domain-specific is a set of elements that are necessary for the application of blockchain technology for specific domains.
For a solution to be reliable for use by organizations, it must be capable of meeting requirements and expectations in the following Elements:
- Governance
- Identity Management
- Decentralization
- Performance
- Privacy
- Resilience
- Security
- Reliability
- Sustainability
Within each element, there are five levels. The five levels relate to degrees of reliability and dependability for the given element or domain-specific element. The five levels are:
| Level 1: Feasible | Suitable to assess readiness for research funding |
| Level 2: Functional | Suitable to assess functional readiness for proof-of-concept deployment |
| Level 3: Operational | Suitable to assess if a solution is ready for operational deployment – Documenting and recording |
| Level 4: Scalable | Suitable to assess scalability for enterprise-level deployment |
| Level 5: Sustainable | Suitable to assess sustainability for global-level deployment. |
To be assessed at any level, all expectations of that level, and below must be met for all of the capabilities.
Security
The goal of security in a blockchain solution is to provide assurance that adequate controls address and mitigate the security risks of its key components, composed of nodes, consensus mechanisms, infrastructure/network, system, and smart contracts.
Levels
The table below describes the requirements associated with each level. The subparagraphs below the table provide the expectations and outcomes for each level depicted in the table.
| Level 1: Feasible | Security objectives and controls for confidentiality, integrity, availability. and partition tolerance is defined for each component of the blockchain solution. Project Charter for Security shall be demonstrated. |
| Level 2: Functional | Security objectives and controls are defined and documented for each component of the blockchain solution.
A risk assessment methodology and plan is established. |
| Level 3: Operational | Security objectives and controls are defined, documented, and tested for each component of the blockchain solution.
A risk assessment is conducted, documented, and implementing the controls and document the residual risks. |
| Level 4: Scalable | Security objectives and controls are defined, documented, and tested for each component of the blockchain solution. A technical vulnerability assessment is conducted, and mitigating controls are implemented at the enterprise level. |
| Level 5: Maintainable | Security objectives and controls are defined, documented, and tested for each component of the blockchain solution. A technical vulnerability assessment is conducted, and mitigating controls are implemented at the global level. |
Please Provide Your Feedback Below
[gravityform id=”34″ title=”false” description=”false”]
Responses