18 KiB
Here we collect and discuss the best DeFi,Blockchain and crypto-related OpSec researches and data terminals - contributions are welcome.
Feel free to submit a pull request, with anything from small fixes to translations, docs or tools you'd like to add.
_________ __ ________ _________ .____ .__ __
\_ ___ \_______ ___.__._______/ |_ ____ \_____ \ ______ / _____/ ____ ____ | | |__| _______/ |_
/ \ \/\_ __ < | |\____ \ __\/ _ \ / | \\____ \\_____ \_/ __ \_/ ___\ | | | |/ ___/\ __\
\ \____| | \/\___ || |_> > | ( <_> ) / | \ |_> > \ ___/\ \___ | |___| |\___ \ | |
\______ /|__| / ____|| __/|__| \____/ \_______ / __/_______ /\___ >\___ > |_______ \__/____ > |__|
\/ \/ |__| \/|__| \/ \/ \/ \/ \/
Note: OpSec is a term coming from the military, meaning operational security. It has been widely used to describe security precautions in various sensible activities, and more recently also in cryptocurrency management.
OpSec SelfGuard RoadMap
Problem 1
Secure email provider like protonmail or tutanota. Use trused VPN like Mullvad or ProtonVPN.
Problem 2
Different emails / different strong passwords. Store them in one place. Never use repeat passwords, especially for accounts with personally identifiable and sensitive information (e.g. Facebook, Gmail, AppleID, Twitter, banks/payments, crypto accounts). Use passwords that are randomly generated and 20+ characters long. If you see suspicious password activity or failed log-ins on any of your accounts, change all of your passwords, starting with sensitive and authorization accounts, such as your primary email and bank/crypto accounts. 1Password and LastPass are both good options.
Problem 3
Never link phone numbers to crypto platforms. Use trusted multiple e-sims if you have to link the phone. To lock down your SIM, contact your mobile phone carrier. Ask them to NEVER make changes to your phone number/SIM unless you physically show up to a specific store with at minimum two forms of identification. This (should) prevent hackers from calling up AT&T or T-Mobile or Vodafone, claiming to be you, and asking them to port your phone number to a new phone.
Problem 4
Instead of SMS-based 2FA, use Google Authenticator (iOS/Android) or Authy apps for iOS or Android. Google Authenticator is quicker and easier to set up, but Authy offers more robust account recovery options. Keep in mind that the codes generated by 2FA apps are device specific. Your account is not backed up to Google cloud or iCloud, so if you lose your phone, you’ll need to spend some time proving your identity to restore your 2FA. The added security is worth the hassle!
Problem 5
Cold storage, and separate “hot” wallet. Use multisig (gnosis-safe as example) or at least a hardware wallet. Never store your seed phrase digitally. Seed phrases are intended to be stored on the paper card included with hardware wallets! That means never type it up, store it online, or take a photo of the card. Store your key on hard device.
Problem 6
Offline back-ups. Store them in a safe.
Problem 7
Never do anything you do not understand. Always check which token you approve, transaction you sign, assets you send, etc - be extremely accurate while making any financial operation. Keep in mind that one of possible attack vectors is to put you in a situation that will encourage you to do smth (login or anything like that).
Problem 8
Be careful about using your real home address online for delivery purposes. Data breaches are now a daily occurrence, and many breaches include customer names and addresses. Your physical address is not as easily changeable as a phone number or email address, so be especially mindful about where you use it on the Internet. If you’re ordering pizza with crypto, order it for pickup instead of delivery. When online shopping, use a different (and publicly available) address for package delivery. Options here include your workplace or drop boxes at delivery service providers like FedEx and your local postal service.
Problem 9
Remember: You Could Be a Target We are a natural target for all sorts of attacks — from garden-variety cybercriminals to competitive spying (sounds dramatic, but it’s real!). That said, it doesn’t really matter what industry you’re in. If you have any sensitive, proprietary information at all (and let’s face it, most people in crypto do), then you could very well be a target. This is a good thing to always keep in mind.
Problem 10
Remain Vigilant - Create a culture of skepticism where they feel comfortable checking twice before clicking a link or responding to a request for sensitive information, and you’ll have a much more secure organization overall.
