Security and Privacy | European Blockchain Convention

[Music] hello hello hello everybody thank you for joining us for the last session before lunch I'm very excited to be moderating this panel focused on security and data protection a little while ago I ran a poll that focused on if you could look at the blockchain trilemma and you had a choice between security decentralization and scalability which one would you choose I know in reality that's not how things actually play out you're always going to have all three but if you had a choice which one would you choose and fairly unanimously about 70% of the people who responded said security so the good news for you guys is at least 70% of your audience care what we're talking about today everybody else is here for really fast salana but for everybody else we're going to try and share some Insider knowledge some War Stories some what keeps us up at night when it comes to the matter of security for institutions for individuals we also want to talk importantly about data protection and privacy something that I think is probably underappreciated in the area of blockchain we love blockchain for its decentralization we love it for its transparency but too much transparency can be a bad thing and certainly from an Institutional perspective having onchain data present and visible for all business operational data transactional data is something that is deeply scary and so being able to go a little bit deeper on data protection is something we also want to cover so let's get started I'd like the gents just to give us a couple of minutes at the beginning on their credentials in security because you have three very different individuals in terms of their backgrounds and what they're working on so I'll start with you Jurgen give us just a little bit of your your background in your security credentials for this audience please hi am CTO of safe tech labs I'm also a consultant European Parliament and uh dealing with cyber security infrastructure needs on security level um I'm here present with my company inh herity which is basically a company approach related to digital inheritance and uh decentralized backups of your secret data all right Cas would you like to go next yeah uh hello my name is k I'm working for C uh my security background comes from Far uh I was a telecommunication engineer focusing on security at that uh that moment now I'm coordinating the the digital asset that crypto asset project within the group actually really thank you very much and last but not least naen thank you Anthony I'm naven Gupta CEO of Crystal intelligence we are a blockchain analytics firm and simply put we take fraud out of crypto so two things we do one we do transaction monitoring so that bad people are not using cryptos for any um wrong purposes and then second we do a lot of Investigations uh on when bad things happen in postmortem how to bring that money back there we go so we have the institution that wants to face the customers we have the technology provider who want wants to provide technology to the institutions and we have the investigations team who will figure out what happened after the fact so we've got the full the full spectrum of activity when it comes to security and privacy on the show today what I'd love to start with is what are your what are the things that keep you up at night what is the one kind of major concern when it comes to security when it comes to web 3 use of blockchains cryptocurrencies in the world that probably are underappreciated maybe or at least are crunchy and difficult at this point in time guys I'll start with you at the at the beginning of the supply chain um from from the banks perspective what are the what are the main areas of focus or the things that you worry about the most yeah so as as as the the the Sy systemic banks are joining this adventure and working more and more on the uh on the digital asset on blockchains on cryptos uh I think risk management for security is a major issue they they are they were building uh and mastering a lot of processes to manage the risk the security risk on traditional asset on traditional uh ways to to to make uh to make Finance now we when we are facing blockchains and decentralized word they need to change their their minds and need to enhance these processes and how to to to manage security uh I say that take some examples today when when you go to the to the analysis risk analysis for security from Banks you will look about integrity we look about uh uh robustness we look about um all these kind of things from from it perspective mainly you'll see you need to have uh backup on systems you need to have uh and the question now if you look at blockchains what does it mean back up on blockchains how do you manage that so this one of the the the questions you you are more about uh let's say how your system is working with uh decentralized situation where the governance you don't manage it or you are not able to to to to to know how it works uh what are your dependencies of the on the system and this is another security issu that you want to in on the other side you have all the technical uh issues that comes with the the smart contracts and the the the the the way that the Integrity of the information is managed so did do are you able to use whatever kind of smart contracts do you need to manage them and the information which is put on this on this uh smart contract do you put it open for everybody are you uh allowed to put it open for everybody and how do you manage these kind of things I think these areas are major stuff and then the the future also is something we need to look at when you you see all the evolution of quantum uh cryptography that could harm some systems and this on another side of security that we need to to look at it as well there we go and and in very very few of the things you mentioned there is actually the security of the