Security Frameworks by SEAL by matta - the red guild | Devcon SEA

[Music] a little while ago I'm sorry Sam who Sam Sam C son you know the guy who saved ethereum's ass like oh I think I know that guy the guy with the Anime Avatar and a sword and I think I remember that post but no clue where to find it yeah I'm just keeping Sho it's a pain let me let me see if I can dig it up for you um H yeah I don't know it's like all these telegram group chats trying to find information it's just so hard these days um you know what now that you mentioned telegram I think someone sent it to me but I have to really it's going to be really hard to find it there yeah wait what did you need the D here uh yeah I didn't realize you um you remember that upset guide that you mentioned yesterday did the one with all these um Sim protections and seam swapping protections and fishing prevention techniques does that ring a bell I think you you're not mentioning the officer Si's recollection of and post and you're not not talking about the insights from the book How to Disappear no no that's something super detailed like a stepbystep guide giving you detailed instructions on how to I was one of us um I was one of us a little while ago wait I wrote something that's on our our internal notion which is like a transcription from something I did with in AI wait was it one or many guides because awesome privacy has like a ton I think it was one actual guide wait Pascal Pascal shared one on Twitter one that's the one thank you thank you thank you let me go back to his Twitter page I'm going to have to scroll over hundreds of tweets to find it but we'll get there thank than you thank I would have fun it without you do you have a minute now that you're here would you be so kind to share me some best practices for developers oh dude there's like there's dozens if not hundreds of resources these days on that topic oh yeah so much I think we put together a Google doc listing all of them let let me see if I can find that [ __ ] didn't realize there were so many yeah so tons these days man it's pretty crazy yeah I can see wow I was thinking I can't find it now no no worries but if only there was a more organized structural place where we can all go and and see all this stuff you know and you know what people say people say that the security issues are not because of lack of information but rather because of ignorance that makes sense that makes complete sense you mean something like maybe a community owned Wiki of s so we can all contribute and point our um lovely users towards yeah man I mean I'm tired of scraping the entire internet looking through my bookmarks and when I'm thinking about this centralized thinging I'm not thinking about notion or Kota or TR so please not I'm thinking of something else yeah man that makes sense um yeah it it it's crazy I spent so much time all the every day trying to dig up you what I was also thinking that even if the information is out there but it lacks Readiness it's outdated and you have to look for it everywhere it's I mean what you going to do right yeah well maybe we can help maybe we can build that Central repository single source of Truth when it comes to security best practices you mean like a generic best practices thingy yeah like security guidelines or security security Frameworks yeah man I love I'll leave you to it thank you God speed oh didn't realize we were here how are you so today I'm going to be talking about the security Frameworks which are high level best practices and say in we three so I'm not going to be speak much Amar Amar oh [ __ ] I'm not going to speak more about seal since it has already been presented uh but the only thing I'm going to say is that we are working with a lot of respectful people from the entire ecosystem and we try to do good so the other thing that I'm going to say is not to confuse us with this security Alliance because I don't know why they are on a triangle formation that's some Illuminati [ __ ] right there it suits them apparently pun intended and also with the seal Alliance which is an organization that tries to save endangered species of Penny Peds and seals I wonder if we fit into that someone has to protect us too right so back to the presentation we do many things but it's outside of the scope of the presentation and Frameworks is yet another one initiative a pretty recent one so my name is MAA I work at the red Gill I am one of the founders the other founder is there tincho and I'm also leading the security works at se and the red Guild we work as a nonprofit organization doing public goods for the benefit and we're very much aligned with SE that's where we're working together so this is going to be like really really really quick FAS because I don't want to bore you and I just like talking more than it's necessary so like the book John Dies at the End instead of pitching something and leaving the product to the end I'm just showing it straight at the beginning so if you go there to the QR code it will safely take you to my latest malware just kidding it will it will take you to one of those links I forgot which one I think it's the the main one so as you can see here on the links both are synced and are deployments of those two branches so the main branch is at.org and the develop branch is at Dev and I'm going to show you some screenshot so you don't stare at the phone and look at me or look at the presentation so here as you can see it's very basic the current state is like a Wiki if you use gitbook is something really similar to it and on the left you have the outline you have like a brief introduction how to how to navigate it all the Frameworks there of course and on the right the content and also there's a disclaimer that reads this is a work in progress not a release not a release this is very important we are looking for volunteers see issues to know how to collaborate you're going to hear me a lot about asking for collaboration and kind of desperate just kidding so if you go there and you click on the on the on that icon it will take you directly directly to edit on GitHub and if you are on