Blockchain Security Framework
About the Project
The blockchain security framework project is aimed at creating a comprehensive framework that covers everything about blockchain security for organizations from the ideation stage till the production stage ensuring maximum security at each stage of the product/solution development.
OWASP Documentation Project - Blockchain Security Framework
Every technology has its own challenges in terms of achieving maximum security. Currently, there is no exhaustive resource available for blockchain security providing detailed understanding about how security should be incorporated during the ideation-creation-deployment of a blockchain project. To help resolve this issue, the aim is to create a comprehensive framework that can help resolve this issue.
The project will help understand the various stages and security requirements from documentation perspective, selection/review of components considered for development including programming language/stack, protocols, etc.,functional security review, security testing requirements, audit/logging requirements, forensic readiness(to ensure that any attack can be traced/investigated as quickly as possible).
The project is not limited to the above understanding and more areas will be added/edited as required by the community or individual requests to enhance the framework.
The blockchain security framework will include mandatory security requirements and best practices that are related to blockchain.
The areas will include the below but are not limited to -
1. Selection of programming languages, frameworks, etc. in a way to avoid 'Using Components with Known Vulnerabilities'
2. Creation of business requirement document to envision functionality, security requirements, blockchain permissions, consensus permissions, etc. This is to ensure secure business requirement review and secure network architecture review takes place over a period of time and all changes are tracked, version and approved.
An example of different blockchain and consensus permissions is as below -
blockchain permissions - permissions and restrictions for network, users, inputs, outputs, transactions, management of assets, etc.
consensus mechanisms - proof of work, proof of stake, delegated proof of stake, proof of burn, federated byzantine agreement, etc.
3. Appropriate change, incident and patch management process with defined SLA's
4. Secure Configuration Review documents for all frameworks, softwares, server flavors, etc. used in making of the blockchain product - this is to ensure all the components have optimum secure configuration during the initial stage itself.
5. Secure Code Review during each stage to build the code securely over a period of time and come up with the secure build(the build may be firmware or an application, etc.)
6. Vulnerability Assessment, Penetration Testing, API Testing, Application Testing(Web/Mobile) of the servers, hardware wallets, app/dapp testing, etc.
7. Smart contracts assessments/testing/permission review, firmware testing, load testing, hardware testing, etc. depending on the blockchain product/solution
8. Firewall review - review of all firewall rules for each component/nodes
9. Database review - review of roles, data storage mechanisms, etc.
10. Data Review - Review of data during each stage of the product life cycle to ensure sensitive data is well managed and compliance from data security laws perspective levels like GDPR are achieved
11. Audit and Log Management Review - To ensure that all aspects of the logging and error management are done securely and only non-sensitive logs/events/error messages are accessible to the end user
12. Forensic Readiness Review - To ensure that the product has all possible forensic level readiness to be able to perform forensic review asap in case of an attack
The license of the project is as described in CC BY-SA 4.0
For more understanding, refer https://creativecommons.org/licenses/by-sa/4.0/
Involvement in the development and promotion of the project is highly encouraged. You do not have to be a security expert or a programmer to contribute. Some of the ways you can help us are follows -
Deepak R Pandey