OWASP Blockchain AppSec Standard
About OWASP Blockchain AppSec Standard
The OWASP Blockchain AppSec Standard is a centralized knowledge base that provides an understanding of what good blockchain security looks like, while also equipping security professionals with timely, reliable insights and resources to stay informed.
The target audience for the Blockchain AppSec Standard includes the individuals and organizations responsible for designing, developing, deploying, operating, assessing, and governing blockchain-based applications and infrastructure.
The guidelines are designed to be accessible to both technical and non-technical stakeholders, recognizing that blockchain security requires collaboration across the entire software development lifecycle (SDLC).
1. Primary audience: Technical practitioners
These individuals are directly responsible for implementing, maintaining, and validating the security of blockchain applications.
2. Secondary audience: Security leadership and governance
These stakeholders establish security requirements, manage organizational risk, and oversee the implementation of security programs.
Blockchain is a cryptography based technology stack recording transactions in a trusted and transparent way. A block of transactions are chained together to form a ledger. The chain is distributed to multiple nodes (decentralized) and the majority consensus is sought to verify the block to become a part of the chain. If a transaction is agreed to be retroactively changed, all transactions after that will have to be changed as well, therefore it is not often that a transaction can get altered even with consensus, hence it is considered to be immutable. Chains can have one or more use cases, such as cryptocurrency, voting systems, supply chain tracking. Using an elliptic curve algorithm, private and public key pairs are created (up to 256 pairs). As a user, a private key is your secret key, and each public key is a wallet.
Each key pair can be used in a different chain, like Ethereum, Bitcoin or other named chains. Many blockchain projects and products require users to have a public-private key pair even when they never buy, sell, or hold cryptocurrency. The key pair can serve as a digital identity, authentication mechanism, credential verifier, or authorization mechanism rather than a means of managing currency.
Each chain has an immutable ledger that is viewable publicly but can only be changed with the majority of users’ consensus. Mining - the chain creates a challenge of the next required block (a specific hash outcome) and miners use their compute power to try different salts in their hashing to reach this outcome.
The first miner to reach and get proved by the chain gets rewarded. Web3 is a communication layer built on top of Internet Protocol. It utilizes blockchain technology to run the next generation of the internet and is envisioned to be decentralized (no single company or person owns it) and user-owned (users own their data and digital assets, often through tokens (e.g., NFTs).
Slack