Byte-Sized Security: How to Deploy a Minimum Viable Secure Crypto Product in 2024 | Kevin Costello

[Music] get let's hear that buffer corn yell oh tough crowd tough crowd uh so we're from Highland security we're a security company that helps web 3 organizations to audit their smart contracts as well as just general best practice in uh securing their protocol we also do a lot of work with Venture Capital firms and investors on investing in the space uh so today we're going to do a little talk about what we find from both sides of the aisle so to speak on uh what VCS look for as well as uh what what you kind of need to do in 2024 in order not to get hacked um so my name is Kevin I'm the head of services at Highland security uh I've been a security researcher on the bug Bounty side and got the opportunity to go full-time last year so really enjoying it I'm here with Ryan today Ryan you want to do a quick introduction yeah good to meet everybody here uh so I've been in the cyber security space about 22 years now blockchain space for about seven uh I'm a principal here I also help a lot in our managed uh due diligence services for VCS and investors so we're going to be bringing in some of that knowledge for you guys today so here's a quick overview of what we're going to go through today we're uh we only got 20 minutes so we're just going to go a quick overview and then we have a PDF takeaway that you guys can get and we'll be around the rest event if anyone has any more questions um so really the first part of this is going to be kind of understanding who your kind of target market is and then we're going to the last half of the presentation is going to be around the common things that you know all the VC companies ask us and when they're looking to do due diligence either to make like a investment in a series round or just kind of buy your a token or or use the protocol uh as well as like some of the things that you know we would recommend anyone kind of launching this year to kind of build into their protocol so Ryan's going to start us off here Ryan you want to take it away yeah thanks so one of the reasons we want to emphasize understanding your Market is that at least for us we're not necessarily sitting here as security zealots we're not telling you that security is the utmost thing and it should inform everything about your business your business strategy should be informing your security strategy and your business strategy generally depends on what Market you're targeting so what does your Market want okay maybe we're talking more defi than anything here but usually they want some kind of value or some kind of return from working with you first and foremost then they really want to know where can I get the greatest return that is within my risk tolerance so we're going to talk a lot about different markets and market segments but each one is going to have a different tolerance for um where they want to put their risks and where they want to get their rewards from so when we look at traditional Finance traditional Finance is getting more and more into the crypto space right now there are ETFs coming around um mostly in the Bitcoin area but they're quickly going to come to ethereum and then they're going to broaden out hopefully to the rest of the cryptocurrencies and other assets inside the space they're really used to Frameworks like sock 2 due diligence processes but one thing that's really key for them is they have a rudimentary crypto knowledge they're not going to understand necessarily everything that you're talking about in the crypto space they're going want to want to um refer that to what they understand today in the finance space then you've got your maybe hybrids the crypto native uh organizations that are proficient in Chains and protocols they understand the space really well they're really investing more and more into the crypto space but often what we're finding working with them is they have more of a rudimentary knowledge in the security space so they're not necessarily looking at the sock twos or the N Frameworks or those sorts of things and they're looking at what you're doing in security then finally we've got the DJ they're looking for Price action all they care about is you know where the next uh where the next uh um to the moon is going to be uh we're not going to talk about them today they're not really going to be that concerned with your security strategy and your security policies um we're really going to more talk about the other two groups so let's let's go through a couple examples um we've got uh a more detailed uh presentation here at the end that you'll be able to get later um when you're looking at transparent and you're thinking about it from a business perspective often you're wondering you know should I be an anonymous Collective should I be working through what should I be sharing with my community well traditional Finance is going to look for acknowledged identities they are not going to invest in you or bring their money to your organization if they have no idea who you are uh if you've got no corporate structure and you're you're purely a DA with no no backing of an LLC or something like that it's going to put them off in some way they're also looking for published information that is readily available to them so it needs to be on on gitbook or or on your website somewhere that actually details out the questions they're looking for or they're going to need access directly to you and your team to answer those questions before they're going to invest which is going to take time away from them now they're also looking for the same things that the crypto natives are looking for the public source code repositories some kind of open governance model if there is decentralized governance uh your vesting schedule needs to be public and needs to be transparent so they need to know who's getting those coins and what's going on and they need to have some kind of listing generally okay yeah you're on defi llama or you're on some of these other crypto sites that they can actually get information about you notice none of this generally looks like security information right now it's because what they're looking for and what all of your clients are looking for is they want to compare your strategy to their risks and their risks are often things like sanctioned entity risks or kyc an money laundering type type of risks that they're looking at today which you may not even consider into a security policy but is something that that is directly in line with their risk management practices so what about vulnerability management when somebody tells you you have a vulnerability what are they going to look for they're not just looking for an audit uh often when we're working with organizations today they're going to have an audit um and it might be some random company that's just shown up you know six weeks ago but gave them the best price and had some availability