# Blockchain-Based Evidence Trustworthiness System in Certification
## 5 Validation and Results
### Cybersecurity Certification
This tool allows the manual verification process described in Figure 4 by manually obtaining the hash of the evidence or the assessment result from the dashboard, accessing the local storage where the raw evidence or assessment result is stored, calculating its hash and comparing it with the one obtained from the Blockchain monitor. Auditors also need an automated method to verify the integrity of evidence and assessment results, in addition to manually accessing their hashes and contextual information through the Blockchain monitor. The automatic verification service fulfils this requirement by providing a tool that allows auditors to automatically validate evidence and assessment results from the local storage against the Blockchain records. The automatic verification service allows automatic verification of all locally recorded evidence and assessment results. As a result, the list of identifiers of the available evidence or assessment results is shown, as well as their integrity verification results. If the integrity verification is positive (hashes match), a green result is shown. In contrast, if the integrity  
Figure 6: Data model for the trustworthiness system. verification is negative (hashes are different), a red result is shown, meaning that the evidence or the assessment result has been modified in some way and cannot be considered trustworthy. Moreover, if the hash of some of the evidence or assessment results cannot be found in the Blockchain because it has not been previously recorded (e.g., old evidence from before using the evidence trustworthiness system), a \"Not found\" message will be shown, meaning that the trustworthiness cannot be guaranteed for better or worse. Figure 8 shows an example of the complete list of recorded evidence where a negative integrity verification result has been detected. This process is likely to take considerable time to complete and will grow with the number of pieces of evidence or assessment results to be validated. However, there are situations where it is not required to verify all of them (e.g., in cases of reassessment due to a particular nonconformity). For this reason, the integrity verification service also allows the application of filters based on the contextual information defined in the data model in Figure 6. Figure 9 shows an example in which two different filters have been created for the contextual information of the evidence: the cloud service identifier to which it refers (cspld in Figure 6), and the identifier of the tool used to gather the evidence (toolld in Figure 6). The application of these filters results in a reduction in the number of results from the list shown in Figure 8 to only those that meet the filters values. Thus, the execution time will be shorter. Any of the attributes considered in Figure 6 could be considered as filters. It is also possible to verify the integrity of a particular evidence or assessment result. For this purpose, a filter for the identifier of the evidence or the assessment result is defined to limit the results of Figure 8 to the single evidence or assessment result of interest. This execution is virtually instantaneous. As a result, the evidence trustworthiness system offers a way to securitize evidence and assist in a trustworthy certification process, providing the following benefits:  
* Improves the integrity, reliability and transparency of the evidence in 100% of cases. * Increases auditor confidence, and certifications are completed in a shorter time, as auditors do not need to manually verify evidence, and thus, costs are reduced. * Enhances problem detection. The automatic integrity check functionality provides an easy way to detect evidence tampering. Figure 7: Trustworthiness system dashboard. The proposed system is based on the existing audit trail solution from the literature [38] which already outperformed existing solutions in terms of deep technical details, usability, and adaptability.