Security best practices: the front end process with Matt Gleason

Transcript

[Music] we're covering security best practices um this is a very very broad topic so I'll further Define kind of what I'll be covering so what I'll be going over is what you can expect to see in terms of who is trying to tactically kind of get crypto from you what they're trying to do and then how we can try to address said so I'll kind of go through that structure and at the end I'll leave time for questions let's start with kind of what tends to go wrong so we see a lot of these very large crypto hacks we see stuff like poly Network allows billions of dollars in tokens to be printed or

Mixon gets hacked for $200 million or Wormhole gets hacked for you know 375 but what does all this actually mean right it means that there's groups there trying to get crypto out of the hands of kind of legitimate Enterprises so who am I um I used to be a software engineer I became what is called an offensive security person which really just means I ran some of these operations that you tend to see these um kind of criminal groups run right so I've gone to infrastructure providers or governments or retailers hacked into all their stuff taken everything done the trophy hunt gone through all of that I also do appc which

is kind of a different discipline but that's neither here nor there um around 2017 I was helping blockchain companies try to be more secure um some of the biggest baddest names you've heard of and then in 2021 I decided to make the pivot almost completely into smart contracts blockchain and all of that because the security need was obviously very there so I also tend to deal with when our portfolio companies get hacked so some of these are like very apt descriptions of things I may or may not have seen before so who are all these hackers it's actually a good question so I gave them kind of names so you tend to have a hacker like Phineas um these are real

hackers by the way um they're independent actors they're very idealistic they go after specific things to leak things about organizations they don't like um then you have criminal groups one criminal group that we can call out from the last two years is lapsis um they were from the UK they've been arrested they've been stopped but what they did in the meantime is kind of go into big Enterprises take as much data as they could Ransom it and kind of get as much money as they could then we have the scarier guys this is like Lazarus and the mid-level aps when we say AP what we really mean is an organization that is involved with the government in some way right Lazarus in this case is related to the Democratic

People's Republic of Korea AKA North Korea then we have the ones we Dub with like fun names like Sand Eagle um they're the very very scary ones they're the ones you tend to think of when you go oh who's hacking everyone that's it's probably them um in the case here we really only care about these two groups right we care about the criminal organizations who are trying to get into your Enterprises to steal your stuff and we care about the mid-level nation states who have made it very clear that they're after you they're after the crypto you have and they want it pretty bad so what motivates these groups right there's really three things

so in phineas's case you have activism right they hate an organization so much they're going to hack in they're going to take everything they're going to disclose it to the world and that's what they're going to do in the criminal groups and mid-level APS we're talking more of this financially motivated criminal activity so they're trying to steal crypto from you they're trying to steal credit cards trying to get your data they'll Ransom it if they have to they'll sell it and oddly enough they're also trying to sell access so if they get access to your org and some government wants access they can go to the government and say hey here's the access you wanted then we have the big guys the big guns what are they up to they're stealing plane Secrets right

they're going they want to know like how is this Westman system built they can find out they're surveilling enemies of the state if they see someone and they're like hey I want to know what this person is doing they just go into their phone monitor what they're doing yada yada and then they also do destruction campaigns and this is a very real thing right you hear about it in Ukraine you hear about it being done against Iran so specifically stuff like stuck net where they go in they go into infrastructure they destroy it and that's their whole thing so again we're going to focus on these guys and specifically this small part right which is they're trying to steal your crypto so what does this mean for all of us

well really realistically it means if we have crypto we're a Target if our organization has crypto it's a Target if our customer has crypto or customers have crypto they're a Target right and we probably should do something about it at least in terms of what we can so let's analyze what they're doing so typically it' be tools techniques and procedures TTP but we're really only going to go through the techniques part of this and we're going to go through it like very high level if you have an organization and they're trying to operationalize stealing stuff from people they're going to basically have some set of operations they run they're going to run them

repeatedly and that's kind of like how they're successful and in this case what they'll do is they'll gain access to an asset or an account they'll see what is this like what data does this have access to what like can I propagate to more access and can I use this to hack into other things like that's what their interest is that's what they're going to do so as we review through this consider that's what's going through their brain they're just like hey I run this what's the next step so the first thing we have in terms of class of attacks is attacks against accounts so this is typically what you would see or what you would like see on Twitter this is your sim swaps and your password guessing or compromise password

