Security & How Can We Make The Space Safer C4 - Jessica Levesque

foreign [Music] foreign foreign [Music] foreign [Music] foreign [Music] how's it going hi thanks for coming everyone all right lots of cheering great good start so hi thank you for coming to talk about security obviously we're all here because we think it's extremely important and we hope you do too so I'm Jessica Levesque I'm the executive director at C4 and we have a panel of Security Experts here today to talk to you about the cryptocurrency security standard C4 is a non-profit and this standard was created by volunteers who are experts in the cryptocurrency space and we are lucky enough to have some of these volunteers and experts with us so let's start first by doing intros so Michael hi my name is Michael Kirkland I am the chairman of C4 and I also have the privilege of serving on the steering committee for the cryptocurrency security standard um I have a a long background in cyber security serving as shapeshifts Chief Information Security Officer for five years and I'm very honored to be here on a panel of a very smart cyber Security Professionals thank you Michael Shahar hey I'm Shahar I am the head of security products at Firebox um also coming from around a decade in cyber security and uh yeah it's great to be here with all the good guys okay and Bartos hey everyone I'm Bartosh I work at haken as layer one auditor researcher I worked as developer from 10 years and I'm in crypto since 2014. awesome thank you okay okay so we're going to talk about why security matters and why the cryptocurrency security standard is so important to anyone who wants to work in the space or use cryptocurrency or thinks that they want to make sure that their money and other people's money and digital assets stay safe so let's get into it I think what we should start with is what the standard is why we're even here it's an extremely robust standard so we're not going to go through all of the details you can check it out on our website it's free and it's open so anyone can look at it so please do so Michael you are one of the people that rolled the standard you're also the co-founder of C4 but I think it'd be great by starting with you explaining what the standard is and why it matters and why have we been working on this since 2015. yeah not a problem um so I prior to getting involved in the cryptocurrency space I worked as a cyber security professional I did digital forensic Audits and incident response whenever a company got hacked I would go in and I would assess their their security using standard tools um like ISO 27001 or the PCI standard or you know things like this and when I got involved in the cryptocurrency space I I started the the world's first blockchain security company that focused solely on on bitcoin security and when I was going in and uh helping these companies do security one thing that I noticed is that every company was doing security differently and this led to a wide array of different results we had on one Spectrum Mt gox that got hacked and lost millions of dollars on another side we had crack in that didn't have any losses at all and what was the differences so uh myself alongside many other cyber Security Professionals some that are in the audience we started contacting many different uh exchanges many different websites that did suffer attacks and we started uh cataloging all of the reasons why they got hacked and as we started arranging all this data in a spreadsheet we started to notice Trends uh the ones that were doing these things were not getting hacked the ones that were not doing those things were suffering the hacks uh and this became the basis for the the original 33 controls that the ccss prescribed today there are 38 controls because over the years the standard has evolved and has grown but each of these controls govern one piece of security for the life cycle of a private key now the ccss is designed to work alongside other standards it does not replace ISO 27001 it does not replace the PCI standard but it works alongside them and the ccss is Razor focused just on the private keys from Cradle to grave how is the private key created is it created securely how is the private key stored when the system needs to access it how is this private key accessed and finally at the end of the life cycle when that private key is no longer used how is it decommissioned this full life cycle from Cradle to grave is what the ccss governs and the standard was built around this and I'm I'm happy to say that over the many years that the ccss has been used by a variety of exchanges none of the exchanges that have reported self-compliance have yet suffered the types of losses that we've seen from other Exchange changes that do not use the ccss awesome thank you so the reason that we have fire blocks on the stage with us is because they were the first system to ever be ccss certified so there are level three qualified service provider and one of the really cool things that I think about fireblocks is that you guys came to us and said hey we know that there's this security standard and that it is something we want to make sure that we are compliant with and to get certified so Shahar I'd love to hear from you about why you think this standard is so important and why Firebox has been a leader in making sure that this is something that's being used within our industry all right yeah um so first of all you know the reason we need certifications at all in this space is the same reason we don't just hire Engineers because their mom said they're the best right we need someone else to say this is legit this is good this is why we believe in Stardust is what we live that this is a good thing and when Fargo was founded in 2018 the idea was to secure the blockchain all right and that started with MPC uh wallet with uh securing for them in the keys and overall as we move forward I think we saw stuff that's very similar to what Michael said about there is a pattern right like people do certain things they get hacked they get drained and when people do other things they don't right and this is how we built our platform and this is cyber security is is at the heart of our product at the heart of the company actually when CC says started so it was a combination of our initiative saying like hey we should do that we should be certified together with