Crypto Startups Say They Take Security Seriously… But Do They?

Transcript

Uh, do you want to get started, Ryan? >> Yeah, sure. So, I am uh Ryan. I'm the head of security at Gauntlet. Go >> ahead, Joe. I mean, I going that was a very elaborate introduction. >> You can go further if you want. >> Tell us about Gauntlet. >> Hi. Hi. My name is is Joe Dobson. Also go by DOBS and I do threat intelligence at Mandant. And what what that means is I identify and track bad guys as they move on and offchain. Right. So, also looking a lot at off-chain infrastructure. >> Cool. So, I'm Christopher. I look after Polygon security, specifically the Polygon products security and as well the smart contract engineering team.

>> I'm Ido, one of the co-founders at Blockade. Blockad's a real-time onchain security platform. We work with some of the biggest exchanges, wallets, protocols, asset managers to protect various different um uh things they build and run on chain. >> And I am Thiago. I'm a technical director at the crypto ISAC. Basically, what I do is I try to find data on and offchain, try to see how that data can help uh protect and prevent events and stop events uh incidents uh as soon as possible. All right. So, uh let's start with the topic, right? I mean we know that a lot of the uh security uh the crypto

startups they claim to to have security they claim to be a security first uh institution or organization but is that really the case so I'd like to start like with a you know provoking the the the folks here to talk about like what's the real uh the you know what's the real security scenario for these startups and uh what's you know what's the reality and what's the, you know, the the the philosophy that they they they sell around. >> Yeah. You know, I can jump in there quick. So, I've been in crypto for about five years now, and I've gotten to the habit where every time I see a hack, one of the first things I do is I look up

who's the head of security at that company. And if I don't find a head of security, the next thing I do is, okay, well, who's the security team at that company? I'll actually go and reach out to my network and try and figure this out. And it boggles my mind how often there is nobody or it's like an engineer who is double duty. Like here's my engineer who is also the security guy. I'm like if you're the engineer, you're busy. Like there's no way you are also doing all of the security stuff. Um so I've really been probing a lot and that that was kind of like why we wanted to talk about this is how many companies out there are actually going and building security teams. Um so go ahead Josh. I I I think that part of it is in my opinion and you all can tell me if

I'm wrong. >> I will. >> Security is not the default, right? You have to be intentional about security. It's not going to happen on its own. And so if you do not make an intentional explicit effort to have a security practice to do, you know, things in a secure way to to understand OBSAC and best practices, then you're not going to be secure. you are a a target waiting to happen, right? A great example of this is if if you fund a new EVM wallet, how long until you get your first fishing token? Does anyone know how long it takes?

Less than eight minutes until you get your first fishing token. Now, imagine a new user, new to crypto, brand new wallet, first time they ever use crypto, they fund it. within eight minutes they're already getting tokens sent to them that will drain whatever money they put into that wallet if they interact with them. We have to keep that in mind because the the default is crypto is kind of in a bad neighborhood, right? You need to have a security. You need to have best practices. >> Yeah. I know I I completely agree with what you both say over here. No, it's it's also it's a difficult cell. No, that's that's a problem really over here is like if for anybody that has worked in in security similar to people that have worked in in research for example,

it's difficult to tell like let's invest in security, you know, especially if nothing happens, if everything's okay if you know the end of the year comes and you know my my boss or the CEO of the company or the founder is like hey Christopher you know like um yeah I don't I don't think we need this security thing like uh what what what what is the return on investment? What do I get about it? Nothing happens. And that's that's a very difficult cell because how do you sell the fact that nothing happens is the benefit. No, a lot of people don't get it. They want they want that, you know, energy that want that, you know, scrolling ticking, you know, thing that says like, "Oh, ooh, amazing. Great job. Good job." But yeah, in security it's not really like that.

