Building a Strong Defense: Best Practices for Securing Web3 Protocols

Transcript

foreign hey everyone I'm super excited to be here today we're going to talk about building a stroke defense basically best practices in securing D5 protocols my name is Jennifer nissanboy I'm the CEO and co-founder at exagate with over 20 years of experience in cyber security and a Serial entrepreneur now everybody here is I'm guessing love to build Lego right and Defy is a money Lego like unlike the early days of crypto we're a system were very simple now we're talking about complex system with many moving parts from Oracle to Smart contract that you are dependent on

to token that you dependent on to configuration and and many many moving parts that just makes security very very complex so it's not only that everything is open accessible we have multiple attack vectors from cyber exploits to financial exploits to third-party dependencies to Administration governance and many more and it makes the hacker lives like very very easy they are highly motivated into hacking into this D5 protocol and again it's not only like the systems are complex they have many moving Parts

everything is open we have direct access to money direct access to value now a hacker in the traditional world when you hacks something you need to do some sort of a ransomware or to start a negotiation with the team to get money here we are one transaction away from getting a protocol wiped and a hacker getting all of the funds and we are seeing all across like the last year and before that and I think like just the presenter before me from Quantum just like showed all of the hacks that that happened we're seeing it happening all the time right

so it's not a question of if and we're working with many protocols and many prospects and like they are asking us I'm not sure I will be hacked I'm battle tested I did so many Audits and we're saying to them all the time it's not a question of if but rather when so what can be done so first thing is get visibility and prepare and I think that if you were here earlier today so Heidi from coinbase 0x Labs team talked about it so much it's prepare prepare prepare some in some point in time you're about to get wrecked and I can see you here

um so how you get visibility and prepare right so first thing is you need to map this is mapping your known threats so this is what you're doing with companies like sritora with formal verification with auditing you need to map your invariants you need to map your first body code you need to hunt the zero day vulnerabilities you need to map all of your third-party dependencies and this is just the first step then you need to go and review your internal security procedures so you need to understand how you assess risk which Personnel do you have in place what are your access controls so for example like in muted panel about bridges so many hacks happen

before because like people don't really manage their multi-six right so you need to understand your security procedures then you need to take into account your the way that your protocol operates like who is or what is the profile of your ecosystem right what is your risk tolerance what is significant loss meaning to you because for example not all protocols can pause your smart contracts right so this is something which is very important and again prepare prepare and prepare in some point in time the worst case scenario will happen and then this is this is the moment in time where you

will be asked to give answers to the ecosystem right so I want to talk about how we are moving from periodic audits into ongoing protection so you did an audit right you hunt for the zero day vulnerabilities now you need to basically shift this Paradigm and instead of hunting for vulnerabilities you want to start hunt for the threat themselves you want to hunt for the hackers right so this is the next step after an audit so you need to have and where we talk about it a lot here you need to monitor for threats and again you're monitoring for the activity on chain for the malicious

activity on chain because you want to detect this malicious activity before it impacts you you need to have the remediation plan right and having the remediation plan is for each and every type of alert because there will be alerts that you won't have time to react on so they need to be automated there will be alert that can be semi-automated there will be alerts that you will have a team inside you will maybe take your developers maybe you need to have a security researcher in place but eventually you need to have playbooks and prepare for everything and of course Insurance response right worst case scenario happened what do you do you need to have red team you need to have proper War uh War rooms you need to

coordinate everything and we'll touch upon it soon so the three pillars of ongoing protection the way that we see it and I'm guessing everybody in this uh in this Auditorium from the space can relate to that so you need to have early detection time is really important in D5 we are one transaction away from getting wiped you need to be very accurate and of course you know I can't say that we are 100 accurate and if you will hear a security company saying that they are 100 accurate they lie right you need to minimize the false positive rate you need to have I'm guessing more than like like in traditional cyber security in some cases even more than one thread feed because you want to increase your

accuracy and you need to have a way to minimum to minimize the response time so how can we manage pre and post incidents I want to give you a glimpse of how we work with our customers basically our concept of pre-incidence response right so if you take a look and we did it uh and I think this is one of the thing the benefits in crypto in blockchain everything is on chain so you get data from the Genesis block it really helps us to build the models so you basically try to track malicious activity and malicious activity follows specific pattern right so it starts with funding

and in funding you basically your goal or our goal is to detect this like funding signals on chain right when we understand that there is like a malicious funding we want to collect the signals and let the security team of the protocol that something bad is about to happen but it's still not decisive it's just funding right but you collect the signals you want to reduce the noise you want to reduce the noise uh the noise in the system then you are in the preparation phase where the attacker is deploying a malicious smart contract this is where you want to start to react on right so we will send an alert to the security team and then we want to see how they are blocking the

malicious activity again this is not one size fits all right you need to have the proper instance response plan you need to know what your block when to block but the goal will be of when the hacker will run an exploit you will be protected and the next phase which is laundering will just not happen right because it won't be hacked but worst case scenario happened so pause instant what do you do first pause everything like we've been in dozens of War rooms we contacted protocols when they got hacked and we set them pause the protocol and they they take their time

and like the first hack was small the second one the second one just wiped everything right so you want to avoid the next hack you need to be able to open a war room and everybody opens a war room right it's on telegram it's chaotic right everybody asks who who knows uh coinbase who knows balance you need to be able to prepare in advance in the War Room you communicate with your community right you do a triaging you do a full process of understanding what is happening and what what are the next steps one of the next steps will be contacting the law enforcement you need to give them reports you need to contact

centralized exchanges you need to contact Circle you need to contact feather and why is that because you want to limit the blast radius right you want to be able to freeze assets and of course you want to track the funding sources of the attacker because in many cases it will allow you to identify his identity thanks if you want to learn more [Applause]