actually customers coming to us and saying hey are you are you part of that you should be right so it's like it's a combination of traction that brought us to this and eventually you know we believe that cyber security that without cyber security can't really do crypto at scale and this is what we aim to do yeah and I think it says a lot about your organization that this is something that you guys sought out because you just care about it and the people that you're working with who want to make sure that your product is in fact secure right because it's easy to just say like oh look at the glitter and gold this looks so fancy with all the neat marketing but what's actually happening underneath is this service or product actually secure is this something we can trust and oh go ahead yeah I was going to say that I completely agree and I think like over time like the like the vision that we see if if this donut becomes more adopted so you can imagine that you know it can be a condition for for example being listed on coinbase right or being contacted and connected to fire blocks maybe boosted on Solana or maybe get funding from a VC right all those things there will be incentives for people to join in once the standard is big enough and be supported by enough people absolutely and so we have trained or rather certified a number of Auditors that have proved their working knowledge of the cryptocurrency security standard and Bartosh is one of our security Auditors he is from hacken and there are over two dozen ccss Auditors out there right now already and this is the exam and the auditor designation have only been out for a few months so it's pretty incredible there are people from Deloitte Kroll confide halborn and nine different people that are Security Experts that work at hacken have become ccss certified and our Auditors and Bartos is one of those so thank you for being here and I'd love to hear from you about why your company has decided that you should be auditing so first of all Jessica thank you for mentioning our feed it means a lot of us and we really appreciate it before answering your question let me say that it's really great that there are so many people and so many companies interested in cyber security and crypto security standards I've been in blockchain since 2014 and I can and I can say that now the blockchain is structure more than ever and it's great okay going back to your question uh our team is getting CSS uh certified because we want to set a new bar for the industry standard standard when it comes to blockchain security it's also a challenge for us the auditors we try to do new things learn new things all the time and ccss is one of them by doing this we can achieve the highest quality when it comes to blockchain security another thing is about making web free a better place a safer easier to use and secure and ccss standard is a great it's a great tool to making it more secure because actually it's quite it's quite hard to build a business using a crypto crypto systems it's so there are so many ways of doing the mistakes and by following ccss is a great step to reduce the risk and make it in Secure way yeah and I think one of the really neat things about the ccss is that it's a third-party auditor that goes in and does the audit but then there's also a peer review process and with that peer review process there's another auditor that's also certified that is going to go in and take a look not at the actual evidence but it well actually why am I explaining this when I have an auditor right next to me who's actually done the peer review for fire blocks so Michael why don't you explain what that process was like doing the peer review for fire blocks the system yeah not a problem um one thing that was clear from a lot of the previous hacks was that companies kind of started lying Mt gox said hey we have all of your funds yeah everything's fine uh FTX said we've got we have nothing to worry about you can trust us everything is fine but the reality is they were lying and if somebody else were to step in and start to take a look at what they did it would be clear right up front that they were lying but nobody ever had the opportunity to walk into their their buildings and take a look that's why when the ccss certification process was being built we made sure to have a peer review process so when the auditor went into audit fire blocks confined was the auditor that fireblock selected to perform their ccss audit as part of that audit there needed to be a peer review uh so already there's fire blocks who says that they are secure there is confide who is walking into their door to make sure that they're secure but how do we know that there isn't a payment there like hey we'll give you a couple thousand dollars why don't you just say that we're secure now there's a third person a peer reviewer who goes in alongside confide and takes a look at what they did and makes sure that they really did the work and I was the peer reviewer for that uh so with these three entities all working together to show their customers and to show the world that they are doing what is necessary to protect the private keys and to protect the funds stored on that system there is no opportunity for shenanigans um and that's why the peer review process is there and I'm I'm incredibly proud of this three-tiered uh system that we've built uh to make sure that when any one of you customers decides to store your money on fire blocks or on any other system you can trust that if it is ccss certified that that means something and there's a distinction between being compliant and being certified so if a system has been certified it will be listed on our website so don't believe everything you see and hear until you've actually checked out to make sure that they have been certified one of the cool things I think kind of jumping off what you said Michael is that it is a rigorous audit this isn't just like come in check this box and Shahar I'd love to hear from you about this experience because I've heard from your team that it was very rigorous it was more um kind of in-depth than you originally thought and you loved it because you were able to obviously meet that because you reached level three or your systems did yeah um so yeah I completely agree actually it was the most rigorous the most like the hardest uh Sonic we had to