>> So, so Christopher though, talk to me about Polygon security team because I think Polygon has one of the stronger security teams in the space. I'm actually kind of jealous. Like I look at your team, I'm like, I can't build that at. Talk about how did you convince them to build out the team? >> I don't know. You should tell me. You were there before me. >> Yeah. >> Is it so? But still tell tell me about the uh >> No, I I think I think you start seeing the return on investment when uh you know you actually see the amount of like like crap that go through your network, the amount of bug bounties that you start paying, you know, when you start to see really the consequences and you see the consequences over time because they start accumulating. Okay, one fishing email, two fishing emails, like

who cares? You know, Google will will cover it. But once you start build getting employees and you know, you start getting public attraction and everything else, that's when things start to accumulate. No. And and compound the amount of fishing emails, the amount of bug bounties that you're paying, the amount of bugs that just the engineering team is, you know, having to fix that basically slows down. So then they start realizing like hey if my software development life cycle is starting to slow down because of the amount of bugs we need to fix from you know what is already out there then uh you know you kind of say like okay maybe you know if we had a security team that could take care of this that could make sure that you know my engineers are focusing on what they need to do you know which is not ideally triaging bugs

and stuff like that then it's when you start to see that return of investment and the same for fishing emails and stuff like that you don't want your IT team to be looking and triaging fishing emails realizing, hey, is this legit? Is this not legit? You know, you want a dedicated team to do that so that it can continue helping the business move forward. I I think though one way that security can provide a return on investment, right, it's still going to be a cost center, right? Even web 2 security is a cost center. We we have to accept that. But we're in an industry that runs a lot on hype and I think that security has not taken advantage of that. were a victim of the hype instead of being, you know, instead of being a victor of it in that if we had better

sharing, if folks would come out and say, "Hey, we were targeted by XYZ and here's how we stopped it and demonstrate thought leadership and security that would build some hype. That would build some return on investment because that's what leadership wants. They they want that that attention market share and that would help. I think >> I I want to ask one thing. You you mentioned you know security is like a cost center, right? It's been a cost center in web two. It's been a cost center in web 3. You know, I I think one thing that's really interesting about our industry specifically is that we're all building at least today, we're all building ultimately financial infrastructure like all of us, right?

And at least as a user when you think about like why use one piece of financial infrastructure versus another piece of financial infrastructure. I don't know what your answer would be, but mine is generally it's like I don't know. It's a thing I kind of trust, right? It's like this thing holds my money like it was there yesterday, it's going to be there today. like that that's why I go and and use that thing, right? I think like we're in Argentina, right? We were just speaking about like the the quos, right? Like before, right? That's I'm sorry for the misprononunciation. But but it's like, you know, the the and maybe like maybe someone from Argentina will come and pick me up for saying this, but like you know, you see the local the local economy, right? very much uh you know not trusting other things that we would kind of in the

states or in Canada and and and trusting you know things that are more um you know on the on the riskier side or things that we would otherwise not necessarily trust in the United States and so and so I'm curious like your thoughts is like uh like just my point here is you know we're building financial infrastructure trust is a differentiator right security builds trust why is it a cost center >> yeah so and just kind of like a kind of riffing off of that a little bit. Um why do we trust our money with protocols that clearly don't have sec like they have this advertising like oh we're security first and then like like literally if they don't have a security team like why are we giving them all this money to hold on to and just like taking that massive risk when we're like

to your point like we're complaining about other institutions not being trustworthy with our money but like there should be a way we can check this like if if I'm going to go and put my money in DeFi into some product or some vault I should be able to ask them Hey, tell me about your security. And it should be an like there should be some standard that's honest that says, yeah, no, this is what we really do. It's not just a bunch of BS on the web page, right? >> Beyond a PDF probably like beyond an audit that goes and says, "Okay, we're we're good." Right? You should you should have a team. Like you should I I think that's actually a really good like the thing you mentioned in the beginning, right? Like that check that you go and do. It's like who is the

team, >> right? People should probably go and check that before they put their money in in different vaults and different for different curators for for things like that, right? I I think people basically assume that no if if you look at the web two uh you know area actually all the all these companies when you work when you do B2B you have these standards you you know you have these frameworks in order to do security if you don't do these people are not going to buy from you and by people I mean businesses are not going to work with you they're not going to make transactions and so on but on the B2C in the web two you as a consumer you're just assuming your bank does does security it's like basic no but in crypto I I personally believe that a lot of people think that

