The blockchain security framework will include mandatory security requirements and best practices that are related to blockchain.
The areas will include the below but are not limited to -
1. Selection of programming languages, frameworks, etc. in a way to avoid 'Using Components with Known Vulnerabilities'
2. Creation of business requirement document to envision functionality, security requirements, blockchain permissions, consensus permissions, etc. This is to ensure secure business requirement review and secure network architecture review takes place over a period of time and all changes are tracked, version and approved.
An example of different blockchain and consensus permissions is as below -
blockchain permissions - permissions and restrictions for network, users, inputs, outputs, transactions, management of assets, etc.
consensus mechanisms - proof of work, proof of stake, delegated proof of stake, proof of burn, federated byzantine agreement, etc.
3. Appropriate change, incident and patch management process with defined SLA's
4. Secure Configuration Review documents for all frameworks, softwares, server flavors, etc. used in making of the blockchain product - this is to ensure all the components have optimum secure configuration during the initial stage itself.
5. Secure Code Review during each stage to build the code securely over a period of time and come up with the secure build(the build may be firmware or an application, etc.)
6. Vulnerability Assessment, Penetration Testing, API Testing, Application Testing(Web/Mobile) of the servers, hardware wallets, app/dapp testing, etc.
7. Smart contracts assessments/testing/permission review, firmware testing, load testing, hardware testing, etc. depending on the blockchain product/solution
8. Firewall review - review of all firewall rules for each component/nodes
9. Database review - review of roles, data storage mechanisms, etc.
10. Data Review - Review of data during each stage of the product life cycle to ensure sensitive data is well managed and compliance from data security laws perspective levels like GDPR are achieved
11. Audit and Log Management Review - To ensure that all aspects of the logging and error management are done securely and only non-sensitive logs/events/error messages are accessible to the end user
12. Forensic Readiness Review - To ensure that the product has all possible forensic level readiness to be able to perform forensic review asap in case of an attack</p>
The license of the project is as described in CC BY-SA 4.0
For more understanding, refer https://creativecommons.org/licenses/by-sa/4.0/</p>
Involvement in the development and promotion of the project is highly encouraged. You do not have to be a security expert or a programmer to contribute. Some of the ways you can help us are follows -
- Help us with the documentation as a collaborator for the project
- Provide topics that you would like to be covered as part of the project
- Request to join the mailing lists and help review the project
- Refer like-minded people to participate/help with the project
- Assist/Invite with events related to blockchain to help promote the project or interact with people from the community to help spread the word and refine the project with their opinions