I want to know that if a company wants to implement a model of blockchain, let's say for internal transactions across its offices in different countries, what are the main and important security considerations?
I know that a centralized consensus server needs to be secure, code should be free of vulnerabilities, digital signatures and algorithms used should be secure etc.
I'm more interested in high level security considerations. What security controls should be in place.
Right now for your use case, I can only think of three.
First security consideration is, is the data you plan to put in the ledger sensitive? If yes, you may need extra steps to protect what you put in the ledger. By default, the data you write is not encrypted, and is readable by everyone. There's no built in functionality of user roles and access controls in blockchain. Everyone has the ledger, everyone can read it. Nevertheless, roles and access controls can always be added at application layer.
Second, in relation to the first consideration, you need to protect all participants from unauthorised access. Since you plan to use blockchain for internal company use, I would assume that outsiders are not supposed to have access to your ledger. Using blockchain can potentially increase your attack surface, wherein every participant is equally desirable as a target since they all have the ledger and potential to participate in the blockchain.
Third, blockchain is supposedly incorruptible through consensus, meaning it should be nearly impossible to forge or tamper an entry by any means. If your nodes are quite small, you may not get this benefit, and could make it possible to tamper or forge through collusion. This can easily be remedied by ensuring there is a large number of participants, but could in turn potentially reinforce the second consideration.
These are quite generic, since the case you provided is quite generic as well. Security controls would depend on which of these are applicable to you. Hope this helps.