protocols do security, that they're taking care of their infrastructure, they're taking care of their employees, of their laptops, but the truth is that probably 80% of all the protocols, if not more, don't have at all a security team as we were talking about it, but people just think it's implicit and it's there. >> So, what do you say to like these wonder teams and sorry to take the things are just coming to my head here, but like these wonder teams of like their excuse is I've got 10 employees and we've got $200 million in TVL. we're just too small to have a security team. Like, how do you h how do you make the case for that? Or what do you say to those people? Because I I've struggled when I've had to try and tell them, "No, I think you really need to hire someone

fast if you have that much in TVL." But >> I I think it's not about them, it's about the customer, and that's who they have to think about, right? Why do they need security? So that they can provide that value, they can protect the value for the consumer, for their customers. Um, and I think a solution is if they don't want to hire a full-time security person, they they can start out with something like like a viso, a virtual SISO, right? They they can start out with someone that offers, you know, security as a service. They can get some level at ADI of advice and input because I think that it's often that they don't have awareness of just how bad it is.

So one one thing a lot of the time people will just outsource for like consultancy firms like audits that's obviously great I mean I I was a consultant for more than 10 years and every time I went to like some of the big taxs to review source code I wanted to you know deliver my best and really find bugs and really get them fixed but uh especially for the the new companies who rely only on third party providers s what's the benefit of that and what's the limitation of that when it comes to actually getting and growing an internal team >> right so for first of all for auditing I mean at gauntlet we definitely outsource

auditing to the expertise like it's hard to to build an audit team inside a company because auditing is so incredibly specialized at least for a for a smaller place I know some places do actually build internally so you have like your solidity coders but having a full-time auditor is tough so we we would outsource Right. And that's a probably one of the areas where I'm really happy to outsource. Like it works well, right? Um other things in security I I prefer not to outsource, but I'll let you guys talk about that stuff first before we talk about what's not good outsource. >> No, I I think on on the on the previous thing you guys mentioned around, you know, I'm a I'm a team with with 2 million in TVL, right? I think like we as security practitioners like need to understand that security is an

afterthought, right? It is something that you bring on after you see some level of like success in your business in the first place. Right? If you have nothing to secure, you shouldn't spend on security obviously right now. $2 million is probably something that you should you should spend on like there is there is uh it's a meaningful amount of money where you should probably be spending on security if if if you have that right and so and I 100% agree with your with your like V viso analogy where it's like you don't need to hire, you don't need to build these teams. um you probably would be better off like like you know if you know the the amount of money you would want to spend on a on a CISO for bringing on right for for for $2 million better spent on a on a VCO

that fractionalizes and does a lot of these different things like for sure I think that uh you know there's you you mentioned like doing that for for smart contract audits I I and I totally agree with you that's that's great but when it comes to like building products or even like an L1 L2 uh if you don't really have like an expert inhouse or even like new, you know, fully dedicated to understanding the development road maps, the team cultures, you know, their their inner pains, what are the most critical components, what's missing there? Is it just, you know, security testing? Is it complex design? If the if you don't really understand the iners of those

development teams and integrate very closely with them, you won't be able to help. Right. Right. Right. >> So Chris, I I'd love to hear your experience in that sense. >> Yeah. I I I think you know probably difficult to sell, but I think the most important thing you to do you should do with doesn't matter if you're small, you're big, you're one person, you're 10 people, you're a million dollars, you're five bucks, is just understand what is your risk profile. like literally understand okay what is the worst thing that can happen and how could that happen just just answer those two questions what what is the worst thing that can happen to me and you know how could this happen and once you understand that question then you start making a plan and figuring out okay should I be spending in people to hire

security folks should I just be doing an audit like the worst thing that can happen is a smart contract hack okay then just do an audit you know couple of them hopefully then you're okay but if the worst thing that that can happen is an employee being compromised, a laptop being compromised, uh my AWS system being compromised. No, you need to understand what is that risk profile so that you can actually allocate resources appropriately to that and then measure it. No. Hey, if this happens, do am I gonna lose $10 million? Then maybe hiring for 200 a year or 300 a year a security guy. It's worth the money. You know, just need to do those economics.

