Status is a decentralized organization that works on creating decentralized products for the Ethereum ecosystem. This combination introduces a drastically new paradigm for what “security” is. Instead of the traditional methodology of focusing on centralized, localized, highly-control networks and devices, we minimize such a thing and whatever infrastructure does exist lives in the cloud.
What does this mean?
In much the same way we’ve decentralized the organization and applications, we’ve done the same for security.
It means the vast majority of the attack surface is you, the people that contribute. Furthermore, the controls and information a security specialist has in terms of making decisions and monitoring how things are run is constrained.
It also means education takes a forward step in importance across the organization, and personal responsibility of quality security practices become paramount. It is up the people to understand potential threats, take preventative measures, and report any issues they come across to the security team to protect the organization as a whole.
Security Week Proposal
With all of the above in light, it seems a great idea to have a week of education and personal checklists that help an individual audit their personal practices and get on track, broken up into multiple sections that focus on certain things (structure also up for discussion). Something like the following:
Some time in advance (1-2 weeks??)
purchase/upgrade personal necessary hardware (on company’s dime).
Configure/set-up said hardware for personal procedures week.
Personal Security Week
days 1-2:
establish channels of communication and ground rules for what they’re used for
initiate personal procedures checklist (focused on personal property and asset management)
days 3-4:
continue personal procedures checklist (focused on company based interaction)
days 5-7:
initiate company-wide checklist
come together on company-wide practices
start regular interval security education series
Thoughts
Please discuss how this sounds and what we should add/remove. I’m hoping that this can be a collaborative effort across the company, and upon a successful finish, we can publish about this experience: what we learned, how we’re moving forward, and how other companies that structure themselves similarly can do the same to move the entire community forward w.r.t. security (both traditional and decentralized).
This occurred through a weak password of one of our admins, which was brute forced, and gained access to. The attacker then deleted the WP entirely.
It only takes one person with a weak credential to take the entire thing down, so I’d like to belabor the point that everyone should attempt to rise the tide of the entire organization.
If we are going to have this week after Prague, we should probably ensure people can order things next week. And possibly distribute things like Yubikeys and HW wallets to people in Prague.
On that note - any recommendations for a simple and solid No-Wifi Printer?
I’d shoot for a bit further after Prague, maybe two weeks after. I do agree on using Prague as the distribution place. We should make that yubikey/hardware wallet order then. It might be too late to get that many this soon.
As for printers, this is a simple quality one that I have personal attestations that it lasts for multiple years: amazon link
That doesn’t come with a cable, and not sure where to get it overseas for various people.
There’s a store in Prague that mentioned they have a limited number of: Yubikey 5 NFC, Yubikey 4 and YubiKey 4 Nano. Which device would we be looking for specifically? I don’t think we’ll be able to get one for everyone in the amount of time we have left as the stock levels are not high, but if they have a few of them I could try buying some (and maybe give priority to those living in areas where these are harder to come by?)
I’m trying to get things set up to get everyone necessary hardware, and move forward slowly with things that don’t require them (social media, personal hardware audit, etc).
I’m thinking as it is difficult to coordinate things across the company, moving slowly (1 concept a week) would allow everyone to complete things on their own schedules.
We’re also working with MyCrypto for an “security advent calendar” of sorts for next month, which will roll in some of our guides (that I and a few others are making).
I was also pushed back a bit due to company re-org, and travel due to a death in the family.