Crypto-Asset Exchange Security Guidelines
What are the security issues with blockchain? Like any complex technology, most Blockchain/DLT systems suffer from new security issues. The CSA currently has a draft listing of almost 200 weaknesses and vulnerabilities in Blockchain technology, many of which are not fully understood or documented at this time. As part of our work we are attempting to classify and publicize these weaknesses and allow other industry efforts (such as CWE, https://cwe.mitre.org) to leverage them.
CSA is creating a framework for distributed ledger technologies used by financial services. You can learn more about this project and read the latest papers released for this initiative in this blog.
Blockchain/Distributed LedgerInternet of ThingsFinancial Services Stakeholder Platform
This group investigates relevant use cases, and security implications of blockchain. Currently they are creating a framework and glossary that would help provide guidance and security around: wallets, exchanges, cryptography and more.
Cloud Security Research for Blockchain
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
Hyperledger Fabric 2.0 Architecture Security Report
Blockchain technology is being rapidly adopted by enterprises to bring traceability and transparency to external business workflows.Considering that many of these external business workflows involve transactions and custody of value in the form of digital assets or other high-value data, cybersecurity certainly takes center stage. In this paper we identified Fabric 2.0’s architectural risks to Cybersecurity attributes (Privacy, Confidentiality, Integrity, Availability) while being implemented as a permissioned blockchain enterprise network for a trade finance business use case in a cloud-based environment.
Using Blockchain Technology to Secure the Internet of Things
This paper describes a high-level overview of blockchain technology and outlines a set of architectural patterns that enable blockchain to be used as a technology to secure IoT capabilities. Specific use-case examples of blockchain for IoT security are also explored, although technical implementation of those use cases will vary across companies.
Crypto-Asset Exchange Security Guidelines
Experts have identified crypto-asset exchanges as a major pain point of crypto security. Exchanges are platforms that mediate crypto-asset transactions between entities. There are several types of attacks that are successful against exchanges. In this document, we give an overview of these attacks, describe an exchange security reference architecture, and then provide a detailed list of crypto-asset exchange security best practices, administrative controls, and physical controls.
Crypto-Asset Exchange Security Guidelines
The goal of this framework will be a series of papers addressing specific topics related to blockchain.
The first of these papers is now available. You can request access to the Crypto-Asset Exchange Security Guidelines here.
Webinars & Resources
Hyperledger Fabric 2.0 Architecture Security Controls Checklist and Report
In this webinar the lead authors for the blockchain working group’s latest release, Urmila Nagvekar & Carlos Dominguez, will discuss the Hyperledger Fabric 2.0 Architecture Security Controls Checklist and Security Report.
Blockchain in the Quantum Era
In this webinar, Ashish Mehta, Co-chair for the Blockchain/DLT Working Group, and Bruno Huttner, Co-chair for the Quantum-safe Security Working Group, provide you with an introduction to DLT/blockchain technology, some of its representative applications, and an overview of the leading post-quantum algorithm candidates that are actively being pursued.
LIVE Cyber Attack Simulation: A Crypto Crime in Action
Crypto mining and cyber crime are at the top of the list for headline-grabbing attacks. Watch a live simulation of hackers bypassing security controls and executing a crypto mining attack. Watch how a security engineer is able to quickly identify the attack, and then learn the tips you can take home to improve your own security posture.
Press Coverage
| Article Title | Source | Date |
|---|---|---|
| CNAs and CVEs – Can allowing vendors to assign their own vulnerability IDs actually hinder security? | The Daily Swig | November 03, 2020 |