>> In in web two, one recommendation we we have is that enterprises need to have a threat profile, right? They need to understand what are the threats facing them, what attackers would come after them, what kind of tools would they use, what you know the TTPs, tool tactics and procedures. What does that look like? And we encourage them to make that a constant re-evaluation, right? You don't just make it once and it's good for five years. You actually need to sit down and re-evaluate as technology changes, as the the the world changes, as there's new types of threats out there. You need to re-evaluate what does your threat profile look like so that you can protect your organization. That's one of the the sad things about web 3 to me is

in web 3 a compromise can be catastrophic for an organization but security is not taken near as seriously as it should be. In web two compromise is traditionally not as catastrophic for an organization but a lot of them take security much more seriously. I think this is a really interesting point on just like how liquid vulnerabilities or exploits or like security issues in crypto are compared to like like web two and I'm I'm sure you've like heard of this kind of analogy but like you know it's crazy you find a vulnerability like even a zero day in like uh um in web 2 and if you want to go and actually weaponize that to make a million bucks pretty pretty darn difficult to do like uh um you you you know you have to start

like you know building malware around that you have to go and deploy deploy in some kind of operation. You got to find data that's worth money to sell and and or or like you know wrap a ransomware around it and then okay and now you can start kind of going and doing these things. That's that's a ton of work beyond just finding the vulnerability. In crypto it's insane like you find a vulnerability you make a million bucks like it's uh it's basically that simple. You know what I find just amazing though? Sorry. Uh this there's this weird thing in crypto that that I don't feel like happened as much in web 2 and maybe it does happen a bit more where like a protocol gets hacked in crypto, lose a bunch of money and I feel like a month later they're back at it and it's

fine. Like everybody just there's such a short memory in crypto that like you know oh they fixed their problem let's just give them more money and give them another tr like go ahead take another spin of the wheel. Um that to me is like it's it's like they just don't care about reputation as much as I wish they would. Like I I know web companies that would have just completely died after a major hack, right? Um except for hotels cuz I think every couple months I get a thing saying my private data is gone from what are Marriott or sorry I probably shouldn't say company names. >> Leave that out. Company X or Yeah.

Anyway, sorry I did. Yeah, >> you get free credit monitoring for life. Okay, just don't worry about much free credit monitoring. >> So we're talking about like the financial side of things. you know crypto startups they are typically born as sometimes with like $200 million already locked in. Uh but what are the other specific aspects that makes these problems very very uh special and critical for crypto companies? Um one of the things that comes to my mind is the like whenever it's done whenever transaction is signed and sent into the network it's not rever reversible right so that's one thing what do you guys what else you guys see that's special to crypto

>> I think uh if you compare between web two and web three type of companies in the web two mostly the worst thing that can happen is like you know some PII data getting leaked uh company reputation being affected um Yeah, those type of things, database being leaked with a lot of you know confidential sensitive you know financial data stuff like that it is definitely catastrophic for a company but you know in the end the users are somehow protected you know however in crypto you are losing not only your money your VC's money but you're also losing your users money in most cases no because all these protocols are open to the public anybody can put money into it anybody can put to tokens into it and a

lot of these People obviously do it with very good intent and you obviously have no idea about what what the risk and and guarantees are over here and you're actually you're directly affecting the user and that is the the the part that hurts me the most when uh protocols get hacked and everything else is that you know it's it's it's mom and dad and your grandma and the lady that cleans your house that you know with with because they cannot access a JP Morgan account or they cannot access buying stocks. They do it through crypto because that's the only access they had and you just lost that a thousand bucks a 100 bucks that they saved that whole year. And that's the the you know the unique thing that is also horrible know when there's a hack to to Chris's point. I think the long and the short of it is the only

real difference is the crown jewels change for the organization, right? I think you said this you said this what like it's in web two it's databases it's data like that's mainly it right um obviously the reputational risk of that uh is probably shared across these two things but the the crown jewels are the data and in crypto the crown jewels is money and so like that's ultim so like now not now just like okay what's the difference between having money that can be lost versus having data that can be lost like that those are the real differences but ultimately that's that's the main main change >> I I think though it's it's going to get it's going to get worse as we uh I don't like to say that >> this is not a fun panel.