usage so as released I think yesterday or the day before um Sim swaps are basically someone bribing a mobile employee few hundred and getting your phone number right it's an inevitability they can do it if they want to if you're using it to guard something like Twitter like what happened to vitalic they get access to your Twitter they send out a call that says hey people you know come to this cool crypto site and they make $700,000 right in terms of passwords something that really illustrates kind of the plight of how passwords have been used in the past is when I used to be doing this

professionally all the time there was kind of a meme which is like spring 2017 exclamation point was a really common password in April of 2017 and when I say really common I mean between half a percent and 1.5% of all passwords on a network right that's an amazingly potent fact right so this is something we have to defend against there will be people who like not intentionally misuse um how these things work but like as you scale and as you have organizations you have to be cognizant of these things next we have class of attacks that go after people specifically so this is two main things

this is fishing which is trying to kind of get you to do something you're unwilling to do and bribery which is trying to pay you to do something for them the reason I mentioned bribery is because it is becoming all too common you may have seen a text before right hey I'd like to interview you for this really cool job uh you just need to download this really weird video conferencing client right that's a way for them to try to get on your computer to use your computer to get access to things that's an attack against you as an individual less so your you as an organization but as you get employees you should expect to see these kinds of operations run against them and then you have kind of the operational bribery stuff so this is

what's happening at like T-Mobile and this is what happens when kind of you're offboarding someone so if these guys here like hey they're about to offboard 50 people they can just start messaging your people and say hey would you like to make a few thousand dollars today right I just needed you to download this run this on your computer next we have attacked Technologies so this is what you usually associate with hacking this is I have a known vulnerability in something I weaponize it and I get access or I see something that looks fishy I find a vulnerability and get access it is always the case that these groups have the ability to operationalize like finding

vulnerabilities so if you have code that's customly written that hasn't been vetted that guards a lot of assets you can expect them to spend some time trying to break into it right the on the other side when you're dealing with bugs that we know about um patching everything all the time and patching it uniformly is very very difficult right it's gotten easier over time but it's still a thing we all struggle with so this is something we expect to see operationalized repeatedly and very often the last one is a little bit more sophisticated this one is an attack against dependencies so it may not be they attack you directly they may go to you

through a vendor so you may have some vendor who's helping you write some software who's or who's helping you like perform some task on behalf of your organization well that makes that vendor a target for some of these groups to get to you specifically right so in the case of a Target breach if you're not familiar in 2013 all Targets Point of Sales Systems are compromised how did they get compromised well they went after an HVAC contractor related to Target got his information and then used it to get into all the stores right so they go after dependencies they do this repeatedly and it is something they're getting much better at right the second

one the the untold story that's about solar winds so if you're not aware of what happened to solar winds they got into basically this network security Appliance tool that everyone puts on their sensitive networks they went into the CI system they put a back door into it so basically they had they now had access to those sensitive networks they got access to a ton of things it was a very very big deal right these are things we see you as your like smaller companies shouldn't expect to see this all the time but you just you have to be cognizant of it so now how do we put this all together so if I were performing an operation right I've described to you a few things you can do

but like what actually happens so this is kind of the typical Playbook so first you fish or guess your way in right like now I have an account I'm in a network you scan everything you try to find a few vulnerabilities you exploit those systems you take all the passwords you can off those systems once you have the passwords you propagate out access and then you just repeat repeat that Loop over and over eventually you take the whole Enterprise everything then you're on what's called a trophy hunt you're looking for the things they don't want you to access and the way you do this typically is you go onto the person who has access to the thing you camp on their system and you wait for them to access it and after you do that you

profit uh this is more of like a Defcon esque meme but yeah so how do we think about this problem so the problem of security is foundationally a prioritization issue right you don't have infinite time but either do the attackers right and so what you want to do is prioritize fixing things that are likely to happen fixing things that are impactful fixing them as completely as you can and trying not to annoy people as you kind of go through that process by doing this you'll make it a little bit harder for the attackers to attack you and hopefully by the time they might be able to get in they'll lose patience and go somewhere else in terms of

likelihood it's actually a really hard metric to diagnose right because all these people's like goals change over time and so just at a high level in terms of like my own mental model here's a set of things you could you're likely to expect to see right you're very likely to see fishing you're very likely to see a Sim swap you're pretty likely to see someone's password get guest you're decent ly likely to see kind of a simple smart contract exploit you're less likely to see a disgruntled the employee give someone access to your network you're way less likely to have a vendor compromised and the worst case is you're very unlikely to make someone mad