that's not going to cut it for the traditional Finance space and honestly that's not really going to cut going to cut it generally for the crypto native space either they're going to look for the Auditors that they trust which might be different depending on the organization so if you already know who your target market is and you have contacts with them ask them who they would like to see uh you get an audit from and don't just take any any company that you actually see um bug Bounty programs are a little more open for that doesn't have to even be a hosted bug Bounty program it can in some ways be private if you're a big enough organization and trusted enough um but you have to have enough of a bounty to match the amount of tvl you have or the value that they're putting into your project and then finally this is something that we see missing in a lot of places it's how you're actually going to respond to a notification that there is a vulnerability uh do you have an upgrade path or you are you um do you have a migration path for example for your for your clients and is that something that you're transparent with your user base on um now the crypto natives are looking more of like do you have multiple audits or not um is the audit over the last code that you've pushed on chain or not um or is it something from a previous version um and uh are those Auditors actually acknowledging the Audits and what I mean by that is some Auditors can post the audits that they've done on their site some of them don't um but for things like rug Poes that kind of thing nowadays they're actually saying they're getting an audit from a certain organization um they might even claim that they got it and went great but if there's no public availability for that audit file as well uh and if it's not posted by the auditor themselves then there's less trust in that audit um so you need to find somebody who's actually going to stand behind the audit that they've done and then finally from a control perspective when you're looking at how much control do you have over the project that you're deploying you might want it to be incredibly decentralized no one has control over it at all it's completely immutable and you want it to live on its own after you launch those are uh great ideologies for the space but they sometimes don't line up with the trafi or the crypto native expectations right now uh trafi is looking more of like do you have the ability to actively respond take usdc for example that can Blacklist addresses that are say or that were involved in a hack they're looking for those types of capabilities they're also looking for you to have some kind of um strategy when it comes to crisis management or or or manage response capabilities and what you can actually do and first and foremost on this entire list they want to make sure that that they limit their exposure to suction entities which means if you have controls that can help them do that you're much more attractive now here's where that does not necessarily map with the crypto natives they're much more accepting of decentralized protocols and capabilities um they want to see some Dow governance they probably want to participate in that Dow governance uh and they want enforcement of things like multisig time locks etc for things like code changes now there are a lot more examples of this that we'll be able to share after the presentation but here's just some things that you can look at um that might inform your strategy awesome so now that you have an idea of kind of what your strategy should be and kind of Base it off of who your target market is uh let's take a look at kind of how most Protocols are approaching Security today uh if you notice that this is a very uh code Centric code testing type of methodology there's this period of kind of building like a lot of what's going on here this week where you know code commits are flying people slinging around code uh you you get to a point where you have a good prototype and you kind to want to launch it and you start talking to audit companies uh a lot of auto companies now you need about a six-month lead time depending on who you are which is kind of crazy but uh you go through this Loop of audits or multiple audits fixing vulnerabilities re auditing and this kind of like Nth Degree uh circular pattern and then you ultimately launch uh inevitably what we've kind of find out that this approach doesn't really work because there's either going to be a hack where you lose money and get it back or you know a full kind of compromise where you're out funds and that's kind of where the response aspect comes in so if you if you haven't really thought about some of the security items that you need to do up front you know this could be a bad day for your protocol and sometimes even kind of like protocol ending uh in a lot of cases nowadays you can usually get negotiate to get like something back but I would say that's not a really good thing to rely on um so the way that we like to look at it is a little bit more of holistic approach uh so we have this long list of security items on the left we're definitely not recommending that you do everything in this list again it kind of comes back to your strategy and kind of what your um target market is going to expect but what we do recommend is the earlier that you start kind of thinking about this uh the more value you'll get in the later half of the kind of development process um so if you look at a little scale here some of these kind of items if you think about them up front really go a long way um so I think out of the out of the top the top two there I think really are kind of minimum table Stakes nowadays uh with the cyber security program you know a lot of fun are lost just to kind of your web 2 social engineering and kind of fishing attacks uh you know those problems have kind of been solved uh you can get software out there there's lots of resources out there that you can kind of reuse for web to we don't necessarily need to reinvent the wheel uh for that one um I think a threat model is also a really great place to start uh basically what a threat model is is a design document where you kind of just list out all the likely threats that your protocols will face and how you're going to design your protocol to be resilient into those threats um after that in the pre-launch phase you know there's a whole host of things that you could do um I think a lot of this is really based again on kind of your code your code who your target Mar Market is what your Tech stack looks like um I think some capabilities in in all of these phases are are generally a good idea uh just to kind of the the the tricky part with security is you're only as strong as you're kind of weakest link very cliche phase of the security phase but it's unfortunately very true um and then once you launch you know again there's some activities that that you should keep in mind here uh I think