>> So sorry >> full of happy people, right? >> Um >> so Bitcoin will get even lower. That's what you're saying. >> Well, I I'm saying like uh think about as things like deepen take off, right? As we get more real world assets tied to crypto, that means that the implications of a crypto compromise get more significant, right? Unless there is you know you know secure design thought out in the beginning of an expectation when we get compromised how do we protect these assets but if if you are storing things on chain or have an integration on chain that has a direct correlation with real world physical assets and infrastructure what happens when that

gets compromised and it's on an immutable blockchain right that's a whole different level of implication that we as a community really need to think about and seriously consider. >> Yeah, I mean there's some a bit of happy note because it has been a little bit of a a down note. Um, >> sorry. >> A lot of the the compromise we've seen, uh, I mean, if they just had, so I I don't want to simplify, but in a lot of cases, I look at and like if they just had someone there in security, you know, like it's like it's a lot of really bad mess ups that lead to a lot of lost money, whereas it's it probably could have been avoided almost entirely. Like, I'm not convinced when people come up here and say, "Oh, you can't avoid being hacked. If if you're you're going to get

hacked, assume you're going to get Yeah, we assume we're going to get hacked because it's kind of part of the game. Like, we have to be prepared that we get hacked. But I mean, there's plenty of protocols that never get hacked, right? Like, and maybe it's because they have a great security team. Maybe not. I don't know. In some cases, I know it's because they have a good security team. In other cases, they're just lucky. But, uh, but like like take an example, the Bybit hack. Like, that was avoidable. Come on, guy. Like there were there was things that they could have done to avoid that one on several layers. Like just about every single one. Like bouncer, they could have avoided on several layers. Like you look like in retrospect, it's of course easy for me to say that. But someone with a lot of security expertise

probably would have spotted that stuff before right? >> But but we're also expecting companies to go up against nation states. And that's what we have to keep in mind, right? It is asymmetric. Right. And and and so I I think that we need to push folks to do more, but I don't think we should shame folks for being compromised unless, you know, there's clear missteps that are, you know, they didn't do industry best practices. They, you know, they they they didn't care about XYZ. Like we should push them to do better, but we also need to acknowledge it. It it is a an environment where there's some very strong adversaries.

>> I I I disagree. So I don't think you should shame individuals but I think you should shame companies because while the individual can make a mistake like if you know you're looking for a job it looks like a great interview and you get pawned by North Korea yeah that sucks but there are so many things about that story that could have been like did you have EDR on your machine like did your security guys set you up for failure did he give you training so yeah the individual maybe we don't blame but the ecosystem and the companies they should be held accountable like they should I do believe there should there should be accountability.

>> Yeah. Okay. Thank you. I I'm glad we agree. >> Not against accountability, right? I just one one reason why I say all this is because in web two there's not near as much sharing of compromises as there should be. And part of that is because if someone shares that they were hacked, right? What benefit is there for them? And that's one thing you really have to consider. In web 3, there is an incentive to share that there was a compromise. First off, it's hard to hide it because blockchains are transparent, right? At least for the most part. And so there's some incentive to share it because they they want to protect their reputation. But also, if there's a massive heist where billions of dollars are stolen and that money gets dumped out through OTC vendors near North

Korea, that's going to cause a dip in the market. it and as well as it's going to make people unhappy and it's going to make them feel like they they don't trust the systems and so there's an incentive to share to protect the whole ecosystem and and that's why again I advocate that if if we make security cool right >> it is cool what are you talking about >> and we make it so that you know when people share how they stopped a hack right or they were hacked but here are all the the details the indicators etc then that cause a, you know, a rising tide lifts all ships, right?