enough that they will spend as much time as it takes to get into your system to break into everything and to take everything which is absolutely to be avoided in terms of impact impact's easy to kind of think about casually but realistically it's actually difficult to quantify the reason here is that access kind of begets access so once they get access into your network or access to your assets they're trying to get more right and you either need to catch them and get them out or they'll continue to get it and so once they kind of get their hooks in you can kind of expect them to try like to try to get more and to in all honesty usually get there right and so when we're thinking about

this we want to consider three things we want to consider if they can compromise accounts that are unrelated to our business mostly related to ourselves so this is like social media um iCloud Google account backups if you're not running uh G Suite as your Corporate email these are things like your corporate emails your corporate networks if you have them and your corporate Cloud accounts as well as access to crypto funds as we remember from their motivations that's what they're after if they get get access they will leverage it um they have done that repeatedly they'll continue to do that so in terms of prioritization let's kind of just go through it just one after another if we're afraid of a employee password

getting guessed how do we fix it well is this likely according to the mental model it's decently likely so say we have a VPN they can log into it and get into our corporate Network so how do we keep this from being a problem so we can do something like impose that multiactor be used on the VPN but once we do that what does that actually fix it makes sure they can't get on our network but chances are if it's a corporate account doesn't make sure they can't access the corporate account right they may get access to emails they may use that to get more data on us they may use that to basically fish others to try to convince them hey I'm having trouble with this running this can you help me right you

kind of wanted to avoid that so you go to the more complete option which is to just have MFA on your corporate account right it's useless to guess a password if you also have a code or preferably a key right like one of these attached to your account next let's go through something like end days so an endday is a known vulnerability you've had n number of days to patch it so if we have or suspect we have a vulnerability on our perimeter right this is either perimeter of our Cloud environment or perimeter of our company as a whole and we know it's there or we know it's probably there what can we do to reduce the likelihood

or reduce the impact right we can obviously try to restrict network access but in a lot of cases the reason that service is up is because it can't like it serves some purpose it can't be restricted so then we go okay if it can't be restricted can we at least enable that it gets updates repeatedly right that it gets Auto updated that we can make sure that we're not like holding old vulnerabilities in this software that tends to work right but it's not always available right I'm sure all of you know of software packages you use things you put up and guess what like do they update every night no right can you make them update every night maybe that's another point but then you

have the case where like what if it can't updated right what if it doesn't have updates or it's not really feasible then I just try to reduce the impact so you take the service and you put it in its own little Network right it can't touch anything it feels better right all these are options obviously who knows what fits our business best but like this is kind of the process we should think about these things in so let's go through what we should do about each of the kind of attacks that we've stated earlier I'm going to go through all of them and I'm specifically going to go through them on what you should do for yourself what you should do for your company and then then what you should do for your customers and this has three assum three main assumptions one you can

impose really gnarly restrictions on yourself because you can hold yourself to them you can impose restrictions on your employees but they have to be sane right they have to understand the utility of the Restriction otherwise they're going to actively bypass it that's what we tend to see and for customers it's honestly just really hard to restrict them right you have to do more kind of enablement activities or you have to make sure that like you're just not the source of the failure so attacks against accounts if we remember these are attacks like Sim swapping and brof forcing so what do we do stop using SMS for everything literally if you use SMS for authentication and you can get away from it it needs to be removed right this

includes Twitter this doesn't really include iCloud but there's a different way to address that like you need to do this right they've shown hey we can get access to your phone number when they get access to your phone number that needs to not yield access to your account another thing you do for this is try not to get your password guessed so you use unique passwords right typically in the form of like having some password Vault obviously this only pertains to accounts that like are important so your Netflix account or some other account that really doesn't matter if they took it you can be less careful there I would say generally try to use unique passwords in all of these places but it's not as important and then you have

hardening account recovery so I mentioned iCloud earlier iCloud uses SMS for account recovery iCloud you can't really remove your phone number right it would make your texts go green or kind of do some weird stuff and so because we don't want to do that what we have to do instead is Harden the account recovery and we'll go over that a little bit later the last one and probably the most important is multiactor off so if you don't want to mess up you have multiactor off pretty simple for your employees again we can't be as Draconian with what we have to implement so we just tell them use multiactor off and we try as much as we can to use single sign on to enforce that authentication across most

of the services we have is as uniform as possible for your customers this is a harder part how do you make sure your customer's password's not guessed how do you make sure your customer doesn't get hacked uh you just try right so standard right now is to basically on first Lo in send them an OTP say Hey you have this thing if you're using crypto for login it's probably not as big of a deal cuz they're not likely to guess it right notify them on New login it's always a good practice y y yeah feels pretty boring so attack against people so for you yourself you just need to be aware right if someone sends you a weird inbound and says hey can you click this thing for me your answer probably should

be no right past that you're looking at Specialized forms of Authentication usually using things like ubik right uh Universal two Factor typically what you want is webn and this will keep it so like even if you're fished for your password you put in webn it signs using the domain you're at meaning that isn't a good signature for logging in as you lastly you should actively consider AV especially for the less technical users it is hard for me to say this because I personally don't like an virus but it does have utility right if you're running Windows machine don't disable Defender right that's just the way it works for your business obviously you want