to go through um and that's actually amazing I mean going through all that was actually also exciting because we believe in the cause we like like I told the earlier part of the reason we did that is our belief and part of that is our customers telling us hey can you can you do that and once going through all that and seeing that it's actually you know like Michael Michael said it's you're actually testing the system you're actually testing and not just the system itself the whole operational cycle which is something we greatly believe in right we think it's the operational security that's end to end how you manage funds how much keys is the is the key to success and building an actual secure product that customers can trust so yeah it was hard it was definitely worth it and part of it being hard was actually exciting and fun I apologize I just wanted to to jump in with that uh two quick things um the audit report for fire blocks if I remember correctly it was something like 140 pages and each of these Pages went in depth into the entire life cycle of how fire blocks handles its Keys uh I was very impressed with confide's work in their audit of fire blocks and uh this isn't something that you know you can just scribble on a piece of paper and be be done with it this is something that takes uh I think it took them uh more than a month from start to finish uh to compile and to perform yeah and I think that that makes it an even more um like a more vital part of our ecosystem because it's not something that's just like a quick check mark it means that we take this seriously and would it be easier to do that sure but would it actually be creating something that is secure no and so Bartos you are an auditor and you have obviously seen the robustness of this standard I'd love to hear a little bit from you about the standard itself and what hacking kind of thinks about it and what you're planning on doing with being a ccssa Okay so excuse me could you repeat the last part sure okay basically I want to hear about why you've decided to become a ccssa and what you think the standard is doing to change and make web 3 safer okay so let me first start with the the second question so I think that okay when you are designing a crypto security system uh it is a hard job to do you need to think about many things you need to think about safe key generation access to the Keys about backups about logs about code reviews there are plenty of things we do which you need to take care of to make the system really secure and it is very hard to do so fortunately there is this ccss standard which which gives you a number of steps which you should do to to make it in a secure way and it takes care of everything so when I saw the standard when I heard about this from this from rco uh I got really interested in this because I think this is a huge step when it comes to the standardization in a blockchain space and the standard is really good I think by following it many of the issues wouldn't many of the hacks wouldn't ever happen and and yeah and there's there's one more thing when it comes to having uh an audit in my opinion you should always have someone to take a look on your code on the system you designed because I've as an auditor I've seen the cases where the companies weren't ever aware about many things for example they were thinking that they have uh working at backup but as it turned out it didn't work I even seen a situation where the developers were actively lying to the management about system they have and because no one was checking this you know it worked like this but it was on the brink of collapse so only because the because of the update they they noticed that something is going uh something is going wrong and our plan in general is to to try to make as many as many CSS out it to help the other companies be more secure and manage their funds in a safe way yeah I think that when we talk about security and we talk about auditing it's not sexy people aren't here like oh we can't wait but it is so important your product if your system isn't secure then what you're doing doesn't matter to be perfectly honest because you're taking money and you're taking the livelihood away from people and I always say this but be a good person do the right thing and get certified or just look at the standard make sure that you're following best practices I didn't create this because I'm not an expert so who did create it volunteers who are in the space their cyber security and cryptocurrency experts and they went in and they created this very robust standard and I think and Michael you can talk about this a little bit but I think one of the things that makes this standard so unique is that it really was created by people who just want to make the space safer there isn't some sort of hidden agenda here it that is the entire goal and that's what it's doing yeah I started talking at the beginning about the various different standards that uh I used to use prior to being involved in the blockchain space the PCI standard the iso 27001 standard Etc um when we noticed that the blockchain space didn't have its own standard for the security of private keys that was when we started building the ccss and started creating it and um how many of you are building a system or are working on a system that deals with private keys or deals with cryptocurrencies okay so um one thing that's great about the standard is that it actually serves two functions one function is it's a it's a measuring stick it lets you grade the security of a system how secure is this system but the second function is once you've graded it and once you know that um I mentioned that there were 38 controls in the ccss let's say your system is covering 30 of the 38 controls so maybe you are a level two system because of those 30 out of 38 you're you're doing well that also gives you a road map because now you know these eight things that I'm not doing right now this is exactly what I should be focusing on next it it is a measuring stick to help you know how secure you are today and it is a tool that gives you a roadmap for improving your security tomorrow uh All in One open source free to use standard um you can go to the C4 website and take a look at the standard and and insert self-assessing right now without paying a cent to anybody because it's all free and open source uh and