>> Raise the floor of security. >> Yeah. So, one thing is like we we kind of like >> I'd love to see more celebrations of the things we prevented rather than the, you know, like the postmortems are great. Um, and the the fusion of funds, all wonderful stuff, but I don't think we celebrate enough the stuff that doesn't go wrong. >> I agree. >> Yeah. here in this talk basically and in the whole day you see all the biggest hacks discussion about how they happen and that's very useful for lessons learned and everything else but I think you're absolutely right we should actually also talk about like how did we prevent this hack uh unfortunately because in the world of automation and now in the world of AI we don't we we may not even know that we prevented a hack we just put some tools over there

we put some strategies on those tools you know we follow our operations our standard operating procedures and stuff like that and potentially we blocked a lot of hacks that we never noticed that we actually blocked. So, >> so there's a lot of technology being built on top of that. Some of the guys are around here probably bitfinding.com. uh they recently a couple of uh week ago maybe they they rescued like uh $1 million from from from the the balancer attack and uh really what they did and I think that's you know I I think what they do is really really cool because they they keep scanning the the monitoring the chain whenever they see you know some contract that's being deployed that they detect that you know the there's some some patterns some heristics there that implies that it's

likely an exploit uh they start fuzzing it and uh they try to call the the the the the smart contract before the attacker does so and that's how they actually took the funds and that's a very different way to do it. But uh speaking about technology and monitoring onchain monitoring to prevent attacks Ido would love to hear from you what's like what's your perspective on that? So, you know, I think it's like an evolv evolving landscape, right? It's um there's always like these new tactics, procedures, right? And so, you have to stay really really up to date on kind of the latest and greatest threats that are happening across the ecosystem. You know, I also think that it's it's um it's incredibly difficult to go in and I

think it's it's it's easier to do this on like one chain, for one ecosystem, for one kind of thing. And it it becomes incredibly hard to go and do this across a lot of different chains, for a lot of different ecosystems, for a lot of different types of companies. Um and uh and I think you know we're we're really lucky to have incredible partners that push us in the right direction, right? So you know we work with some of the largest protocols, we work with some of the largest chains, work with some of the largest you know uh uh wallets and asset managers and you know at the end of the day they go and tell us what to build and and that's what we ultimately end up doing. Um and so and so I think that you know I really like your guys's idea about like you know the the the

panel next year should be you know let's talk about uh the billion dollars that wasn't stolen this year in crypto, right? Um because there there are good teams and there are you know we have great partners that do a lot of work to to ultimately prevent a lot of these different things right um we've seen things like you know after the buy bit hack right we have like a a newer product that basically you know verifies transactions before you sign them across various different MPC wallets or or or or multisigs and and you know we've seen tons and tons of teams adopting these things right um and uh and and you know basically telling us hey we we need this we want this and and then going and using them um as well you know, other kinds of solutions as well. And so I think ultimately like I I agree with you

that that we need to we need to definitely highlight what the industry does well um in order for for that to percolate to other teams that probably do it poorly. >> I just feel like it won't get as many likes on on X. Like >> that's a different problem for a different panel. That's the algorithm. So people talk about open source being, you know, not secure. you know, it's open source, it's out there, an attacker can see it, but at the same time, people can just, you know, auditing. So, there's like this this kind of a cons, you know, contrast between it being more secure or less secure. How do you guys see it? And specific specifically when it comes to crypto projects,

>> I think in the long run, security by obscurity never works. >> Yeah. No, I I agree. I I like the idea that if you build a secure product like most of the cryptography algorithms from years ago were always like open like you could read the entire algorithm you could understand exactly how it works and you still couldn't break the codes right because like like triple dezz like everybody in the cryptography uh kind of area they they understood triple you looked the whole thing couldn't break it with our defi protocols you know the code should be open everybody to read and there should be a lot of eyes on it which is in a lot of cases that that that's what happens Um but then I don't know I guess there is some argument for having closed source

because if there is a vulnerability you wouldn't want to be out there. I don't know if anyone wants to make case for that but I I I I would prefer things being open. >> I think there are areas where that definitely will benefit from being closed sourced or like private. Uh I think you would you I still you know want to have things that being open source and really public. Uh but then make public the inputs make public the outputs. maybe don't make public you know how the inputs you know work into outputs and you know just keep that little you know enclave if you want to call it in some way private uh but there's still if if you know if we start building closed source then we haven't made anything better in the world like we're just going back to web two it you

