Difference between revisions of "Blockchain Security Framework"

About the Project

The blockchain security framework project is aimed at creating a comprehensive framework that covers everything about blockchain security for organizations from the ideation stage till the production stage ensuring maximum security at each stage of the product/solution development.

OWASP Documentation Project - Blockchain Security Framework

Every technology has its own challenges in terms of achieving maximum security. Currently, there is no exhaustive resource available for blockchain security providing detailed understanding about how security should be incorporated during the ideation-creation-deployment of a blockchain project. To help resolve this issue, the aim is to create a comprehensive framework that can help resolve this issue.

The project will help understand the various stages and security requirements from documentation perspective, selection/review of components considered for development including programming language/stack, protocols, etc.,functional security review, security testing requirements, audit/logging requirements, forensic readiness(to ensure that any attack can be traced/investigated as quickly as possible).

The project is not limited to the above understanding and more areas will be added/edited as required by the community or individual requests to enhance the framework.

Description

The blockchain security framework will include mandatory security requirements and best practices that are related to blockchain.

The areas will include the below but are not limited to - 

1. Selection of programming languages, frameworks, etc. in a way to avoid 'Using Components with Known Vulnerabilities' 

2. Creation of business requirement document to envision functionality, security requirements, blockchain permissions, consensus permissions, etc. This is to ensure secure business requirement review and secure network architecture review takes place over a period of time and all changes are tracked, version and approved. 

An example of different blockchain and consensus permissions is as below - 

blockchain permissions - permissions and restrictions for network, users, inputs, outputs, transactions, management of assets, etc. 

consensus mechanisms - proof of work, proof of stake, delegated proof of stake, proof of burn, federated byzantine agreement, etc. 

3. Appropriate change, incident and patch management process with defined SLA's 

4. Secure Configuration Review documents for all frameworks, softwares, server flavors, etc. used in making of the blockchain product - this is to ensure all the components have optimum secure configuration during the initial stage itself.

5. Secure Code Review during each stage to build the code securely over a period of time and come up with the secure build(the build may be firmware or an application, etc.) 

6. Vulnerability Assessment, Penetration Testing, API Testing, Application Testing(Web/Mobile) of the servers, hardware wallets, app/dapp testing, etc. 

7. Smart contracts assessments/testing/permission review, firmware testing, load testing, hardware testing, etc. depending on the blockchain product/solution

8. Firewall review - review of all firewall rules for each component/nodes

9. Database review - review of roles, data storage mechanisms, etc. 

10. Data Review - Review of data during each stage of the product life cycle to ensure sensitive data is well managed and compliance from data security laws perspective levels like GDPR are achieved 

11. Audit and Log Management Review - To ensure that all aspects of the logging and error management are done securely and only non-sensitive logs/events/error messages are accessible to the end user 

12. Forensic Readiness Review - To ensure that the product has all possible forensic level readiness to be able to perform forensic review asap in case of an attack

Licensing

The license of the project is as described in CC BY-SA 4.0

For more understanding, refer https://creativecommons.org/licenses/by-sa/4.0/

Getting Involved

Involvement in the development and promotion of the project is highly encouraged. You do not have to be a security expert or a programmer to contribute. Some of the ways you can help us are follows -

1. Help us with the documentation as a collaborator for the project
2. Provide topics that you would like to be covered as part of the project
3. Request to join the mailing lists and help review the project
4. Refer like-minded people to participate/help with the project
5. Assist/Invite with events related to blockchain to help promote the project or interact with people from the community to help spread the word and refine the project with their opinions

Project Resources

https://github.com/OWASP/Blockchain-Security-Framework

Classifications