Awareness on all your employees you have to kind of tell them that's not easy it takes a while everyone finds it boring same thing with u2f right get your employees these little Keys make fishing fishing them harder then we enter the part where they are compromised via bribery or some other Vector right you have to be careful who you h you have to know who they are you have to know what they're doing if you don't know those things they could be anyone right and that exposes you to a lot of risk same when you let people go if you're letting someone go as D like as sad as it is to say revoke access first right you can call them on the phone

later it feels really really bad but it keeps them from giving access to your network intentionally like that is the main main purpose so if you really really trust them sure maybe you circumvent some of these but if you're really trying to make sure this isn't a problem you you get a little bit little bit worse and then lastly again I don't like antivirus personally but it does do something right makes it harder to hack into stuff it makes it harder to perform operations so it's always a good thing for your customers when you're looking at how this affects your customers you're not trying to not get your customer fished you're trying to make sure you're not the source of fishing

right the way you do this is you make sure your social media accounts are on point right multiactor make sure that's not using SMS so they can recover it make sure all these things are just as button down as you can because they're going to use them to fish customers right same for email SPF and dkim are preventative measures that basically let you tell the internet who can send emails on your behalf for all your domains this should be there right the reason because you don't want them to just send a random email from a random domain you have and say hey we're doing a new airdrop click here to find more right and then lastly and this is kind

of a longtail thing you have to protect your customers from your employees so if you're Gathering a bunch of customer data and you have a treasure Trove of it you need to it to some extent restrict your own employees from viewing it taking it and like throwing it out right this kind of is a sad truth but that's how it works for technology right I've already mentioned this you need everything to update you need to auto update it you need to update it manually you need to not download things that look really sketchy right if you're doing any of these things you're going to get caught right and lastly something that actually does help quite a bit is if you're using systems with app isolation um it's much harder to use

malware to propagate out right um this also affects fishing but I just put it here for your business obviously you need to update stuff you need to keep track of advisories and update when you see them you need to make sure that the configuration of your servers is uniform right this is where configuration management comes in this is again another longtail thing that you think about eventually and then we have a whole discipline of trying to keep your code from having gold ities it's called appc really for you guys we're just talking about test your code have someone review it right that's that's what you that's the bar you're going for right and for your customers if you build something your customer gets make sure they can update it make

sure you either you can keep it up to date or you'll tell them hey there's been an advisory please update your stuff this is very important right as much as we go oh like maybe it's not going to affect them maybe it's not going to do this like we have breches that are almost completely sourced on the failure to tell someone that something went wrong so next we have dependencies for this first one I just needed to put a bullet so for yourself you don't have enough dependencies typically for this to matter for your business just keep track of what they are and do vendor due diligence so as you onboard vendors to do important tasks for you or as they get access to your data or your contracts or whatever you're giving them access to make sure

they're who they claim to be make sure they are doing what they need to and make sure they're reputable right and for your customer don't be the source of the dependency failure right Harden your entire build process right make sure it's hard to get code into your GitHub make sure it's hard to build make sure it's hard to kind of back door and deploy there's some extras these are mostly around spotting people if it happens or if the worst happens what to do they're pretty simple gather logs um you eventually want to analyze them but start Gathering them it's probably important um be able to recover data in the case you get ransomware like the

easiest way to get past it is to essentially go hey I have this data it's over here but along with a backup of data you have to restrict that data um there are hacks that are literally just hey I went in and found their backup and I just stole their backup right and then incident response is important and you really just need to answer one question it's like who are you going to call if sh hits the fan right and if you can't answer that question find out who it is right I was asked to kind of include this stuff as well um audits are important the reason they're important is the following people who get hacked think the way they got hacked wouldn't happen right they thought hey I have

controls around this whole process this should have never happened why did it happen because mes happen right it's very easy to just as you're going through things to just Skip One Step and that one step bites you and that one mistake they will find it right and so you need to get your system reviewed you need to as you make these big changes and you have very important controls to verify those controls are in place right because it's very easy for you to kind of kick it down the road or think like ah I kind of have it but I'm not exactly sure that's not good enough next how do you get an audit it's a fairly simple process it's actually more involved than this but I'm going to kind

