Information Stewardship in the Age of Blockchain

Blockchain is presented as an emerging foundational technology for new business models and as a potentially strong answer to current Information Stewardship challenges, especially around integrity, transparency, auditability, and trusted exchange. Information Stewardship is defined as the organizational management of the information lifecycle—from creation to deletion—balancing service and control, promoting value-oriented behavior, ensuring compliance, and implementing appropriate access controls and resilience plans. Core tasks include classifying information types (regulated confidential, sensitive valuable, public), building risk registers and vulnerability assessments, propagating information value and security levels across the organization, and controlling risks through identity and access management (authentication, authorization, auditing, administration). Additional focus areas include data center risks (privileged access abuse, encryption limits, recovery planning), end-user risks (training, DLP, encryption in transit), mobile risks (minimize local data, separation, remote wipe), and organizational culture (policies, role models, incentives).

Blockchain’s key effects are described as replacing personal/institutional trust with cryptographic proofs (hashes, distributed consensus) and certifying integrity for entitled partners. Three generalized usage patterns structure its application: reliable registries of digital identities (“digital notary”), distributed attributes/rules tied to identities (“digital referee”), and distributed control of those rules (“digital court/cyber law”). The text stresses that blockchain does not solve proof of entitled authorship by itself and identifies constraints: miners must behave correctly (driving interest in permissioned ledgers), scalability and energy demands (notably proof-of-work), and the risk of hardware/knowledge oligopolies.

For Information Stewardship, blockchain’s biggest incremental value is not basic encryption or hashing (already common), but integrity assurance via replicated ledgers, storing enforceable rules/contracts, and validating data from unknown sources before processing. The report concludes blockchain’s maturity is still limited, standards and regulation remain unsettled, and organizations should learn, prototype, build rigorous business cases, and select the most suitable blockchain variant without overestimating near-term impact.

• Three information types are distinguished: regulated confidential/personal data, sensitive economically valuable data, and public data.
• A risk register process includes identifying assets, classifying threats, assessing vulnerabilities, and selecting avoidance, controls, or transfer/mitigation approaches.
• DIN ISO/IEC 27001 is described as identifying over a hundred controls and offering detailed advice on applying them.
• Verizon reported RAM scraping as a fast-growing threat in 2015.
• Verizon’s 2015 studies reported internal users caused about 20% of recorded security incidents.
• The 2016 Vormetric Data Threat Report is cited as indicating mobile intrusions were small relative to other damage at the time.
• The Economist called blockchain a “great chain of being sure about things” in Autumn 2015.
• Three blockchain consensus/validation approaches are referenced: proof-of-work (Bitcoin), proof-of-stake (Nxt), and puzzle-solving more generally.
• Blockchain is said to be unable to solve proof of entitled authorship of a transaction solely through random hashing and ledger distribution.
• Three generalized blockchain usage patterns are defined: digital notary (registry of identities), digital referee (distributed attributes/rules), and digital court/cyber law (distributed control of rules).

• “Blockchain technology seems to a promising solution.”
• “Information Stewardship balances the service and control aspects of enterprise information processing, regardless of how it is used, who owns it and where it resides.”
• “Disaster prevention is not the same as disaster recovery.”
• “Traditionally IT secures the perimeter while trusting those who are inside the network.”
• “The key factor in information leakage are the limitations of discretionary access controls.”
• “Blockchain is a ‘personal trust-replacing’ software which safeguards the accuracy of transactions through distributed algorithms and public or private ledgers online.”
• “People cooperating digitally, who don’t know and, therefore, cannot trust each other create a shared record of ownership, assets and transaction assent in a blockchain, their digital and shared version of truth.”
• “So the following three aspects remain to be solved for blockchain technology to become attractive for professional use.”
• “The convenience of blockchain related to the relatively complicated procedures of secure data handling makes it easier for end-users to behave compliantly”
• “All these opportunities and challenges must be carefully assessed, take care to avoid utopian expectations, as well as the pitfalls of technocratic reasoning and risk aversion which could restrain innovation or even make it impossible.”