you only need to worry about paying someone if you want to go from compliance which is self-reporting and saying I think we're good enough to certification which is when these other people come into your home and look at what you're doing and and approve that yes you really are as secure as you think you are um yeah yeah and and I would like to add to that I think that like the response we've seen from our customers after going through this certification tells a lot about the starter itself and ccss and C4 um we actually saw you know after obviously customers came to us about this but after we came certified they were actually quite quite a lot of customers that during the sales process um they asked about some compliance as far as certification to different standards and it's like going deep and then when we said hey wait are you aware that we're uh ccss level 335 so they said oh so we're good we can go for it so this was really amazing this was really amazing to see like the customer's reaction and I mean like top banks of the world the tradify institutions that care a lot about security it was really amazing and it really you know it's I think it's like a common Spirit of ours right caring about security um and and from the grounds up so yeah okay I believe that ccsa will became an Indus industry standard when it comes to a crypto and we'll see that most of exchange will have them soon so we'll have it soon I mean they should have because it's it's a standard when it comes to crypto you know there's nothing to add it has everything it needs and there's no no reason not to follow it well and I kind of like that is there a reason not to do it is there a reason not to check I don't know you tell us if you don't want an auditor to go in and look at your system I wonder why yeah why wouldn't you and it's also um a rip on the tried and true model of what we see with the payment card industry the payment card industry they have a standard that they all created amongst the companies themselves Visa Mastercard Discover they all run these payment cards and they came together and said we got to start regulating ourselves before the politicians get involved and tell us how we're supposed to be doing our job they created the payment card industry standards and they self-policed it later on Fast Forward years later when legislation came in uh they referenced what the PCI group built and they said uh if you're going to be dealing with payment cards you have to follow their standard so it was a standard they created them selves now when we're looking at the cryptocurrency industry an industry started by Satoshi Nakamoto with no leaders nobody in charge um we it's up to us to build the standards for ourselves to follow because if we don't do it ourselves with the Security Professionals like us who know what we're doing and and know how to write this properly so that it can benefit everybody we're going to have legislators in a big white building with stone columns dictate what security should be followed for these cryptocurrency companies and I don't know about you guys but I would much rather a cyber security professional tell me how to be secure than a lawmaker who probably doesn't even know what a blockchain is perfect summary yeah it really was um so I would love to ask the audience a question so who here knows someone or personally has lost digital assets due to some type of security issue okay so wouldn't it be wonderful to live in a world where no one raised their hand anymore like that's what we're trying to do and that's what I think everyone on this stage cares about and why we're here in the first place yeah I would recommend all of you ask the exchanges that you use are you ccss certified and if not why not yeah and I love the answers that I've gotten where they're like well trust us why and then they tell me who their Founders are and I'm like okay I'm still waiting and they're like no no but we've got this and you know on our website we say this and I'm like yeah I'm still waiting for you to tell me why I should trust you and they can't because you shouldn't and so um I think it's pretty cool when there are organizations that want their systems to be audited for no reason other than they want to have that proof because they don't want you as users to lose their money yeah yeah and I I think like earlier you said that you know certification isn't cool like people don't love doing it and I think for us the experience was obviously hard but it reflects how much effort we put day to day in Secure engineering like the amount of time we spend each day when we plan new features when we design and redesign the product and how it affects our velocity right we could have run so faster if we dropped our secure enclaves if we dropped our multi-factor approvals if we drop all that we could just you know scale like like even more crazier is that than we had and we every day we choose again not to do that and do it in the more secure way because we believe this is the way to scale correctly and not disappoint our customers that have put trust in us so it actually was exciting to do that and go through that and get a certification because again it's a reflection of our day-to-day efforts so it was incredible so blockchain systems are getting more and more complicated you know the only way to deal with them to make the to keep them secure are the standards and ccss is a great standard to start with I bet there will be more in the future maybe something for zero knowledge proof I think I hope that C4 will also develop them too and and that's great because it let us go forward go forward when it comes to the crypto industry and yeah that's that's all I wanted to say it's great you are doing a great job keep doing this thank you I would also say don't trust what we just said check that what we're saying is actually what we're doing go onto our website look at the standard it's free it's open you can check that Firebox is actually certified as level three qualified service provider you can check that Michael is actually an auditor and that he passed the exam you can check that Bartosh is as well and I'd like to just stop by saying hack and slogan we're all working here together to make web 3 safer so thank you for coming and listening and we hope that you get certified thank you all thank you appreciate it foreign [Music]