block chain itself right we didn't even talk about the the nodes and you know whether the blockchain itself can get hacked and in reality over the last few years a number of the main instances of issues or breaches haven't been the chain it's been other parts next to it or other parts of the supply chain so we'll get into that in a minute Yan obviously as somebody who's also building infrastructure or advising on building infrastructure what are the things that keep you up at night as you're trying to face or trying to reassure your clients on using blockchain technology well uh in my my case it's Direct related to the project I'm working on it's to safely Trans in all transparency securely secure uh your digital footprint and uh to uh to transfer to your next skin or to back up for yourself because security is nothing when you when you don't look at the SEC how do you securely store your keys to access those security layers right and it all starts we are all always cing back to the same point we need to have segmentation of responsibilities at at each level of the development chain yeah key management is a good one and I guess as individuals we've all got a piece of paper somewhere or something we've scratched onto a piece of metal that we've hidden under the bed and that's our approach to managing our keys but those are our keys and what happens when our spouse our partner our friends somebody else in the company we work for where those assets exist have have access to that you know or require access to that right we're very good maybe at individual privacy and individual security of our assets but I guess it becomes a little bit more challenging when you've got institutional decision making when you've got crypto assets that an organization owns and the CEO gets fired the next day who how does the key key management chain of custody work how do you make sure that you've got a number of people responsible for managing the keys but not too many that it becomes you have to fly three people in from six different countries to be able to make it work much too complicated so the user experience around that I think we still have work on naine you get to see the the the other end usually kind of something bad has happened and therefore um you're brought in what are some of the biggest concerns that you see or what are the biggest some risks that you're brought in to help with yeah absolutely so let's first just look quickly look at through the numbers right um anybody in this room who has not been attempted scam who has not received a WhatsApp or something like that trying to scam them or trying to link your wallet to anything else anybody has not been not being not being even a single person all right not a single person and this something tells us about the state of crypto Market that we are in so let's just look at the numbers itself um we issue something called as a hacks and scam report uh in 2022 just the reported scams and hacks were 20 billion us and that is just a small fraction of what the total number of hacks and scams happen and I'm rounding up the number just for everybody's ease $5 billion of those are security flaws that means something was wrong in the system which could have easily been fixed 5 billion of those are defi hacks right and almost the rest of them are just scams where somebody's impersonating somebody and trying to get money from you right some of the top ones axi Infinity anybody knows that $600 million FDX $600 million after FTX was going bankrupt somebody drained money out of FTX and essentially took the money from the wallets right number one country in terms of reporting scams and hacks United States in terms of volume right number of cases reported total value of from a country that has been lost just anybody wants to take a guess total value of money being lost reported by a country is China right billions of dollars being lost and again Vu token plus token almost in billions of dollars of scams that essentially happening in there so it's far more prevalent than we think it's prevalent at a country level at an institution level at an individual level right and to me um there some things can be fixed something cannot be fixed in which the industry needs to move forward but I think the state that we are in is actually quite pathetic right it's it's a little bit wild Westy or rather I mean the example you mentioned there again it's important to cite that these are not blockchain hacks the um the ACT Infinity Hack was a bridge hack so there was an insecurity around the bridge smart contract which was exploited FTX was institutional wide corruption and failure and and inappropriate controls that's one that we all know but unfortunately as an industry we get to suffer from The Fallout of that it's like FTX happened oh blockchain's the problem right you know a bridge gets hacked blockchain's the problem blockchains are no longer secure the reality is it's the supply chain around the blockchains that are the challenge and this is where we need to work on um n is there are favorite hack that you come back to from time to time where you can illustrate the learnings for people here that they can take something away yeah absolutely uh anybody heard heard of the bazer X hack $230 million lost couple of months ago no nobody's heard of it $230 million actually doesn't matter much maybe this is part of the problem maybe security doesn't have a good enough marketing team true so in in the VX hack what happened as you know $230 million of investors fund or sorry customer funds essentially got drained out of the wallet um the scamsters it was a multi-c wallet but scamsters were able to overtake uh four multix accounts by by making changes in the smart contracts and it was with an outside custody provider and they were able to drain the wallets for $230 million and after that of course the money has gone in lots of sources it's gone into tornado