What Is Wrong with Web3 Security and How to Fix It?

Transcript

all right thank you so much for staying here uh lunch is right on the way after dimma here is going to present to you all things cyber security so dimma please take it away let's give dimma a round of applause thank you so much thank you hello guys so yeah like it's it's going to be short uh I want to share like about some insights about web Tre cyber security business because maybe you think it's big and important but like in fact we have very big challenges that we need to overcome so my personal experience I started as the uh deid guy like spent there eight years and now I'm trying to build crypto deid called

haaken uh also I'm co-chairman of ethereum Enterprise Alliance uh which unites like most of the companies and we are building the standards and also VP of blockchain Association of Ukraine um hen worked with almost all the brands in the industry from 2017 it's easy to say with who we don't work and yeah like we we have Services products and a lot of different stuff so yeah everybody heard that uh we have a lot of crypto hacks scams uh the number is quite big um do you so you see it's like billions do you what is your guess how big is the market size of web free security like any guess

tell the number like how much companies are spending in total per year for web three security any guess no no it's just 300 million markets so we are hacked every year for 4 billion and the companies are spending just 300 million so most of the companies they are started to think about Security in three cases so the first case is when they get hacked obviously to late when they lose Revenue when they are starting to be non competitive and when the regulations are pushing them so comparing to web 2 and web 3 security you know like in web 2 security if you got hacked you get a

fine um user data may be leaked not a big deal to be honest and in any case the insurance companies will probably cover your losses from the F but in web three security is the things are way worse because if if you got hacked probably all your funds got lost you your reputation is ruined and and um probably you will have to shut down the whole thing and go away from our beloved industry yeah and um unfortunately you know like right now audits um are being done usually by companies just for marketing purposes so when the coin coin market cap introduced like the pages

like it's um you know like audited project not audited project it gave a boosto industry but in fact the company companies are coming to us like a lot of companies just for small scope so they have huge D5 protocol but they asking us to audit the just the erc20 contract and that's that's uh according to our analysis in q1 like only 1% of the hug projects in this period of time were uh did have a relevant audit and the next slide is the table like the Bible of web free security guys is direct. news uh if you don't know this website I really recommend to visit it because it has it's written in sarcastic Manner and

it's it's fun to read about the hex and um you as you can see uh most of the projects they are either un audited or like the audit is not relevant so the fact two that I was saying is that when the projects are starting to lose revenue and this um this how we like basically build our brand so we um created the website when we started to put all together information about cryptocurrency exchanges uh security so we have analyzed all the public data and made the like basically the pent test on our own for exchanges and we created a ranking and that

ranking um was integrated to co geka trust score so basically right now the trust score of coin geka have 20% of our data and overnight suddenly most of the exchanges ranking has dropped and they started to like oh no I want to be top 10 top 20 cryptocurrency Exchange in the world uh what I need to do and then they started to do the pentest and bu bouncing and yeah so that was a success case and uh the result the result is that right now um most of the exchanges are doing regular uh pest bug b County and we see way less uh exchange hugs comparing to 2019 18

2020 um yeah so the fact three is uh projects invest when The Regulators are asking them so right now we don't have this at all and one of the reason you know like when you read the ma m is saying like you have to do all your best to make the uh your project secure you have to protect user funds and you uh have to make disclosures and that's it this is how Mika saying about security right now and the reason why because they just really doesn't know what what's what's uh uh how to advise projects like what they need to do they they just do doesn't know they don't have uh people skilled people they don't

have tools like there is no tools how to monitor the project security and the regulator also um yeah uh that's it so security budgets across the uh another another very important fact so the web 2 um budgets for software companies they usually spent around 15 to 20% of their um uh like development to to uh to Security in our industry as I say this only 300 million industry is around 3 to 5% and again uh why the we have such a big number in web to security is because SEC at some point

they decided we want to have cyber security unicorns in Silicon Valley and they started to create a legislation when they put a big big pressure on all the software companies to install crowd strike poo Alto software to be compliant so yeah in our industry we still have a lot of um lot of Bad actors a lot of exploits a lot of hacks and still security is not priority um and um still no accountability for the projects like um they nobody will sell uh you're a good project I will invest in you because you made so many things in

security to know people are driven by foro and by stupid stuff so what to do what to do so if you're are b2c um yeah learn risks educate about risk um if Enterprise Alliance um like my drama group that that I could share we created a very big um metrix uh that's explain every risk um ask questions to the project you want to invest this is a crucial so you have to ask uh not only like who is your Auditor show me audit report but to push them to disclose you like the coverage of the audit like there is so many cases when people are not like it's okay like you know to to make an audit for

um but most of the projects right now they they they can add new new code and the audit is becoming Irrelevant for example erer protocol who heard about it 200 million hack so what happens they just uh they had the uh they spent quite a lot of money on auditing they um had audit pant uh Crow uh crowdsource uh uh contests uh and at some point of time one genius decided to add some one small donation function that's uh was just like I don't know like 30 lines of code which basically created a vulnerability and the whole protocol was exploited for 200

million uh so yeah and check s. life why not uh we are trying like it's our proon project this is how we try to build the industry we are trying to collect the public data so that you can verify your project security and if you're B2B yeah yeah um the best you can do is collaborate with was Regulators so basically come to them and speak with them what reports and disclosures we need to do in order to be compliant as I'm saying Regulators doesn't know but only like step by step only through experience you can um you can um basically Define what will be the future reporting disclosure for cyber security engage long term with security companies

like not just um when when uh the TG is uh is next week and you need an audit now uh engage from the day Zero because they can consult to you consult you how to make the audit cheaper and more efficient and faster and um yeah plan that in future you will have to pay way more on cyber security it's in aaable so plan the budgets like at least three times more hacking um our strategy is hacking is um is to work with Regulators as well so uh we uh we're working with European Union sandbox but our biggest bet is on Abu Dhabi uh adjm is uh the regulator of

mina let's say the main regulator of mina region and they are Risk Takers so with them we are collaborating in order to provide them technical due diligence service basically Outsource we're building tools for the projects that are licensed by them to Monitor and all the security activity and and um of course um uh to create some new important standards so for examp so one of my dreams is um to and my goals let's say like this is to put a very um strong um push on all the tokens that's are listed on centralized exchange and uh in in the

way that's uh exchange is responsible for tokens that are listed there so they have to demand not just like a small audits but they have to demand like the full scope uh regular uh security assessments for every token that they uh that they have and if they don't then they are at risk to lose the license so this is our bet how we want to create this Market how we want to make our crypto Industries safer place so that's it short presentation and if you have questions I will be very happy to answer thank

you if not that's fine I'll be around and hope to chat with you later have a good lunch