Not a Walk on the Block: A CISO's Journey from Web2 to Web3

Transcript

all right thank you H hi everyone I am crer I am a chief information security officer uh at starwell been working there for the past two years also in web free for the past two years I'm here to talk about challenges uh I had as a security officer and also as a security professional uh in web 2 coming to web three and the biggest challenge I hope will be to make this in 10 minutes or less so good luck um about myself I've been working two decades in cyber security started as a researcher a malware analyst and then later uh exploitation mobile uh web uh

later on manager of security engineering and research team I like to keep hands on and uh solve complex problems uh that's one of the reason I wanted to choose blockchain and web free and I'm very excited that I have done it um but uh when I came to stock and web free nothing prepared me for uh web free uh security Mayhem so many attack vectors interesting uh assets to to protect and from Web Two from web three and I'll share a little bit about the the Fret actors the Frets and what I think can be good for security leader in protecting web free and

defi so let's talk a little bit about Web Two frat actors uh the first we have the skip kitties they open command line you know and they I think they hackers so these are not really threat for us this is one example but we have also back bounty hunters sometimes they can be also blackhe whets uh usually uh um issues uh related uh are reported and and being paid for sometimes they are deciding to do also be malicious uh next we can have an example of activist group like the anonymous team uh usually doing dos uh in web two

as far as I have seen and uh essentially the I wanted to mention the insid of threat uh in web two uh which can be devastating up to an extent um when it comes to web free attacks or or threat actors uh the malicious Insider uh the same one from before as much more incentive because this is multi-million dollars and it can do a lot of damage right compromise private keys for example when you have access to the company sometimes there even worse project that can do rock pools like uh it can be related to a malicious Insider or Executives or the entire project is malicious in order to pump and trick users

essentially stealing money so this is another uh big problem we have in the industry uh we have also the AP groups organized crime that are not be nation state that also decides to deal with crypto which we need to deal with and the lastly the most uh threatening threat is the uh nation state ters like dprk lazaros group which can be very very uh and have done a lot of damage so my point is that web free threats are much more targeted than Focus uh they are behind social engineering Mastermind uh sometimes they can for example have lateral movement they hack a Twitter

account or a telegram account and then they reach out to people that they know trying to install or download something some recently even been hired as it or Dev uh which is devastating because they can cause a lot of damage inside they are highly skilled they are usually patients and most of them know how to mix and demix very quickly thus allowing them to do money lering uh we talked a little bit about web twox and this is also a problem in web 3 because Web Two Hax are easy leverage into a key compromise for example if I manage to have a Trojan or on a computer we' have seen recently a lot of attacks against multi where troan

ores can be used to steal or or uh or trick users into signning with cold wallet uh important uh on fake data we also have application security that we need to be taken care of cloud security misconfiguration and social media so yeah we don't have a lot of time but there are so many threats to deal with in web 3 also coming from Web Two uh as a ciso it is not the most relaxing job in the world because if the attackers have built correctly their uh way of exploitation the execution is usually within minutes on chain uh running attack is one examples of very strong

social engineering where they stole more than $600 million uh Wormhole wasir X more recently uh so very very big damage in minutes so how do you prepare for that uh on web 2 my previous companies you call an IR F they come they take a m dump but we do not have the time for that right it's minutes we don't have hours we don't have days we have to react quickly and above all after all we also have govern government and legal risk which I know is a bit controversial in defi but as a ciso you also have to swim between the lanes and also keep due diligence and compliance wherever you can in order to support uh the users in

various countries so with all those threats and risk how what do we do now uh what I did in every company that I come to do a security I usually do a risk assessment sometimes I use framework like n like Mitra so I had to adjust the threet actor and how it's bigger than usual in web fre and in web two and their capabilities uh there are few minutes to effective immediate response it's now a decentralized risk assessment versus centralized it's not one entity and it is not your typical ciso SO2 or ISO 271 checklist it's not like you are going to install a EDR do some uh

encryption and you are safe maybe you are safe from so is 2701 but you are not really safe from uh web free hackers so this actually presented an opportunity for me as a sister to be practical to focus on the important areas rather than just the checklist and I tried also to navigate between constant changes in various countries and even due diligence by Major vendors from different countries um sorry yeah so addressing web free risks the first thing that you have to

do in order to be prepared is to have an incident response plan ready with pre-b Playbook play a war game with your security team imagine the worst case scenarios that can happens and have a prepared list afterwards build a realtime monitoring for those exact scenarios how do you track them work with there are many good web free security monitor companies that you can work with and build those pre-build playbooks in order to detect them in real time and you also have to have a emergency response for those exact pre-build playbooks those responses should also be decentralized by some kind of Security Council like if there is a risk of uh several uh companies

that you work with report that there is a a risk of um Lo lost money or still asset then you can maybe freeze the network may may be POS but you have to do that in a secure way without false positive because otherwise this false positive can also become an attack Vector so this is challenging and also need to be decentralized uh proa activ L navigate the rapid changeing regulations as well other things you can do War Games as talked been to In in this conference already S is doing war games and other organization and companies as well do it internally do it externally train your people with the IR plan that you have pre-built secure development fuzing

formal verification when you can testing coverage uh internal Audits and once you ready do the external audit and audit competition which is also very useful at the end do an effective back Bounty program make sure that you Scope the things that you care about so you don't get H not you can waste a lot of time if your bu Bounty program not is not scoped um community and ecosystem involvement is highly important for stet we have a starnet security community and also it's important not just to have the community report to you issues and have a way to uh Pi you up it's also important to protect them uh work with uh protect user from fishing for example

we work with wallets like our wallets uh braavos and Argent uh they we we work with um blockade to protect users within the web free from fishing so invest in protecting your users uh and at the end if you are hacked make sure that you also have follow the money solution so that you can return some of the funds uh that's also important so I'm run out of time summary there is unique challenges in securing web three and coming from web three from web 2 to web 3 I learned a lot I hope that other people will learn from that as well thank you [Applause]