the doev domain and you log in with Vel you will be able to select any part of the content and leave comments that I can read later and if you are like really interested in some of the Frameworks or the pages that you have found you can book them bookmark them so what we did in in on top of this is we implemented a way to navigate it depending on your role on your background on your profile so we have TXS now the TXS have been implemented by Ani so it's kind of generic and there's room for improvement but as you can see here right next to the magnifying glass you you see a tag and you can search there and in this case I'm showing Community marketing and of course some of the Community Management platforms that that role may use and of course also something related to awareness so filtering by tax the tax that are outside the screenshots the bullets are the rest of the TX that have been implemented recently and on the left I have another example if you see it reads security places and procedures governance risk management compliance with regulatory requirements metric KP kpi so it's basically Leal and compliance on the on the right side you have HR and if you pay attention to that it's mainly related to onboarding and off offboarding of employees and and members of an organization so if you want to look your bookmarks you just click on bookmark and and that's it and now I'm going to show you a a few classic examples of in this case the category operational security you may be tired of here and I say hey don't use msf SMS TOA but here it is again an entire category for you to read at your home with your family sharing a nice meal and also here this is one of my favorites it's one of the outputs of one of the other initiatives SE 911 so let's say an incident happened and you don't know how to organize your information well here you can use this template to assess and act as fast as you can and another simple one which is more Bas to an implementation of a platform which is Discord and it explains basically how to harden a Discord server so technical details this is as you can see this is really simple we have a an open repository there it we we are using a set of kbook MD book and it Auto deploys with verel you commit and you see the preview of the deployment and right now only the dot Dev is accepting comments so so it's basically markdown files and pure docks I had to admit it but my mother was right I did end up studying 15 years just to write [ __ ] documents but whatever what you're going to do so on General details uh we have a currently Community cor team I'm really fortunate to be working with Freddy and medy I have them by my side and we try to put minimum contents on every page so you don't see some of the Frameworks and empty and so and you can jump there and criticize what we have wrad but a lot of work is really needed for the first release so this is why I put the disclaimer this is not relas and the next phase is currently right now moving everything to public so we are seeking Community collaboration and we hope that making everything public will inight for the collaboration so what's the problem that we want to tackle you've seen that security threats don't diminish by the year uh as a was saying if you paid attention to H talk and something that's happening is that most recks let's say are not only aimed at decentralized infrastructure so and and even they are getting better so related to the information if you remember the sketch it's like really difficult to keep track of all this stuff it even happens to us at the at the guild WE Post articles and I don't go back to update them I I have a lot of repositories in GitHub where I put notes and you know how it is it's like really difficult to keep track and it happens they get updated so we propose this solution so what can we do to to solve this we can transform it to a way where you can access it and understand it independently of your role in an organization so which is our aim our aim is to create best practices make them comprehensive help organization to secure different aspects of their projects and if we can do that regardless of the specific technology the better but this doesn't come without challenges so what might difficult process I mean if you come to DSS or this track you know that the knowledge is out there you possibly all have something in your head that I don't know and the other way around so I just need to understand how to get to each one of you even proof reading is something that helps and that's why I'm insisting on that we need collaboration this is something that we all try to have to do to her so then let's say that we created something and it's useful we need to convince people that they should follow these practices so seeking adoption is something really important and to do that we have to make make it at least usable or easy to navigate otherwise it would be like a painful experience so of course of course of course now that we created everything like that and it's public then we can keep it updated and another stuff that happening is if you saw we have more generic approaches but then you sell something like Google s Discord Telegram and you are going to say hey but that's like really close to an implementation yeah so the thing is that we don't want to go too abstract in order not to get to uh and and how to draw an draw an old situation so the idea is that we have to understand better how to see where it is needed to go further deep on the impation versus on High level practices back again to how collab at how to collaborate number I'm going to drive you crazy about this so you can go there log in with um with your veral account and leave comments annotation whatever and of course since it's on a public kab you can create a PR you can create an issue you can create a discussion hop on on the previously created ones here I am showing you just a few where currently there are 25 more than 25 so if you don't know where to start there is even the label good first collab and there are 15 of them right now and I will start creating more after Devon so why should you