rainforest @rainforestqaBitcoin + Ops Primer:!Understand your riskManage attacks
View Slide
@rainforestqarainforestRainforestHuman powered QA SaaSDesigned for ‘Continuous QA’Built for PMs and Developers
@rainforestqarainforestUsTeam of 6 in SoMaAll developersYC S12
@rainforestqarainforestUnderstanding risk
rainforest @rainforestqaUnderstand the trade offMore secure generally means more effort
@rainforestqarainforestRisk vs Exposure
@rainforestqarainforestHigh RisksHot wallets / key storageOutgoing paymentsPhysically shipped itemsReversible payments (e.g. chargebacks)
@rainforestqarainforest…more risksShared hosting / VPS / “physical” securityStaff
@rainforestqarainforestLimiting ExposureStoring keysHot wallets -> Cold wallets, where possPrinciple of least privilege
@rainforestqarainforestWhat risks?
rainforest @rainforestqaInternet connected = hackable(Though, the NSA can spy on you, even if you're not connected to the Internet)
@rainforestqarainforestTop 5 >1k BTC hacks46k / Linode (Bitcoinica): exploit in admin area / staff—> hotwallet11k / Bitcoin7: “hacked”4.5k / BTC-E: Insecure external API key4k / Kronos: self hack / backdoor2.6k / Gox 2011: exploit in admin area
@rainforestqarainforestTop 3 reasons:
@rainforestqarainforestBadly configured servers /services
@rainforestqarainforestPoorly written software
@rainforestqarainforestExploits
@rainforestqarainforestAttack vectorsYour serviceYour customersYou & your team
@rainforestqarainforestYour serviceDomainEmailServers (app, db, etc)NetworkExternal servicesBackups
@rainforestqarainforestDomainDNS hijackingMITM attacksDoppelganger domains / Typo-squattingRenewals
@rainforestqarainforestHSTSPinning / force-sslCloudflare, imhoFirewall + IDS
@rainforestqarainforestEmailDKIM / SPFAccount stateClear email policiesLockout policy
@rainforestqarainforestServersShared / VPS / AWSDedicatedCo-lo>
@rainforestqarainforestOS + software updatesAutomate provisioningHire pen-testingHave a security program
@rainforestqarainforestTransactions & locking(see Flexcoin / Poloniex)
@rainforestqarainforestNetworkIDS / IDPS / HIDSFirewall (both ways)-complex-
@rainforestqarainforestExternal servicesVerify SSL certsLimit IPsWork out what + who you can trust
@rainforestqarainforestBackupsMajor security issueEncrypt themTest them
@rainforestqarainforestYour customersUnderstand their behavior(Progressive) Account limitsPoliciesKYC
@rainforestqarainforestPrimer
@rainforestqarainforestEducate yourself
@rainforestqarainforestPick secure by default tech
@rainforestqarainforest2FA
@rainforestqarainforestAvoid shared servers
@rainforestqarainforestHoney pots
@rainforestqarainforestAutomate deployment
@rainforestqarainforestUse SSH keys, rotate them
@rainforestqarainforestUse a Firewall
@rainforestqarainforestUse an IDS
@rainforestqarainforestEncrypt (and take!) backups
@rainforestqarainforestSubscribe to security lists
@rainforestqarainforestDo as little as possible
@rainforestqarainforestStaff opsec
@rainforestqarainforestPrinciple of least privilege
@rainforestqarainforestSplit your servers
@rainforestqarainforestOr consider LXC / KVM
@rainforestqarainforestSplit your app
@rainforestqarainforestServer:partitions + noexec + nosuidsplit running usersdisable rootremove packagesSELinux
@rainforestqarainforestStarting pointsFigure out your risk + exposureImplement low hanging fruitReduce surfacePlan the rest
@rainforestqarainforestConclusionsSimpler = betterUnderstand your exposure and limit it
@rainforestqarainforestFurther readingHacks: https://bitcointalk.org/index.php?topic=83794.0Flexcoin: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/Docker: http://www.slideshare.net/jpetazzo/linux-containers-lxc-docker-and-securityCVE: http://web.nvd.nist.gov/view/vuln/search?execution=e2s1
rainforest @rainforestqaQuestions?@rainforestqa@rhs
ukd1
yanzm
oracle4engineer
t88
shimashima35
____rina____
aramaki
chiroruxx
hirokiotsuka
yusukeshimizu
shao1555
gen519
bcantrill
vanstee
shlominoach
jonrohan
chriscoyier
bluesmoon
panda_program
trallard
rasmusluckow
hannesfritz
eileencodes
destraynor