cash uh it's gone into multiple other places to be washed and to be um sent out for different other purposes but again um this is a place uh a sophisticated exchange uh with huge amount of money from the customers but at the same time having lost all that money and now uh essentially battling it out in the court so this is one of my favorite um investigations that we are constantly looking at and to me um almost I think the chances of getting money is actually very very low right and what could they have done better looking retrospectively at what happened what was the failure point or what were some of the good practices that should have been instituted that maybe weren't yeah so there is four things that we essentially see I'll just talk at a high level and then come down to the specific case first a lot of people don't realize lots of this is a work of insiders right so FTX for example most likely was an Insider who essentially drained this particular wallet right so lots of time the practices and the processes that are being followed in those institutions is at a very very low level right um lot of lot of these institutions grew up from an Excel sheet so they were just using an Excel sheet to manage all their cryptos and essentially money belongs to each one of you and then essentially lost that money and then everybody shrug their shoulders and blames it on somebody else and walks away right I think I would say the third thing that I would say is lots of them are unregulated so let's your money does get lost there is no place where customers can essentially go and and essentially get their money back and also they're uninsured right so and and the last thing that I would say is there is no bit of audit that essentially happens so u in as you know in regular practices like for example if you look at institution like a bank there is huge amount of hacking ethical hacking that essentially happens there's a huge amount of audit that essentially happens security audits um uh compulsory audits but whereas for example for crypto institutions a lot of time that doesn't happen so the ability to essentially catch them is very very difficult but I would say the top ones is really a Insider job and then the second one is lack of culture and processes in the institution to be able to protect themselves from it so another version of don't trust verify trust no one I want to move on to data protection and privacy next so kais I'm going to come to you we love or one of the benefits of blockchain that is frequently cited is transparency visibility can't be evil if you can see the code you can see the data everything is visible and transparent um that's often cited at the same time you've also got open source open platforms the ability for anybody to innovate on top of these systems which allows us to create applications or allows us to create Innovations around Financial Services in a way that fintech probably can't up until now and that's hugely exciting the transparency part still scares people and so being able to have all of your order book all of your previous transactions all of your interactions with smart contracts be visible and transparent on chain all of the time I imagine for bank or for institutional clients or for investors even is not something necessarily they're entirely comfortable with where are you guys as a bank in terms of data protection the requirement for shielding certain parts of that transaction data because if we just went pure ethereum all the time right now that would be a struggle yeah thank you very much for the question this is basically a big big question that uh all the banks and all the institutions are look into when you look at it from historical point of view the first and the first applications that Banks has looked to or institution look to was was based on Consortium private Consortium uh local development uh and there is there was no way to get into public blockchains or public infrastructures now we are feeling that more and more uh of these institution even sear National institutions are looking to to to to to public infrastructures and public blockchains the reason is very simple public blockchains are more robust they're less suffering from many problems of of Consortium uh and all this kind of open open infrastructure is is is key so how to manage this and and you're right we transparency some sometimes is not uh uh something that you you you you you could bring when it comes to customer data transaction and all this stuff also you have all the regulator uh constraints gdpr for example is is is a big piece of data uh let's say management that you need to cover as a bank because you are not allowed to to to to share this data of your client from from a business perspective I don't think that clients from Banks or any other institutions wants to their competitors to look at their transactions and to keep track of it on on a history or whatever so these are two things that are not really very uh online so what happens today is that all all the actors are looking to how to manage security and how to encrypt some data on a public blockchains for example and that the way that only people who needs to know will know about it and this is this is one of the the the the the more I would say um uh discussion that we are doing with a lot of actors basically you still have the blockchain or layer one or whatever custody settlement way which is working and now you need to build applications you need to build trups or Layer Two or whatever where we we you manage the uh the the confidentiality you manage the data that you don't want to to to to make it uh open for everybody and still benefit from the open infrastructure still benefit from the open systems and for uh let's say the robustness of a public infrastructure that is open to everybody and everybody could manage the the the smart contact to see how it works and reduce