collaborate I think that we need to shift our perspectives stop negating the human nature and like we're going to make mistakes so if we use mechanisms of of control trying to avoid people committing mistakes is negating the human nature right so what we we should do is just accept that we are going to make mistakes as I said and build more mechanisms of resilience to be able to recover which is more important and of course we can do this alone so since we can do this alone I am also going to show you this recent initiative that we're participating along with secum and theum Foundation from the red Guild I'm not going to say much because you can find anything everything there on E Rangers but if you have participated in public goods working in security for the past year or past month then you may be eligible for 25k in two trenches and even if you participated in the past and you're eligible and don't know what the [ __ ] you should do we are going to give you different initiatives where you can support continuing your work which because is like is really valuable and of course security Frameworks fits into one of the initiatives that you can continue supporting so that's it I thank you very much all for your time and I hope you contribute to the security Frameworks awesome let's give Mata a big round of applause can I just say I love his outfit as well so colorful and I like the fact that he took out his shoes that's why he calls himself a techno hippie yeah one one with the stage one with the environment and one with the security now we haven't got any questions yet maybe because I forgot to remind everyone to please send in the questions I know you're really interested by his presentation of the Frameworks so let's give everybody just maybe one or two minutes quickly send in some questions you can scan the QR code submit some questions if you want to ask about the seal Alliance about the security Frameworks that you briefly mentioned in fact I was just looking at the security framework let me open it so you can actually get the um QR code that he got on screen I scanned it and I got it um if you miss the QR code it's uh frameworks. security alliance. deev very very interesting it's a resource a collection of best practices written in abstract or general fashion to be applicable regardless of the specific technology right so it doesn't matter whether they web through whether you're web 3 everybody can read it is that right M absolutely everybody can access completely free online I love the fact that this is the kind of things that we collaborate and we build together speaking of building together I see you guys building the questions on the screen so let me look at some of the questions and let's go right to the top oh do vote for your question so we can Target the most popular ones first one on the top Mata why create oh excuse me it moved okay they voted for this one what's the highest impact action a web three user can take to improve their security or it moved away but we'll go to that one highest impact that you can take to improve your security what would you say they are all good questions really hard to to to reply to them so I'm I'm going to try to to be brief sure I think this answer has to be more it's more related to the relationship everybody has beat war3 or two to the Technologies I feel like we're using a lot of technology and we don't understand it it happens like on even on household items you have a router you have a portable computer that which is capable of doing a lot of stuff and people don't know like for example on the iPhone you have a lockdown mode which protects you for a lot of stuff you can even disable I don't know a lot of stuff that may pose you to other threats so I'd say that getting awareness and understanding the technologies that you use it's a more important stuff because I've seen people say no you should use this extension when you interact with protocols or you should use this snap but those things can be tricked and have been tricked in the past and if you only R to that kind of Technologies to protect you what happens when they don't are you going to get wrecked so I'd say understanding the technologies that you use and the risk that they pose it's the most important stuff excellent very good understanding the Technologies we use right we use it every day but we don't always take time to understand it now three votes at the top why create a new framework instead of adding to existing ones from the web to companies I like to see those I like to see those and what happens at least to the ones that I known I don't know if you ever try to look information in the Internet and try to contact a company to do a collaboration most of the things that I have seen from organizations are like really jealous of on like other stuff and they mostly do it like a marketing stunt I'm not saying it's not valuable so working on with with organizations that did this as as as um yeah as a stun is like really hard and for example if I want to collaborate or others want to collaborate it's like really difficult so we we thought of doing something that everybody could participate and it's free I mean it's on the security Alliance but it could be elsewhere you can even Fork it and start doing a new one if you think that our our ways suck so this is an approach I'm not saying it's the best one this is an approach we have more ideas to improve the the interface that will come later this this year so we wanted to be more to give the the community more control over this stuff that is really important to us I completely agree it's not always companies that are willing to share companies usually protect their stuff they don't want you to know their security practices because otherwise you might then take advantage right so but this is collaborative what seal is doing is to collaborate with everyone to build a document together the okay four votes at the top Mata do share any memorable incidents if you don't mind what can you share something that happened that you want to maybe share a story um I'm going to share like a personal experience which