Blockchains and Cybersecurity: Augmenting Trust with Algorithms

Cybersecurity still depends heavily on centralised systems and trusted third parties to address the trust dilemma (“can I trust you?”) and the identity dilemma (“are you who you say you are?”). These central authorities remain necessary in society and technology, yet their design creates systemic weaknesses: they become single points of failure, prime targets for advanced persistent threats, and susceptible to insider abuse through mismanaged privileged access. Traditional “walled garden” network zones can even create a dangerous illusion of safety, while trust delegation (e.g., via certificate authorities) rests on the unverified assumption that the delegate is impartial and uncompromised.

Blockchains introduce a decentralised, distributed, tamper-evident, append-only log whose integrity is maintained by algorithmic consensus and chained hashes, offering mathematical proof where trust was previously implicit. This supports traceability, independently verifiable auditing, improved integrity assurance, and resilience through elimination of single points of control and compromise. However, blockchains are not a universal replacement for centralised trust, nor do they solve human identification and contextual identity challenges; hybrid systems combining centralised and decentralised components are portrayed as the likely path forward.

The text distinguishes decentralised from merely distributed systems, argues blockchains should be understood as an immature platform/protocol family rather than a database or standalone application, and warns against hype-driven adoption. Promising cybersecurity use cases include strengthening DNS and PKI, device integrity and configuration management (especially for IoT/Identity of Things), real-time security intelligence, and tamper-evident logging for internal and cross-organisational audits. Key challenges include access control and privacy in transparent logs, incentive design, consensus performance costs, and new attack classes (e.g., 51% and selfish miner attacks). The overall stance is cautious experimentation: start with low-risk, high-value integrity and auditability use cases while maintaining core security fundamentals.

• Centralised authoritative systems are key targets of advanced persistent threats (APTs).
• Mismanagement of privileged access makes centralised trusted systems prone to insider abuse.
• DNS and public key infrastructure (PKI) rely on hierarchical authority structures where root nodes are treated as final sources of truth.
• Gaining control of topmost DNS or PKI nodes enables broad impersonation and fabrication of identity assertions across internet-based systems.
• Pretty Good Privacy (PGP) relies on user-generated key pairs and a “web of trust” rather than a certificate authority.
• The DigiNotar compromise demonstrated that a breached certificate authority can enable extensive impersonation attacks.
• Merkle trees were invented in 1979 and are used to efficiently verify large data sets by comparing top hash values.
• Bitcoin provides pseudo-anonymity while making transaction histories publicly visible to all participants.
• A 51% attack can compromise a blockchain’s integrity if an attacker coordinates a majority of participating nodes.
• A selfish miner attack can be executed by a sufficiently large pool (described as 25%) that withholds blocks to gain advantage and slow the network.

• “The promise of blockchains to replace trust with mathematical proof holds such an alluring appeal.”
• “Security by nihilism: start from the assumption that the system could be compromised and nothing can be trusted.”
• “Who audits the auditors?”
• “The invention of the ship was also the invention of the shipwreck. Every technology carries its own negativity, which is invented at the same time as technical progress.”
• “Distributed systems are not enough however – DNS and PKI servers are already distributed globally and highly resilient to system faults – decentralisation, transparency and publically-verifiable information integrity is the real challenge.”
• “Blockchains are not a distributed database, as their linear, append-only data structure fails to provide essential features described in formal definitions of a database.”
• “A blockchain which cannot be independently verified cannot properly be called a blockchain.”
• “A proper use of any blockchain would be as a means of the verification of sensitive information or transactions between parties, not the storage of the sensitive information itself.”
• “Decentralised consensus is expensive and very slow compared to traditional, centralised systems.”
• “Proceed with caution!”