somehow the risk of uh Corruption of this kind of things got you so we're we're on the journey you're I'll come to you as well as I said kais has kind of outlined we've got a spectrum from fully private shielded chains that could be public we've got fully private DTS land parties where you have Consortium chains and you have fully transparent public blockchains in your engagement with European Parliament and others where do you stand on whether this blockchain infrastructure is fit for purpose at the moment for for data protection and privacy well that's difficult one right um in my case and for inh herity for instance uh we use uh a public blockchain of choice of your choicing uh for the simple reason that it's it's almost Community Driven right everybody can pop up a so you have you have the immutable aspects of the of your store data that you want to protect that's what we do we St we use blockchain as a storage layer we equip the data so transparency it's only transaction wise that we need the transparency but not the data itself it's encrypted so for that part we can go public if you have go to a private blockchain you have to deal again with yeah who's going to deal with that one right so uh so it's you have to draw the line where which use case and where you want to use yeah it's it's an interesting one and I mean um guys talked about what happens in a post Quantum world and if we are encrypting data onchain today can that that data be decrypted at a later stage you know it's a level of comfort right it's a spectrum um from a personal perspective I work for a project called Midnight what we're looking at is rather than having encrypted data on chain the use of zero knowledge proofs so a fundamental concept is send proofs of data not the data itself keep the information on the client ser server generate the proof on the client server and pass that proof to the smart contract so we can we can create a world on chain with blockchains where none of the sensitive data ever leaves the client side it can remain on premise not even on cloud back to the traditional banking infrastructure um but at this point in time zero knowledge probably is a generation of blockchain which I think Regulators probably aren't experienced with using banks are just getting up to speed with and I think we've still got a little bit of time right first we created Bitcoins we had a decentralized network that's exciting then we added programmability with ethereum and so on and so forth we added a small amount of interoperability with chains like Cosmos polka dot cardano and some others that were starting to create movement of assets between chains but we never really sold for data protection and privacy so something I think for the audience to look out for is starting to see more discussion around onchain programmable data protection maybe less encryption on a generation 2 public chain but how do we use a a generation 4 um roll up layer 2 or main chain that has some of these capabilities built in I think it's an an interesting journey of of Discovery but it's still it still feels new I remember talking about zero knowledge at conferences in 2017 thinking oh my God this is really exciting this is going to change everything and here we are in 2024 and it it still hasn't changed anything yet it takes time but it's progress right there is a a lot of progress on uh zero knowledge proof uh architecture and protocols but we we we still enhancing things if you can look at it from a historical point of view when we started work on clouds uh from institution or whoever we were very uh feing this this kind of things we better put all the infrastructure uh local don't use local servers uh cloud is a little bit not secured and these kind of things and then we start to get why to not to to buy or to rent a piece of this cloud and make it uh for for ourselves now we on on on the blockchains applications we are going in the same area uh in the beginning we wanted to make all the infrastructure local or conern or whatever it's closed when when you are going to to to uh to public blockchains you need to look at it a little bit different you need to see that today the information needs to be managed outside of your system you need to to to be able to to uh to make calculation make operations on the information outside of your system and from a technology point of view we are there when you look at things like FHA fhu full homeomorphic encryptions or a lot of things are happening from mathematical point of view that you are able to to manage encrypted data without knowing the data itself you are able to to make some operations on data encrypted without knowing what is the data inside which is a few years ago it's something is kind of magic now you you you are able to do it and you are able to to put some data on on let's say a public Area Public loud whatever and uh bring someone to make calculations make whatever the the the the operation on it without he he knows anything about what is in this data which is great and this kind of evolution is kind of uh the future of the use of blockchains in the public domains um and we see that these these things are still developing it's a lot of research area but this is the in the next two 3 four years that we will see the the benefits of this of these things lots to be excited for we couldn't come to a European blockchain convention and not talk about regulation MAA has been getting quite a lot of air time on the conference so far so we'll do a brief nod to it I think it's something from a European perspective that we should look at as a competitive Advantage but also possibly not and N I'm going to come to you we both sat and enjoyed a panel this morning with with bit panda a team of lawyers um and and crypto Finance talking specifically about the requirements on exchanges custodians and a number of other financial institutions around crypto assets digital