of shortcut it here so find someone good or ask people and they'll find someone good for you reserve some of their time and then they'll give you a report and you fix the things right as simple as that it costs a lot of money it sucks to do sometimes but it's kind of a necessary evil so to wrap it up let's go through a more involved demonstration so let's all take out our phone open up Twitter go to your profile hit settings and privacy go to your account information and check to see if you have a phone number if you do and you don't need it just right now click on it and say delete phone number the reason you're doing this is

because this is how they get access to your Twitter exactly this is exactly what's going to happen right and it's this simple to fix so we're fixing it now and we're just going to make sure you're not going to have a problem in the future next people with iPhones go to settings click on iCloud this may take a little while click sign in security scroll down hit account recovery and check to see what recovery key says if that says off don't turn it on right now because it does involve writing something down and making sure all that's there but take a note right now if this isn't on they can Sim Swap and steal your iCloud immediately right and they will and they'll keep it right so if you want to avoid that problem do

this next if you don't have some of these little UF Keys get a few use them for all your logins anyone who accepts them they should you may need two one is a backup but they're very important and then lastly make sure auto updates are on this is how you do it on your iPhone you go into settings you hit General you get a software update and if it says automatic updates on which it should then you're probably good and then once you're kind of at this posture what we've now done is we're protecting your Twitter from being hijacked we're protecting your iCloud from being hijacked and we're making sure that it's going to be very hard to hack into your phone so you can depend on your phone to be your secured device right if you have any worries or someone's like hey can

you download this sketchy like video conference app use your phone right as weird as that is to say it has app isolation you use it you delete it later hopefully no effect there if they have a zero day they're not going to use it on you unless you have a lot of money lastly and just to restate and this feels really bad to say everyone's going to get hacked sometime right we all have it the hope is the way you get hacked is someone accesses your Netflix right that sucks but not really and so what we've done is we've made it just a little bit harder for attackers right and you want to continue to do that as you move forward and

especially as you scale and again if you need help please ask right this is very important we aim to kind of keep everything good and like there are no stupid questions so with that do you have any questions first question just rolling back straight to audits right yep um so I'm familiar with like uh payment card industry DSS with uh you know like paying trust keeper someone to automatically scan your website and look for vulnerabilities but like there's also smart contract audit so I was wondering if you could speak to like the types of audits like by category we should be thinking about question really boils down to how good of an audit do I need to get for which types of systems for smart

contracts the answer is a good one right unless it's a smart contract that basically you didn't write that's written with a bunch of different dependencies that are already really well vetted then it has to be reviewed thoroughly and like very well unless of course it just doesn't matter right there are those cases for something like your website right it may be important it depends on what your users are doing on it if your users are using crypto wallets and signing stuff and trusting you to tell them what they should and shouldn't do that needs to be audited right fairly thoroughly but not quite to the extent that like a smart contract would need to be and then lastly you

have kind of like your tendentially related apps so let's say like you built an app it's not doing anything with crypto it's just users talking to one another doing that kind of thing at that point this is a due diligence question so you don't want to leak data you obviously don't want to get hacked but there's not as much risk there right as I mentioned they're targeting crypto right if there's no crypto on the site why are you that worried and so you can kind of scale with with that question is like how much do they get out of hacking me on this platform and if it's a lot you have to do a lot to guard it so hopefully that answers your question are

all yubis unique or do you have to back are they all can you back one up to another essentially and if not is two enough so they do have like from at an Enterprise level you can get ones that are flashed the same thing and you can get configurable ones that you can Flash with certain keys right so you can make two UB keys that can sign identically realistically you as an individual what you're really going to do is like just have two right you're going to en roll both of them right you're going to store one in like a safe away from your house away from kind of like where normally get stolen safety deposit boxes or your friend um and then you're going to carry one on you and like that's what you're going to use to

authenticate and that's typically like what should insulate you if you need kind of a third Factor right top is fine it's just you want to avoid using it all the time right you want to avoid pulling out your phone and putting in a code because that is something they can fish and so it's just materially weaker than using your U key so you want to use the most secure thing you have and like if you really need backups you can back up to things that are mostly secure but like you have to consider what the point of them is okay so this is just a real life thing so one time I was put in front of a compromise system we noticed that there was an ongoing problem and they had been attacking the Apache logs themselves and changing the log so no