know it's ultimately like the Apple and Google debate right it's like uh you know Apple is security by obscurity you know Google is like fully open sourced Android right um what's more secure right what's what's the perception of what's more secure as someone who spent time, you know, like six years like researching vulnerabilities for mobile devices, like it's it's freaking hard to find a vulnerability in in in in like fully patched Android. Um, it's also hard to find in iOS for what it's worth, but you know, nothing's really closed source. Like if you have the binary, like you you you can, you know, you can you can do a lot. Um, and so, and so I think like even on chain, right, like if people start deploying closed source contracts or stuff like that, it's not really closed source like you you just like have a harder time reading the

source. >> Yeah. Yeah. Good point, >> guys. But let's face it, incidents can happen, right? So, Joe, what what's been your experience in like responding to an incident specifically in the realm of crypto? Like what what you see that it's different when responding to an incident in crypto? things happen extremely fast at you know at oftent times we don't have enough information what's different and how do you guys have approached it >> I I think one of the biggest points is that speed is much more important in crypto it's still important in a web two compromise but in in web 3 speed is so much more important because of that immutability of funds of of transactions on chain right and so there has to be

awareness there has to be monitoring And folks need, you know, instant response plans, right? So many organizations don't have them. They think that they can just call up someone on, you know, instant happens. They email someone, they call up someone, say, "Hey, I need, you know, someone to come do instant response." And what if there's not availability? And that happens, right? If there's no SLA, no ser service level agreement, there's no guarantee that someone is going to be there to answer the phone when you need help. I would say that's one of the biggest differences is time matters much more.

>> That that is one thing I I encourage protocols to have is to have some sort of retainer with an organization to help you with instant response because exactly to to Joe's point if you like were to message Mandant and like send it to an emergency say, hey, you know, we need you now. And they're like like yeah, we're backed up like we'll we'll call you in a week and we'll send over the SLAs's to sign and we'll and then it's like well that's way too late. Um it's a hard hard to justify like when I go to like my CTO and say, "Hey, I need to spend this money on a just in case we get hacked." Um because he's like, "Well, we're not going to get hacked, right?" I'm like, "Well, I don't think so." But, you know, if we do, we want to

be able to call someone super fast and have them tracing funds and have them respond. And there are some good companies out there that do that. Um you could DM either of us and we could like put you in touch with companies that are like there to help that sort of thing. I would I would say they're not that different to be honest. Web two versus web three in incident response. And the problem is that we think that we need to execute incident response once the smart contract is hacked or you know or manipulated or something like that. But in the end having a security team having somebody that thinks like a security guy you know pessimistic and so on is going to help you because there are always indicators of compromise. always somebody is starting you know we we see it in the polygon blockchain for example

we see po people deploying you know contracts and hm they they've been uh you know uh funded by tornado cache and then that's starting to be an indicator of compromise you start seeing people that are sending you messages asking you you know hey why does this function behave this way why does this function behave the other way there's always you know and that's what security teams do you know they're monitoring the things and they're actually the ones that can tell you like actually this guy asking in this question may be malintentioned. You know, he may not be asking it because he's integrating. He's actually asking it because something like that.

And you see that across a lot of the hacks. You end up when you start looking at the breadcrumbs of a hack, you start seeing, oh, this guy actually went to the forum and he started asking about this like a month ago and then you see that this same address was actually deploying contracts on a test net, you know, and obviously you cannot see, you know, what the smart contract was doing, but you can decompile the bite code and stuff like that. So there's always little breadcrumbs like, you know, nobody's perfect and in the end this is all done by humans so far, uh, all the hacks. So, you know, you are always going to be able to start initiating your incident response process hopefully before the hack is is happening or at least keep that in mind. So, when the hack happens, you already know like,

yeah, I I I I saw this coming. And yeah, >> there's something they do in in web 2 security that we did a long time ago that is I don't think it's totally made it into web 3 yet, which is the hunting aspect. So when you have a dedicated security team, when they have nothing else to do because well, first of all, they're almost always busy. But uh when there is free time, you can start hunting for activity. So you're not waiting for alerts to come in. You're actually making hypothesis like, you know, maybe contracts funded by tornado cache are more likely to be malicious. So let's go and find all this stuff, right? Let's go and look for all those emails, all those fishing emails that my employees are reporting. Let's actually go through a bunch of them and see like how many of them are likely North