made me get interested in security like totally off topic because I mean we can talk about like dpk or some other stuff if you wanted I know who wrote this if you wanted something more like that we can talk we can discuss it out stage but I started in security doing let me go back I started playing online games like in 2000 there was a very popular Argentinian game called called arum online arum online arum online yeah it was the me the the first mm op orpg orpg there so I met a friend there a female okay nice nice and then we started exchanging messages MH and back that the day we used messenger for 4.0 wow yeah and old yeah we were chatting and and she she told me hey you can see this emoticons not emojis let me send you this pack so I accepted the pack and then my compa dicks was started the tray was started open and closing and she said thanks you thank you for your IP I was like what the [ __ ] so I got locked off and all my contacts were erased and I lost contact with bunch of friends online I was like I feel like violated my you got hacked from MSN Messenger yeah from an emoticon pack yeah wow 24 years ago so that's when my evil Arc started wow I'm on my good one right now now that is you can see I'm working for two nonprofits I'm not good I'm not bad I'm not bad thank you slip of the tongue there wow that I've never heard of anyone getting hacked on MSN of all things but um thank you for sharing the story I I I mean that was really memorable uh we got a we got a few more minutes so let's uh let's uh see the question at the top two simple things to enhance SEC security the most so you mentioned awareness and I think maybe if you want to add one more thing that you think would be a practical something practical that everybody in the room can do well I can tell you what I do uh for example I have a Linux machine I have full dis encryption and I also sometimes paint with nail polish the the the the screws you paint the screws with nail polish uh yeah in case I I get an ail made attack you know what ail made attack is no it's when you leave your room on your your computer on your room and you leave and someone enters and hijacks into the room and then unscrews your computer and puts a VOR in it so if you oh I see you have to yeah this this is like really Paran so you paint it so that you'll know if someone has taken out the screws wow but if you have full disc encryption it's like it's okay yeah I mean it it depends what's your thread model if you're like a very high profile Target okay you may be doomed but that is quite extreme what I do what I do is for example uh I use a firewall firewall uh in my case I use open snitch but on Mac you can use little snitch or Lulu I prefer Lulu better and I have a virtual machine and inside the virtual machine I run containers and every project that I try to run even the ones that we have created I run each one of them inside a container because the container even runs the extensions inside the container but as we showed on yesterday's Workshop M there are even misconfigurations that can leave you vulnerable yeah unprotected so yeah but I think what you pointed out is important as well not everyone has to do all of these things right it's about your Threat Level if you're dealing with things which are dangerous then of course you have to implement I don't think I'm going to paint the screws on my my MacBook at home but um but I mean those are very interesting uh tips I've not heard that one before so that's and and for example here uh I got this tip from Greg yeah hi Greg the um we are using a giet giet was it g g IET router it's the it's called a VAR it's really small yeah so what we do is we take it for example to this conferences it comes with a VPN inside y so we create a local network and we connect all our devices there even if you're on a plane and you are only allowed one device it also works like that yeah like this so isolating yourself I'd say correct creating your own private yeah private Network okay very cool thank you for sharing those are some very interesting security practices we got time for one or two more questions uh where can we follow your work so where can they follow you if they want to follow your work uh since we work at two organizations mainly our organization I mean our organization is the red Guild you can go to the red guild.

red Guild okay yeah we have created for Devon especially a CF on our platform which is called Direct direct games okay direct games okay there we have theable defi which was originally created by tcho MH and also the CTF which is based on real case scenarios that made organizations Get Wrecked so you have to play the role of an adversan and then you have to help for example the theum foundation to retrieve some credential that vital has pushed and deleted on a file on on a repository and then we have the fishing Dojo fishing do yeah I don't know if you ever went to those corpo fishing awareness trainings I have I have yeah they suck yeah yeah they put you like a video and then they they ask multiple choice question they'll send me some emails and if I click on it then I go for the training cuz I failed the fishing test yeah this is this is I I'm really proud proud that we came up with this y so fishing. direct games.com there you have for example it starts with an interface of an email and you have to understand if you to see some someone or something fishy right and and then it changes sceneries like you sign in a transaction you're watching ether scan trying to see if you get spoofed but it's all fake even the wallet you don't have to leave the the entire platform it has been thought that way so it's safe to play and and have fun and then yeah we have I think like monthly updates okay kind of like that and un seal I I'd say join our community we have a Discord where it's public there's not much activity right now but may if you come we can start talking there and share everything we have been up to perfect you finished right on the time is up 00 let's give Mata a big round of applause thank you very much all the way from the seal Alliance ladies and gentlemen