# Blockchain-Based Evidence Trustworthiness System in Certification
## 3 Evidence Security
### Risk Mitigation  
Blockchain technology is increasingly being recognized as a suitable technology for auditing due to its key features: decentralization, transparency, traceability, immutability, and integrity protection [19; 20; 21]. However, traditional databases and replicated databases are also worth considering. Blockchain and traditional databases might seem similar, as both are used to store information in a distributed or centralized manner. However, Blockchain offers more than just data storage [22]. Here are several key differences between the two technologies. * In Blockchain, each node participates in a consensus mechanism to verify transactions, providing equal access and capabilities, thus democratizing the system. * Traditional databases, on the other hand, are controlled by a central authority (administrator), making Blockchain advantageous as it eliminates the need for trust by design. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Attack** & **Likelihood** & **Impact** & **Risk** \\ \hline \hline \multicolumn{4}{c}{Eavesdrop on evidence storage} \\ \multicolumn{4}{c}{connection} \\ \multicolumn{4}{c}{Gain read access to evidence} \\ \multicolumn{4}{c}{storage} \\ \multicolumn{4}{c}{Phishing} \\ \multicolumn{4}{c}{Man-in-the-Middle on evidence} \\ \multicolumn{4}{c}{storage connection} \\ \multicolumn{4}{c}{Gain write access to evidence} \\ \multicolumn{4}{c}{storage} \\ \multicolumn{4}{c}{Denial of Service (DoS) attack to} \\ \multicolumn{4}{c}{the evidence storage} \\ \multicolumn{4}{c}{Internet access down} \\ \multicolumn{4}{c}{Poor private key} \\ \multicolumn{4}{c}{Privilege Escalation} \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Overview of the risk of the potential attacks. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Likelihood** & **Low Impact** & **Moderate Impact** & **High Impact** \\ \hline
**Low** & Low & Moderate & Moderate \\
**Moderate** & Moderate & Moderate & High \\
**High** & Moderate & High & Very High \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Risk matrix. * Blockchain distributes data across all nodes, and each node stores a copy of the entire Blockchain. This setup ensures that even if some nodes are compromised, the system remains operational, making single-point failure infeasible. * Traditional databases store data centrally on a server, which is more vulnerable to attacks. * Data Handling:
* In Blockchain, data cannot be deleted; once recorded, it remains forever. For an audit trail, updating evidence is not necessary, as any update is considered new evidence. Deleting existing information is also not a requirement for an audit trail; in fact, not being able to remove information is beneficial to the transparency and trustworthiness of the audit solution. * Traditional databases offer more functionalities, such as updating and deleting data. * Blockchain ensures data integrity through a consensus mechanism where all nodes validate transactions and store a copy of the entire Blockchain, making it nearly impossible for a malicious actor to alter the data. * Traditional databases are more vulnerable if the administrator is compromised. * In Blockchain, all nodes have the same access and capabilities, ensuring transparency by design. * In traditional databases, the administrator controls who can access the data and what actions they can perform. * Implementation and Maintenance Costs:
* Blockchain is a relatively new technology, and its implementation and maintenance are generally more expensive than traditional databases. However, as Blockchain technology becomes more widespread, these costs are decreasing. * Traditional databases have more contained and predictable costs. * Blockchain is slow due to additional operations like signature verifications and consensus mechanisms. However, although desired, high performance on audit trails is not an essential requirement. * Traditional databases, however, are known for their fast execution times and the ability to handle large volumes of data.