Problem 11
OpSec often comes into play in public settings. For example, if members of your team are discussing work-related matters at a nearby lunch spot, during a conference, or over a beer, odds are that someone could overhear. As they say, loose lips can sink ships, so make sure you don’t discuss any sensitive company information while out in public. Many OpSec missteps can be avoided by being more aware of your surroundings and the context in which you are speaking: what you’re saying, where you are, who you’re speaking to, and who might overhear. It’s a good idea to go over the “no-no’s” for your specific company during onboarding and to remind employees of them periodically.
Problem 12
Identify your sensitive data, including your product research, intellectual property, financial statements, customer information, and employee information. This will be the data you will need to focus your resources on protecting.
Problem 13
Identify possible threats. For each category of information that you deem sensitive, you should identify what kinds of threats are present. While you should be wary of third parties trying to steal your information, you should also watch out for insider threats, such as negligent employees and disgruntled workers.
Problem 14
Analyze security holes and other vulnerabilities. Assess your current safeguards and determine what, if any, loopholes or weaknesses exist that may be exploited to gain access to your sensitive data.
Problem 15
Appraise the level of risk associated with each vulnerability. Rank your vulnerabilities using factors such as the likelihood of an attack happening, the extent of damage that you would suffer, and the amount of work and time you would need to recover. The more likely and damaging an attack is, the more you should prioritize mitigating the associated risk.
Problem 16
Get countermeasures in place. The last step of operational security is to create and implement a plan to eliminate threats and mitigate risks. This could include updating your hardware, creating new policies regarding sensitive data, or training employees on sound security practices and company policies. Countermeasures should be straightforward and simple. Employees should be able to implement the measures required on their part with or without additional training.
Problem 17
Implement dual control. Make sure that those who work on your network are not the same people in charge of security.
Problem 18
Automate tasks to reduce the need for human intervention. Humans are the weakest link in any organization’s operational security initiatives because they make mistakes, overlook details, forget things, and bypass processes.
Problem 19
Incident response and disaster recovery planning are always crucial components of a sound security posture. Even when operational security measures are robust, you must have a plan to identify risks, respond to them, and mitigate potential damages.
Problem 20
Risk management involves being able to identify threats and vulnerabilities before they become problems. Operational security forces managers to dive deeply into their operations and figure out where their information can be easily breached. Looking at operations from a malicious third-party’s perspective allows managers to spot vulnerabilities they may have otherwise missed so that they can implement the proper countermeasures to protect sensitive data. The most important thing here is to conventionally understand the process of attack. Their vector.
As an example: hacker delivered you some RAT (remote access trojan) on your computer and now the hacker has two ways. If the hack is "fan", i.e. massive, then the stealer will steal your cookies, and other information, so that later data will be sold on the secondary market for the processing of these logs by lamers. Classic opsec mentioned in 1-10 should help from it.
Or the second option is a direct attack in which a hacker will make a phishing page on your router, through which you enter your password (poisoning of the DNS server). That is, to prevent an attack, ideally you need to separate machines and networks. You should also check certificates.
Hacker can also make an attack on the clipboard when you copy the address of sending and it will change to the address of the hacker. Moreover, the beginning and the end will coincide with the original address, which will be a mix of attack vectors - social engineering vector, phishing and classic malware.
Problem 21
Your level of opsec usually depends on your threat model and which adversary you're up against. So it's hard to define how good your opsec is. But I'd say it sounds pretty okay.I recommend watching:
Problem 22
If you use smartphone be extremely aware.
Problem 23
Only Interact with DeFi Protocols You Trust - Take your time to read up on some previous concepts we’ve covered such as staking, yield farming, NFT farming, and research any other new terms you may come across before depositing crypto into a DApp that deploys any of these investment strategies.
Problem 24
Use trusted services. Using a secure, easy-to-use crypto wallet to interact with DeFi applications is essential to a safe and user-friendly DeFi experience. Interacting with smart contracts can be tricky for first-time users, so using a beginner-friendly crypto wallet with DApp support is a smart way to mitigate risks stemming from accidental errors on the side of the user.
Problem 25
Be aware of most common attacks. Follow hacker websites, latest security standarts, check out what Nitrokey and Yubikey do and why. As a conclusion - read what is OSINT and counterOSINT so possible criminals wont be able to collect needed data.
Table of contents
Support Project:
Support is very important to me, with it I can spend less time at work and do what I love - educating DeFi & Crypto users 💖
If you want to support my work, you can send me a donation to the address:
0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A — ERC20 & ETH (officercia.eth)