# Blockchain-Based Evidence Trustworthiness System in Certification
## 3 Evidence Security
### Risk Assessment
to carry out a proper audit and obtain a certificate. The combination of the likelihood of an attack and its impact on the organization determines the security risk, following the risk matrix of Table 5 and based on the risk level guide in [11]. The higher a risk ranks for both factors, the greater threat it poses to the evidence, and its mitigation is essential (very high). In contrast, low likelihood and low impact mean low risk and priority for mitigation. For intermediate combinations, the impact has been considered to be more relevant than the likelihood of the attack, so that even with low likelihood, if the impact is moderate, the risk is also moderate. As the probability increases, so does the risk of the same impact. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack** & **Effect** & **Impact** \\ \hline \begin{tabular}{c} Eavesdrop on evidence \\ storage connection \\ \end{tabular} & \(\bullet\) & \begin{tabular}{c} Sensitive information is disclosed \\ (unfair competence, organization \\ discredit, etc.) \\ \end{tabular} & Moderate \\ \hline \begin{tabular}{c} Phishing \\ Man-in-the-Middle on \\ evidence storage connection \\ \end{tabular} & \(\bullet\) & \begin{tabular}{c} Sensitive information is disclosed \\ (unfair competence, organization \\ discredit, etc.) \\ \end{tabular} & \multirow{2}{*}{High} \\ \begin{tabular}{c} Failure access to \\ evidence storage \\ \end{tabular} & \(\bullet\) & \begin{tabular}{c} Evidences can be modified/deleted \\ (evidence and audit will not be \\ trustworthy). \\ \end{tabular} & \\ \hline \begin{tabular}{c} Denial of Service (DoS) \\ attack to the \\ evidence storage \\ \end{tabular} & \(\bullet\) & \
\begin{tabular}{c} Evidence is not available \\ Audit cannot be carried out (unfair \\ competition) \\ \end{tabular} &
\begin{tabular}{c} High \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Overview of effect and impact of the potential attacks. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Attack** & **Likelihood** & **Justification** \\ \hline \begin{tabular}{c} Eavesdrop on evidence \\ storage connection \\ \end{tabular} & Low & \(\bullet\) & Current connections are usually encrypted \\ \begin{tabular}{c} Gain read access to \\ evidence storage \\ \end{tabular} & High & \(\bullet\) & \begin{tabular}{c} Access control needs to be correctly configured \\ \(\bullet\) \\ High interest to access sensitive evidence \\ \end{tabular} \\ \begin{tabular}{c} Phishing \\ Man-in-the-Middle on \\ evidence storage connection \\ \end{tabular} & Moderate & \(\bullet\) & \begin{tabular}{c} Current connections are globally extended [16] \\ Authentication is not always strong \\ Access control needs to be correctly configured \\ \end{tabular} \\ \begin{tabular}{c} Gain write access to \\ evidence storage \\ \end{tabular} & High & \(\bullet\) & \begin{tabular}{c} High interest to modify/remove evidence \\ \(\bullet\) \\ High interest to read or modify evidence \\ \end{tabular} \\ \begin{tabular}{c} Denial of Service (DoS) \\ attack to the evidence storage \\ \end{tabular} & High & \(\bullet\) & \begin{tabular}{c} DoS attacks are globally extended [17] \\ Easy and effective \\ \end{tabular} \\ \begin{tabular}{c} Internet access down \\ \end{tabular} & Low & \(\bullet\) & It depends on the Internet operator \\ Poor private key & High & \(\bullet\) & Default or easy passwords are common \\ \
\begin{tabular}{c} Privilege Escalation \\ \end{tabular} & High & \(\bullet\) &
\begin{tabular}{c} Access control needs to be correctly configured \\ \(\bullet\) \\ High interest for a total access \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Likelihood of different attacks to happen. Based on the risk matrix, Table 6 defines the risk value for the potential attacks identified in Table 3.  
Taking into account the risk values in Table 6, some important mitigation techniques have been identified to reduce or even eliminate the identified risks.