assets and setting a high bar which can be a good thing but at the same time the additional security requirements may be challenging in a decentralized and Global industry what's your take on the implications of MAA for Security Professionals and and and being able to advance the industry so I think first I just want to start at a higher level right like first of all we all in this room want to be protected right so at a market level the way we want to be protected is against manipulation that somebody is not manipulating the price of ethereum Bitcoin or any of the top assets or even a smaller asset that we are buying right so in this way regulation is good because what it essentially tells you is hey if you're going to manipulate the market there'll be a price that you need to piay right so that's at again at the market level then you come at the each ins institutional level like you're talking about custody providers exchanges are they following the best and breed systems and processes and are is the is the customer here in the room insured right is he or she sure not only their processes are good but just in case something goes to happen there is some reserves and the customer funds and the proprietary funds of the exchange are not getting intermingled right like so there are number of processes around it right and then the last part that's essentially comes in if something goes bad is there enforcement is there uh investigation service that's out there which are essentially able to get back the funds right in terms of enforcement of some of those actions right so to me all that these three things MAA brings together but what also it does is it tilts the scale in favor of bigger firms right because only bigger firms for example institutions like Banks uh institutions which are able to raise very significant amount of money and maybe there needs to be a slowing in graduate process because you have institutions that been used to an Excel macro and have been running their business on that for whatever reason and you need to have a graduation path and maybe that graduation path is through some Outsourcing Services working with bigger Partners to be essentially to be able to get there but overall MAA is hugely welcome and the other thing that needs to be done is just to make sure that Ma not only applies to institutions that are operating within Europe but also institutions that are outside of Europe because otherwise it'll become useless because people will go outside and essentially do their business yeah it's really good having a very high wall and high castle out here but if all of your customers are going outside to a lower lower regulated or more accessible or better user experience true also you risk losing Talent yeah and Regulatory Arbitrage right I mean you just have to make sure that doesn't happen Canada lost ethereum to Switzerland because of better regulation and better regulatory user experience that would be the fifth largest company in the history of Canada if ethereum still remained where it was where it's originally created so um some lessons learned for Regulators is that this is a large industry it's only growing and growing at a rapid pace don't dissuade the innovators so with a couple of minutes left I'm going to ask each of my panelists to give one area of focus or one tip for you guys as an audience when it comes to security and and data protection to take away I'll start with you jogen if there's one thing you'd like this audience to take away from this session or in the area of data protection and security what would you want it to be maybe for those uh willing to create their own dabs or their being their having their own development company I would suggest that they do prop segregation of responsibilities uh you can't allow a full stack death also deploy your infrastructure you need to have a real segmentation of responsibilities in between the key players of your government company basically because inside jobes that you were referring to before most of them could be prevented if you have uh strategy in place to have those policies uh written up that's a good one k one thing from you yeah maybe to to come back to the risk and uh kind of risk that needs really to be uh really managed is that this technology or those Technologies are really very fast moving uh the things are moving very very fast and for institutions and even for others to follow the this Evolution you you need to be uh you need to predict many things and you need to be aware of what will happen in the next few years for months because things are really moving very very fast and if you just keep your systems working as 10 years ago where Evolution needs one year two years to be implemented you will not manage anything so basically the the thing that you need to put in mind that these things are evolu very very fast need to manage that from higher level need to have all the process that could be adopted very quickly and this the only way to manage this new uh security gaps or security issues and all of these kind of things so Anthony my message message will be to the foundations because today they represent everybody in this room and they have a seat at the table in most of the ecosystems right the foundations need to take this forward in terms of better infrastructure hugely scalable and and security apparatus behind all the chains that they're being part of because that's one place who can force the ship to happen to make sure that we all stay safe and and crypto can become a much much better World versus where it is today brilliant thank you very much thank you to the audience with us thank you to my three panelists give them a big round of applause thank you and you guys can go have some lunch and we're going to stay for the obligatory selfie on stage because Victoria and Daniel did say that we have to do lots of social media engagements so we are going to have