one would notice what was going on yep so are there any like good practices for the moment logging events occur like offload that off the machine like what what do you guys think about that so most of the log aggregators do that so what they're doing is they're monitoring the files and as they're appended to they take that information and send it to a log aggregation server and so as long as they're not keeping the file from being written to right which they can do then you're going to see log generat and if log generation stops it might indicate something happened right and if you're building alerts out for these systems and this is kind of like a longer conversation then you also want to know that liveness is there right if every metric says this Apache server is

here but no logs are coming to my server that's a very big red flag right and that's like something you have to consider so when I say get logs I don't just mean get logs I mean get logs have some log aggregation tool push them over and then later monitor the logs for kind of anomalous events again on the topic of audits what do you think of crowdsourcing the audits to something like code for arena or or other platforms which are like competition based um like any any practical experience from from seeing teams get uh their smart contracts hacked which have been audited uh in a crowdsource way versus like a dedicated auditor

I guess that's a you know Case by case thing but maybe like General yeah I can give kind of a good example right we have examples of code that has been audited by like a single firm getting hacked right those will happen right we don't have as many examples of the crowd audits stuff getting hacked the key with crowd Audits and like the thing that makes them a little weirder to use is if your code isn't like really up to Snuff you're going to receive like 150 issues they're all going to be pointing in different directions and they're all going to be asking for different fixes and you have to sit there navigate through them all think about how do I fix this like realistically and then after you do it you need another audit

to make sure you did it right and so it just takes time when you're building that if you're pretty mature with your coding process and you have like an independent reviewer who reviewed something a crowd audit is always good right a crowd audit finds a lot of things IT addresses a ton of edge cases right they've been very effective right if they become less effective like I'll note that but right now like they stand as one of the more kind of like easy things for you to do again the issue is fixing the issues they they give to you and making sure like they're fixed in a way that like keeps everything kind of stable so that's

typically what I see and so like yeah they they end up being really well really good um would love to hear your take just you know given security expertise what's the best place to store a private key and I mean that like part of partially like it's you know a joke but like I think it's important of like do you think it's safer on a piece of paper under your bed you know in an iCloud or like in a you know something that you think is more secure that's digital curious what your take is so if you need a like a true crypto prodct storage crypto key right so a crypto key I don't need to use right you can encrypt that key print it out on paper store that paper somewhere safe well how do you store the

encryption key well that should be backed somewhere in either in HSM that you have or some other kind of like Hardware device that's not going to like let them exfiltrate it right that could potentially be your phone but like that's pretty risky as the funds grow your phone isn't a good place to be do to be doing that but typically like if you're going for maximum safety with like minimum usability right like that's kind of the way you typically approach it if you're going for things you can still use right Hardware wallets tend to be pretty good still um we there are some like I have some qualms with some of the manufacturers and the way they

manage their firmware and the way you update it and whether or not they have access to your keys right but a trusted manufacturer with a good reputation and kind of going through that a hardware wallet that does that is probably like as good as you're going to get for like a warm or hot wallet I would be curious to hear uh your perspective of audits versus Bounty programs and if like there are different instrument for different use cases like um for example like alting a blockchain could be maybe like very hard to audit uh and perhaps like a bounty program make sense just SC through your your perspective yeah so when you're

talking about very complex bugs and bugs that are like manifestations of technical debt through deployment cycles that are that would be something that's really hard to spot in like a standalone audit this is where bug bounties Excel right and realistically you should be willing and able to pay someone money if they can tell you how they would steal all your money right this needs to be something you're willing to do it probably needs to be something you can advertise you're willing to do and so the Bounty projects are a good way to do this you can also just advertise it on your project page right you can say Hey listen contact us here we will give you a reward here's the maximum amount we're advertising and like we're going to go

through this so that's kind of my mental model of it is the bug bounties are really good at catching things that are weird they're really good at catching things and incentivizing people to go through through your stuff after the fact after the deployment they're not a substitute for audits per se especially if you're not confident in the quality of your code when it's kind of created right and audit's there to kind of help Shore that up but in terms of like unknown vulnerabilities other kind of weird stuff that's where the bug bounties Excel so if if you're a big enough project and especially if you're a blockchain uh bug Bounty is exceptionally good at incentivizing people to instead of stealing your money

to hand you the bug and just have you give them money for it so it's it's worked exceptionally well the hacks that we've seen kind of drop in the last year partially is going to be crypto winter but partially it's going to be the fact that like people have paid probably hundred million doar to avoid having another billion stolen [Applause] what