Korean, how much are likely e- crime, how much are likely, you know, something else and who clicked on like if you don't have someone dedicated to security. That's just not going to happen. Like no one is there to look at that stuff and you can hire for that too. >> I was going to say to build off what both of you are saying, everyone is aware of, you know, the defender's dilemma, right? You have to protect everything. If the attacker finds one thing, then it's it's all over. Well, there's also the attacker's dilemma. And this is what a lot of folks don't think about. If the attacker sets off one alarm and there's someone watching, then the gig is up, right? But there has to be someone monitoring and watching in order to see that alarm go off >> and put in the traps, put in the alarms,

like you know, web two, we do a lot of these things, honeypotss and and those type of things. So you a lot of hacks can be preventable. You can actually get indicators. I was going to say talking about the threat hunting or you know red teaming and things like that. You don't even need a security team for that. No, you can ask your own auditing company. Normally, I I think that most of you, if you ever hired an auditing company, and I see a lot of auditing companies over here, you probably get like, hey, here's a bunch of contracts. Uh, do your work. I don't know what it is, just do it, you know. But in the end, you can actually tell them like, please focus on these areas. No, maybe not for the first audit, but the second, the third, the fourth. You're actually going to tell

them like I actually want you to focus on these functions because these are the ones that are most this is the critical path and this is what I want to cover. And then the third audit you're going to go and like I actually I want you to start through this with these type of assumptions. No, think this way. Please plan you know your thread models in these areas and that's going to help you build a much better you know you know thread landscape as well as you know plans if some of these things happen. >> Right. So, what is your last message and uh probably the most important message that you'd like to leave to the founders out there?

So, mine's really easy. If you do not have a security person and you take care of other people's money, go hire a security person. Like, you are holding on to other people's funds. You should just go out there. There's tons. And if if anybody tries to say it's hard to hire security people, I'm in like this web 3 chat and several of them full of security people looking for jobs, right? I don't know where the disconnect is, but there are a lot of people out there in the security, especially in web 3, who would love to be offered a job. They just don't know who to talk to or how to apply or I don't know what the disconnect is. Anyways, go ahead, Joe.

>> Uh the thing that I hope folks take away is awareness and education. I think that we need a lot more awareness and education around security for startups for founders and that will lead to a much safer ecosystem. >> Uh I think I'll say uh security is not difficult nor expensive and I think that's a misconception. Uh you know with that security is nor security in web 3 is not different from security in web 2 like please go and ask. I think people are just afraid of asking ask for help like you can even get it for free. You can get audits for free. You can get a security review of like your website for free. There's a lot of people that are really willing to help. And at least,

you know, in this panel, I think nobody here would say like, "No, I'm not going to help you." I'm sure I can find somebody that's going to help you with your problem in the budget that you have and in the time that you need it. So, don't be afraid of asking. Um, yeah. >> Yeah. Maybe, um, I agree with everything you guys said. You guys, uh, I think super super super insightful. maybe that um security I think in this industry is not a cost center. It it can be a differentiator and when you know leadership looks at kind of security practitioners like to bring me on and doing these things they should probably think about okay great maybe if I have a head of security I'll get more assets deployed to my protocol maybe if I leverage you know this kind of solution

or that kind of solution to go and kind of bolster security I will actually be safer and I will actually increase TVL or I will actually kind of you know generate more more revenue. Um I think it's especially true for financial infrastructure and especially true for for for the infrastructure that's being built across the industry. >> The real cost center is getting compromised. >> The real that I mean that's company ending. >> All right. Thanks everybody. >> Thank you. Breathing tonight.