The traditional financial industry is saddled with multiple pain points, and I predict that within 15 years, many financial and payment systems will be replaced by a wholesale shift to digital assets. Businesses want to achieve their goals by trading faster, conducting payments faster, cutting expenses, and doing it in a simpler and more secure way. I truly believe that digital assets will be a revolutionary force, because at the end of the day, if you want to work quickly and securely, with fewer parties taking their share along the way, that’s the way to go.

For CISOs operating in the digital assets world, that means a paradigm shift.

Information security in the world of digital assets

Just like a regular enterprise CISO, digital assets require security controls and layers of defense. As we’ve seen over the years, the best defense against cybercriminals is a multi-layered one that can provide redundancy in the event that one of the security controls fails. Attack vectors can be similar, but you need strategies unique to blockchain – unlike in traditional banking, mistakes that happen on the blockchain are irreversible, and the damage can potentially be much more devastating.

In the world of blockchain, your private key is your identity and access to the funds. That’s the “holy grail” you should always be looking to protect as a CISO.

Protecting your Private Keys, verifying your Deposit Addresses and doing both with secured credentials and authentication is crucial.

Once a key is stolen, it cannot be recovered; your money is gone forever. Hackers and other malicious actors (such as rogue employees) may attempt to compromise a victim’s private keys in order to access their wallet, which controls the funds they have stored on the blockchain. This enables the attacker to transfer the funds from the victim’s wallet to their own wallet, and this is exactly what Fireblocks aims to solve. We have developed the most secure wallet system in the world, and a suite of applications that offers the simplest and most secure way to work with digital assets.

If you’re a CISO entering the digital asset landscape, start by learning the foundations of this space.

Here are some examples of the basic foundations that DA CISOs should master:

• Blockchain technology and crypto infrastructure: Understand how blockchain works, and what consensus mechanisms, decentralized apps and smart contracts are.
• Security risks unique to crypto: These include 51% attacks (attacks on a cryptocurrency blockchain by an entity or group that controls more than 50% of the network), double spending attacks (a modification in a blockchain’s operation that lets attackers use a token multiple times), and the multiplicity of vulnerabilities in smart contracts. Research shows that the majority of attacks on blockchain and crypto are centered on smart contracts and phishing.
  To transfer funds to a counterparty, it’s necessary for both parties to exchange deposit addresses. Hackers target the deposit address exchange process at a number of points along the way. This includes spoofing the address in copy/paste activities, fraudulent chrome web extensions that hijack the web browser (man-in-the-browser), or malware on a counterparty’s computer that modifies the copy ‘n’ paste of a deposit address to send assets to the hacker’s wallet. To mitigate the threat of deposit address compromise, you could test the transfer in small value or whitelist the address.
• Cryptography: How do you confirm a good transaction and your ownership of the digital assets? It’s important to learn techniques specific to digital assets, including public and private key management, cryptographic hashing and digital signatures. Familiarize yourself with encryption standards and best practices for securing digital assets and transactions. Remember: If someone steals your private key, they have all your money.
• Compliance and regulation are evolving disciplines. Financial services agencies, governments, and regulators worldwide are still developing legal frameworks, regulations, and best practices.
  Some legal frameworks and compliance standards have already emerged, and CISOs need to be aware of anti-money laundering and know-your-customer regulations, which can differ across jurisdictions. CISOs also should be familiar with industry-specific standards and guidelines from entities like the Financial Action Task Force and Securities and Exchange Commission.
• Custody and Storage: Cold storage involves transferring private cryptocurrency keys to an offline device or medium. On the other hand, hot wallets are connected to another device or the internet. Be familiar with the differences and the security implications of each.

Five pillars for a defense-in-depth security framework

The best defense against cybercriminals is a multi-layered security approach that can provide redundancy in the event that one of the security controls fails. Given the uniqueness of digital assets, I have outlined the following five pillars supporting a defense-in-depth framework.

1. Key Management

Your private key is your identity and represents access to the funds, therefore it needs to be secured. The best defense against cybercriminals is a multi-layered security approach that works in an extreme zero trust architecture.

For example, when you issue private keys, make sure you’re on a stand-alone machine. Use multi-signature and MPC mechanisms to sign transactions and assure maximum security and privacy. Fireblocks MPC represents a powerful next step in private key security because it removes the single point of compromise, and it’s even more effective if it’s secured in hardware.

Have a secure backup solution in place, using a geographically distributed, encrypted method to store private keys and recovery phrases.

2. Identity and Access Management Security

Access to resources is of the utmost importance in the digital asset world. A CISO should manage human and non-human identities, access and privilege management using the “least privilege” principle.

Implement specific approval policies for every transaction and configure a list of rules that affect how transactions are handled and approved.

Access to sensitive resources should be secured from both the network (e.g. utilize VPN) and strong identity provider. This conditional access will help to eliminate a single point of compromise.

Require Multi-Factor Authentication (MFA) using Passkeys/a security token that enables users to add a second authentication factor.

Today, institutions use chip-level hardware isolation and biometric factors to securely authenticate users and store API secrets. The unique security properties of chip-level hardware enclaves guarantee confidentiality and execution integrity. In addition, Android and iPhones include hardware-isolated biometric authentication capabilities. This prevents hackers and hosting providers from accessing credentials/keys and enables a strong multi-factor authentication of users that is not susceptible to spoofing.

3. Data Security

The emphasis on security in the development phase must be extreme. Security must be embedded in the culture of your R&D and product development teams much more than in any other industry.

When you are developing code in digital assets, you cannot make mistakes because transactions are irreversible and can cost companies hundreds of millions of dollars in losses. You’ll need a lot of preparation to make sure what you’re putting up is ironclad.

As smart contracts are a major vector of vulnerability, ensure that the smart contract you’re developing is free of flaws and bugs. This requires multiple code reviews, code scans, security audits, formal verifications by internal and external security teams. Consider hiring a niche cryptographic company to review the algorithms. Conduct numerous pen tests and bug bounties.

Usage of open source packages and other third-party services must be carefully examined for business logic and security flaws. The entire SDLC process should be secured by design, audited and monitored.

4. Detection and Incident Response

Companies operating in the digital assets domain should have a strong monitoring, incident response and forensics capabilities to achieve maximum security efficiency. Those are the foundations for the internal Security Operations Center, which is your expert in cyber and blockchain forensics.

Proactive detection techniques and live cyber intelligence updates should be an essential part of the monitoring strategy. An offensive approach is a key factor to proactively check your security resilience.

Familiarity with the enemy (nation-states, Lazarus, commercial attackers) and attack vectors (phishing, WC attacks, dApps) is crucial.

A good disaster recovery plan with crisis management drills specific to digital asset incidents is critical. To reduce the blast radius, adapt playbooks and continue learning of incidents such as wallet compromise.

5. Risk

Lastly, it’s all about risk management. Conduct comprehensive audits and risk assessments, including code reviews and threat modeling. Insider threats are risky due to the irreversible nature of blockchain.
CISOs must prepare employees and raise awareness to recognize and report because phishing is the No. 1 vector, and a new sophisticated way of phishing is looming.

In the world of digital assets, security awareness should be on steroids. AI is going to increase the sophistication of voice simulations and deep fakes. Threat actors will create QR codes that might bypass your email security.

It’s coming our way very fast, and I assume that digital assets companies will be the first to be hit because the rewards are so high.