the big one that Ryan kind of mentioned is a bug Bounty program uh a lot of people kind of associate bug Bounty program with like immuni or some of those other big um kind of hosted providers in the space really doesn't have to be that I think you could do your self-hosted one I think the point is if you just have a public place where people can come to report you vulnerabilities uh you know that's really what you're going for there uh all right now we're going to get into the meat of the matter here so uh with all of that being said every time we talk to kind of these VC firms potential investors um and the like there kind of all comes back to six things that they all kind of look at at a high level uh they within within these six things some of them have different kind of Tolerance thresholds of like what they like to see but if you have an element of all of these six things you know you're you're going to be in a good spot uh with particularly with the VC firms um so the first one I kind of mentioned is like a basic cybercity program again this stuff has been is out there in the web 2 space we don't really need to reinvent the wheel for web 3 I think it's just all about understanding who your threats are and then tailoring something to that so if you look at things it seems like most people are using kind of Google Drive uh you know some sort of like messaging Discord just some like kind of basic hardening and uh some security hygiene that space really goes a long way um the next kind of component here is access controls uh really looking for like a tiered access model that could be through the use of kind of multisig but then also with something like open Zeppelins Access Control ownable libraries uh really kind of defining each of roles and what they should do and then kind of having that Associated testing which is the next one to really test out those roles a lot of uh easy low hanging fruit vulnerabilities that we find just comes from you know a function that didn't have the correct modifier and uh you know somebody can set a rate that shouldn't have been be able to set and lose money that way um so really kind of understanding that in the threat model of who who's going to be interacting with your protocol who's the trusted entities what should they be able to do what should they not be able to do where's the checks and balances you know that that that really can be done design time and and it pays dividends later uh the next one here is really doing some product security testing so seems like everyone at least has like an integration test Suite done where they're testing you know different functions making sure they they all work together right um you know we're we're telling our clients nowadays to kind of embed some security tests in that it's not a it's not a silver bullet of course but uh you can actually find a lot of like things that you probably shouldn't have an auditor telling you that just like kind of like should be done in the pre- audit phase to uh during this step so the other uh area that we we didn't really mention that much is defining invariant so an invariant is a condition of your protocol or system that should always be held true uh these are really good to Define in design phase and then you can actually build some tests to make sure that they are true uh things like uh for an erc20 type token you know total total deposits and should always equal the total Supply things things like very basic conditions like that um and then you can also add some kind of fuzzing around those invariants as well to really find those edge cases which tend to lead to the vul vulnerabilities um as Ryan mentioned and I mentioned earlier there's there's a lot of hacks still taking place uh I think in our primary we said 1 billion last year it's probably actually closer to two billion was lost um so having some sort of plan for the inevitable uh really you really goes it pays dividends right so if you have uh some sort of like okay how are we going to detect that something's wrong like ideally you shouldn't be relying on you know your community and Discord telling you that something's wrong like you should have some kind of canaries in the coal mine up front uh to know that hey we have an issue that we need to take action on uh and then I think another key part of that is like who is going to take what actions uh a lot of teams are very small that we work with you know three to five developers maybe some contractors mixed in there uh having some understanding of who's going to do what before something happens allows you kind of respond a lot quicker pause a protocol or take some other defensive action to really kind of minimize any any kind of impact that happens uh kind of hand inand with the inant response plan um spe specifically with Crypt native and the tread financy kind of publishing some elements of your plan also is a very good practice that we're we're we like to see and the VC firms like to see as well um just to have your community kind of knows what to expect if something does happen uh whether that's hey we'll still be able to withdraw the funds maybe we just won't be able to do other things in the protocol or uh you know if if you can um um like how they how they might be reimbursed like maybe it's a governance vote whatever you decide is appropriate for you uh this is kind of a good spot to kind of publish that in your docks and then the last one here is really around secret material protections uh so this kind of goes hand inand with the with the first point of um you know it all comes down to your keys at the at the end of the day right not not your keys not your coin is like a big phrase that I that I am really proponent of um a fishing attack can really really hurt protocol so just having some sort of technical solution to protect your key material whether that's using something like a multisig like I mentioned where there's you know an appropriate threshold uh it could be something like fire blocks that's a good good option as well uh but just having some strategy around that like if somebody clicks a link you know it's not a total kind of protocol loss uh because it's inevitably going to happen that even I like I hate to admit it but I've been fished as well too it uh it just is too common if it's super targeted enough you know it's almost impossible not to fall for it uh we're coming up on time here but uh we'll be around the event for the rest of today and the rest of this week if you guys have any questions or want to know some specifics for your kind of protocol you know happy to talk to security uh we also have a QR code if you want to scan that and you like this content uh we're going to be sending out all of this in a guide format um so that you can kind of take this and as you're kind of building you know uh integrated with your protocol uh that's all from us but uh thanks for listening and we'll be around on the side if anyone has any questions