The C4 CryptoCurrency Security Standard (CCSS) | Marlene (DeployOpen) Petri Basson, and Jake Silzer

yeah that's I think so so down great think we're ready so good afternoon everyone um super excited to see so many people here to learn about security um my name is Jake szer I am a cryptocurrency security evangelist I also work um at Ripple as an information security TPM and I'm also a cryptocurrency security standard auditor uh with C4 uh C4 is a nonprofit organization made up of uh cyber security and crypto Security Experts and also we're all volunteers as well um and today we really want to speak to you about the cryptocurrency security standard and um what it means to bring security more security with into this within the space and today I'm joined by two amazing panelists um Marlene and Petri and I'll let them both do their own their own introduction okay hi everyone my name is Marlene Dart and my background is in cyber security I have over 20 years of risk assessments it audits um forensics and secure architecture and design across Financial Services public and private sector afternoon everyone um so Petri bason my background is finance and it um used to be at KPMG we' did um sock audits cyber security audits for a lot of different entities and these days we're working with a lot of different foundations on their corporate governance um working on Dow operations and then also compliance and um sort of security for different entities wonderful and Petri as a ccss chair um can you give us an overview of what the ccss is sure so I think the ccss at a um high level is a standard that's been created around private keys and how do you secure private Keys um the origin origin of This was um I think a lot of people in the security industry seeing different hacks happen realizing that we need a standard for this um we have certain security standards out there sock one sock 2 um ISO Etc but when you look at those standards they don't really talk about private key security specifically so the ccss was created by different cryptocurrency and security Specialists um we've got a a very good roster of people working on it um so we've got a few security people um Jameson Lop that a lot of people might know um Ron Stoner who's also with Kasa then you've got Michael Perkins um he's um worked as ciso of shape shift um and Durk Anderson that has a lot of experience but you also have people with audit experience um so personally I used to do sock audits um for companies looked at custodians Etc um we've got Noah Buxton who works with the Network firm he's an auditor um yev Bevan with hacken um and then we've got mark kishos um he's also an auditor so it's a mix between people with really strong cyber crypto experience and Auditors that created the standard to help people wonderful yes it's great to have such a mixture of people involved in trying to secure the space uh Marlene um you were actually a cryptocurrency um security standard auditor can you tell us a little bit about why you decided to become an auditor sure um my story goes back to 2018 so at the time I was working at V as a chief security architect and I did a concept project using uh digital wallet and blockchain with integration with the VISA net to solve the problem of fraud with prepaid cards and so I started exploring different um standards for blockchain and looking for technical requirements for my design came across a conference and a workshop for the ccss that was being held in Denver so I went to I think it was the first um ccss workshop and Ron Stoner was uh the trainer and I got exposure to it and decided to become an auditor wonderful um I guess what do you see as the importance of the ccss well I think um you had mentioned also having some audit experience and I also have done sock audit PCI Hippa various regulatory Audits and the thing that I really like about the standard is that it's it really augments and supplements um specific in areas that matter such as Key Management wallet creation and operational controls and even though those requirements can be found in other um Frameworks or other standards such as nist it's uh a very endtoend comprehensive controls framework that's immediately usable and um for that reason I really was able to have that into my you know incorporate that into my design so I think that's uh probably one of the best reasons that I saw yeah yeah I agree I think it's a very easy to digest standard I think anyone in the crypto space could really take a look at it and learn quite a bit and know kind of what the end to-end process should be for securing a private key um I guess Petri um as a user um of different cryptocurrency service providers like exchanges and custody providers um why should I care whether they're ccssa certified or not I think maybe just to tag on to what you were just saying um because we're talking very high crypto security we're talking about you know corporations doing it but as you just said it's a very accessible um standard so even if you're doing your own private Keys um we've got the levels Etc so even for individuals it's very useful just for the things to consider when you're doing self- custody to answer your question I think for anyone using an exchange um we've always had that principle of trust but verify um at the moment a lot of it is trust um with no verification so that verification is very important but as an exchange I can't open up my doors to anyone to come and have a look at my security explain to them how that works so that's where if you've got an independent auditor someone like marene who comes in they look at all of those controls um they verify that you're actually doing all the stuff that you're saying on your website because anyone could put a lot of stuff on a website say that they're doing and then what we have in the ccss is also a peer review so it isn't just one auditor going in there you've got a peer reviewer who verifies everything as well um which creates that trust over time then um because now you have independent parties that have come in verified that all the controls are there yeah I love that I love you don't have to kind of um just have one person who's doing the verification right you have a quorum of individuals that are really going in and making sure um that an exchange or a custom provider is meeting all of these different requirements ments um I guess from the flip side um as a service provider like an exchange or custody provider why should I want to spend the time the resources to pursue CCS ccss certification I think there's there's two sides to that the first side is because this is an industry standard um this has been through the rigger a lot of very smart people have worked on it so if you're designing a private key management system this is very important so you can actually work through it design a system that's very robust very secure takes into consideration a lot of different things and the second side of this is more for your users to actually show that you have the confidence to get someone in to actually look at