Appendix 1. Assessment

Chapter 1: Cyber Threat Landscape and Security Challenges

1. There are several open standard and proprietary ways to be updated with adversaries' capabilities. MITRE's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) is one of the widely used frameworks for cyber adversary patterns, reflecting the various phases of an adversary's life cycle and the platforms they are known to target. MITRE has developed three categories to determine an adversary's main capabilities: pre-attack, attack for enterprise, and attack mobile profile.
2. Cyber threat intelligence starts with collecting a lot of data and information. It includes these steps: establishing an intelligence priority framework, collaborating with intelligence sources, consulting with threat intelligence experts, and then coming to a conclusion on the solution.
3. There are several technologies knocking at the door almost every quarter; however, it is important to understand the effectiveness and purpose of a specific technology before it can be given a chance. Security stakeholders should take part in privately-held security conferences and popular public forums including the RSA Conference, Black Hat Conference, DEFCON Hacking Conference, Cloud Security Expo, SANS Summit, Infosecurity Europe, World Cybersecurity Congress, Infosec World, the International Conference on Cybersecurity, and many more. CISO and CSO should also consider joining some of the independent security research companies, such as Gartner and Forrester.

Chapter 2: Security Must Evolve

1. The zero-trust approach requires complete visibility and control over the network. This takes several human hours to perform the assessment and internal network audit. It is critical to understand the concept of network avenues, vulnerabilities, third-party channels, business partner networks, DMZ, and so on, before a zero-trust approach can be considered. Most organizations tend to use default settings with most of their applications and network devices, which can also be a problem in deploying an efficient zero-trust approach.
2. The breach-assume approach helps organizations to prepare for data-breach conditions so that a better cyber defense program can be planned. The breach-assume mindset requires continuous network and application monitoring with an added layer of incident response planning. It is important to segregate normal traffic and abnormal traffic, applying an appropriate policy and response to each dataset. This entire process must be undertaken carefully and precisely, as a small mistake can disturb the whole approach.
3. The internet was never built to be used for financial systems and critical asset transfers. However, since becoming highly dependent on the internet, organizations are now continually adding new security layers to defend critical infrastructure. Almost all business applications are running over client-server frameworks to support existing TCP/IP internet stacks; moving from a centralized database needs a high degree of interoperability support and industry acceptance.

Chapter 3: Introducing Blockchain and Ethereum

1. No, it can't be used for business applications because applications need to be programmed based on requirements. Bitcoin blockchain is built to be rigid in nature, making it impractical for business applications.
2. The future of Ethereum depends on its industry adoption and then the ether. Although in the current situation, the Ethereum market doesn't look that stable, it has got potential to thrive in the market for long-term business opportunities. The founder of Ethereum is several ways to improve the existing consensus and make it a more energy-efficient solution to mine ether.

Chapter 4: Hyperledger – Blockchain for Businesses

1. No, IBM and The Linux Foundation have specifically focused on building a private blockchain environment for businesses. Hyperledger Fabric is built to provide a better framework for permissioned networks, where all participants have known identities.
2. Although there have been several use cases released to connect blockchain with traditional databases, none of them have a proven framework.

Chapter 5: Blockchain on the CIA Security Triad 

1. As Hyperledger Fabric is built on the same distributed ledger system, it has similar features and properties to blockchain. Hyperledger Fabric is even more secure and reliable for business applications. It fulfills all the CIA Security triad conditions with its permissioned database structure.
2. In order to achieve high availability for dApp, it is important to work on frontend development that still works with traditional JavaScript and HTML programming languages. 

Chapter 6: Deploying PKI-Based Identity with Blockchain

1. Cryptographic key management is the most critical objective for any organization. Employees use Hardware Security Modules (HSMs) for signing a small volume of documents or code, authenticating to VPNs or any other network. HSM can also API and can support automated workflow. Secondly, Physically Unclonable Function (PUF) technology has been a paradigm shift in key protection. With this technology, keys can directly be derived from the unique physical properties of the chip's SRAM memory. 

2. Guardtime, a software security company based in Amsterdam, has come up with the Keyless Signature Infrastructure (KSI) technology to transform PKI. KSI technology uses hash function cryptography, allowing it to rely only on the security of hash functions using blockchain.

Chapter 7: Two-Factor Authentication with Blockchain

1. Yes, Ethereum can even be used to develop a multi-factor authentication platform by programming a smart contract. This smart contract has to be programmed to connect with several integrations, such as biometric and mobile applications.
2. In order to achieve an SMS-based 2FA platform, Ethereum's smart contract has to be programmed to integrate with the SMS gateway to send a One Time Password (OTP) for a second level of authentication. This OTP protects against Man-in-the-Middle (MITM) attacks. 

Chapter 8: Blockchain-Based DNS Security Platform

1. DNS tunneling is a misuse of DNS. Domain Name Server (DNS) has been called the internet's equivalent of a phone book. Rather than remembering an IP address with up to twelve digits, you just need to know the domain name associated with the IP address. DNS tunneling attempts to hijack the protocol to use it as a covert communications protocol or a means of data exfiltration. It is a broadly overlooked security threat.
2. Yes, it can be done. Emercoin built a complete DNS solution over blockchain where ЕmеrСоіn іѕ а рlаtfоrm bаѕеd оn thе рорulаr vіrtuаl сurrеnсу Рееrсоіn. Ѕоmе DNЅ fеаturеѕ аrе аlѕо fоrkеd frоm Nаmесоіn. Тhе ѕуѕtеm uѕеѕ а ѕесоnd-gеnеrаtіоn Рrооf-of-Ѕtаkе (PoS) аlgоrіthm. Тhаt'ѕ whу іt саn funсtіоn wіthоut mіnіng. Тhіѕ mаkеѕ ЕmеrСоіn есо-frіеndlу аnd mоrе rеѕіѕtаnt tо 51% оf аttасkѕ. А tоtаl оf оnе bіllіоn ЕМСѕ wіll bе mіntеd.

Chapter 9: Deploying Blockchain-Based DDoS Protection

1. Recent research found a 55% increase in large DDoS attacks of more than 10 Gbps in the first quarter of 2017, compared to the previous quarter. DDoS experts predict that advanced, volumetric attacks will become more common in the near future. A growing use of dark web marketplaces and open source software platforms have caused an increase in DDoS incidences, and a huge number of IoT devices, such as connected refrigerators or other smart devices, have minimal security and could easily be looped into an attack like this. Attackers are using DDoS as a tool to knock things offline that they don't like, and such tools are freely available on the internet.
2. Although there can't be a perfect answer to this, there are several initiatives to stop DDoS attacks. A decentralized platform allows users to rent out their bandwidth, which can then be pooled to allow for substantially greater amounts of data processing, greatly reducing the risk of DDoS success.

Chapter 10: Facts about Blockchain and Cyber Security

1. The most effective and popular decision path has been developed by IBM. This helps organizations to decide on the appropriate blockchain model. This includes several factors, such as the cost-reduction approach, improving discoverability, and many more.
2. Blockchain has its biggest challenge with industry awareness. Although several startups are developing innovative products with blockchain, it is still difficult to determine its effectiveness. The Linux Foundation has come up with a great initiative for collaborating with industry leaders to develop an open source blockchain platform for businesses, and named the project Hyperledger. The Hyperledger project may be a driving factor in establishing rapid growth for blockchain technology.