everything you can have that all verified um so I think the one side is a design thing um the other side is almost a PR thing to be able to show to your users give them that confidence wonderful and I guess speaking of the audit U marleene Can you tell us a little bit about the audit process and the rigor that goes into an audit it yes one of the things that I really love about the standard is that it requires a peer review so as an auditor I would conduct the initial audit and then that audit result has to actually be peer-reviewed by another ccssa and I have never seen any other um regulatory framework or audit requirement that actually has peer review by another certified auditor that doesn't have bias um and is also not affiliated directly with the organization the the way that the auditor is chosen is randomly for the peer reviews so I think that builds in additional um scrutiny and transparency wonderful um you're also part of a working group currently um where there's a team member working with different Regulators can you talk about your experience and kind of what the some of the goals are with the advocacy group yes and I'm I want to go back to what you said so one of the another reason that I am participating in the advoc advocacy group and why I also like the um standard is that it's open source so anyone can contribute and you have industry experts uh people who care about security and um instilling safety and participating in these standards and so it's meant to um be scr ored and to be improved by people who want to participate so it's totally accessible that way um I think yeah I think that's wonderful so you know anyone can really contribute to this this open source standard so if you're interested you go read it you think that we're missing something I'd love it if you come and actually provide us some feedback on that as well yeah I think maybe to add on to that as the ccsa committee we take a lot of these recommendations and questions very ser seriously and have very long conversations about this um proof of reserves is one really good example we used to have a a section on proof of reserves but over time it sort of realized how much that actually takes and then removed proof of reserves from the standard completely so we don't almost have that in there we focus only on the security side of things um but also very open to people who have suggestions if someone wants to help to write a proof of Reserve standard um it is almost pulling that Collective knowledge to strengthen the entire industry yeah and um we meet weekly basically and we have long conversations about things and it's coming from a practitioner point of view which I also like so actually having experience or Real World Knowledge about what's going to work um there's different levels in the standard I don't think we've talked about the levels so there's levels one two and three and um even just achieving a baseline controls with level one is uh respectable and uh that's another thing I like is that it it lends itself to um anyone who's adopting the standard to just establish the Baseline controls and then also uh aim for improvements going up to level three if that's something that they wish to do yeah I agree I think um you know for myself like I don't go out and do audits um of the standard but you know with ripple as a company we do um you know custody people's U crypto assets and so it's been a very useful standard for me to kind of look at and see where we're meeting best practices or maybe where we can um improve as well so I think anyone who's kind of in a security role as well at a crypto Focus company can really get a lot of value from the standard yeah yeah I wanted to mention also that um you can easily create a self assessment from the standard and so before you would even consider bringing in an auditor just taking the standard and coming up with a self assessment I think is also um very valuable I think maybe the one thing to add in here is we've also tried to make it um easy for people to use um because you've got the standard which talks about all the technical requirements but we also have the auditor guide um because not everyone out there is an auditor you have some people that have cyber security it backgrounds um who also are interested in these things and we've created that guide to actually help people through the process um explain you know what are you looking for how are you getting evidence how do you collect evidence and show that you've done all the different tests so we've tried to make it very accessible to all different fields you don't only have you know Auditors who can do this if you're a cyber security expert and you've never done an audit before there is a guide that can help you through the process yeah I want to touch on all of the um free tools and resources you just mentioned the audit guide which is very helpful there's also the uh standard itself which is downloadable by PDF and also in an Excel form if you want that it's pretty comprehensive um basically there's three high level components to that there's the key management wallet creation and operational controls and uh there's also some amazing scenarios that when you're studying to become a ccss auditor that you actually look at the four scenarios and it's really giving um examples real world examples and how you would actually uh take those scenarios and apply the standard for uh an assessment rating so it allows you to think through uh things that have actually really happened and uh there's what else is out there for collateral the um yeah we just released yeah we just released a level one training course actually um if you'd like to learn more about the cryptocurrency security standard um and for anyone who's attending eth Denver we do have a special coupon for 20% discount on that up on the screen so definitely recommend checking that out um even if you don't want to go to that full training course you know the standard is there on the website you can read through all of it um if you do want to become an auditor that's great um you know there's some training other training material and just a test to become an auditor but you know we really encourage everyone to participate in one way or another uh with ccss because it's really the strength of it is in the volunteers and the experience of the volunteers anything additional you would like to add or follow the YouTube channel um there's a lot of good training there and then there's also some training courses and uh I think we might have to flip the slide here if you can see that we're offering a 20% discount shown it a minute ago but looks like it's static on that one yeah um but yeah feel free to come up to us afterwards we're happy to answer any questions and happy to give you that discount code if you missed it um but yeah thank you everyone for attending thank you both Marlene and uh Petri as well uh really appreciate your time today and look forward to making the crypto space more secure for all of us thank you very much guys thanks [Applause] Jake