Top 3 Security Risks of Blockchain-based Digital Assets & Tips to Prevent Them

Blockchain is a technology that allows safe and transparent management of data, such as transaction history, without any intermediate administration via a decentralized data storage system. One of the main features of the technology is security. Since all users participate in storing, managing, and distributing data, attacks such as data forgery can fundamentally be prevented. 

However, there were several hacking incidents recently that were related to blockchain-based digital assets – but they were not caused by loopholes in the technology itself but mainly because of the security risks caused during the process of storing and trading these assets. In other words, to prevent this from happening, a security strategy must be adopted before any transaction occurs. In this blog, we will find out more about the security risks and tips to prevent them. 

 

Types of Security Risks

1. Site Forgery and Phishing

This is a type of attack that occurs most commonly in the existing IT environment. Hackers create a website that is almost identical to well-known exchange websites and encourages users to enter credentials and then extort the users’ digital assets. The damage can be much bigger if an employee of the exchange were to be a part of this process unknowingly. In particular, as interest in blockchain and digital assets is increasing across the world, such phishing attacks are expected to occur more frequently. 

 

2. Watering Hole Attack

The watering hole attack is a method used to inject malicious code through a zero-day attack into a website that’s only accessible to a specific person in order to establish a foothold for the attack. It uses a network that is damaged by malicious code to access a system to carry out various attacks. Hackers could eventually infiltrate the internal systems of the exchange on pages where only the employees might have access.

 

3. Insider Threats 

The zero-trust strategy is drawing more and more attention as it’s one of the basic strategies to implement. Employees can manage access rights and realize a zero-trust environment through different security solutions. It applies the same to any other digital asset management company or exchange. As a matter of fact, around 9 million dollars was outflowed at a large digital asset exchange company by an insider back in 2019 because an exchange company did not meet basic requirements for robust security.

 

Digital Asset Security Strategies to Implement 

All the incidents that occur regarding digital asset extortion have one common feature; that it all looks quite similar to incidents that occur in the existing IT environment. After all, hackers that target digital assets are not exactly targeting the loopholes of blockchain technology, but security vulnerabilities. Therefore, it makes things easier for companies to implement security strategies once they have implemented similar security measures for their IT environments, just like they would to protect their data and information. 

 

1) Web Application Firewall (WAF) 

Many digital asset exchanges have deployed web firewalls for safer asset storage and trading environments. It is the most effective method to detect and block malicious web traffic and prevent different types of cyberattacks that may occur on the web, such as DDoS attacks. 

In the past, even when digital asset exchange hacking incidents occurred, many exchanges got to realize that their web environment did not have enough web security measures implemented, such as web firewalls or SSL secure servers. In particular, as regulations on digital assets and exchanges have recently been strengthened, the need for web firewalls on exchange websites is expected to increase. 

Penta Security’s web application firewall WAPPLES has been the No.1 WAF in the APAC market for 13 consecutive years. It not only responds to web threats but also plays a role as an integrated solution in various fields, such as preventing information leakage, unauthorized access, and web forgery. In addition, it is equipped with an intelligent detection engine that detects new attacks with a low false-positive rate. 

 

2) Multi-Factor Authentication (MFA)

By deploying an MFA, companies can block common attacks such as credential stuffing where the account credentials breached in advance from other servers are randomly used to breach into a system. If an exchange supports MFA, hackers would have to disable the authentication option which inevitably lowers the possibility of a successful attack. In addition, if the company uses various factors such as biometric authentication or OTP, it can increase the level of security dramatically. 

Penta Security’s authentication solution iSIGN+ provides a secure authentication solution both in IT and IoT environments. In particular, since it complies with major regulations, it can be deployed to services such as a blockchain-based digital asset management environment to establish a safer environment for users. Moreover, iSIGN+ provides certification services that comply with the FIDO UAF and U2F standard protocols. 

 

3) Digital Wallet

Making use of digital assets means that you basically own a digital key. In other words, to protect your assets, you must protect the key first. The key gives you access right to your digital assets and they must be stored in a safe environment. In particular, since exchanges store and transact large amounts of assets, it is necessary to build an infrastructure that enables secure key management as well as transaction management. 

Penta Security provides D’Amo KMS for hot and cold wallets, which are digital asset management solutions optimized for corporates. These solutions are on-premise appliances that provide a safer and more efficient environment for the digital asset payment process. It also utilizes a unique encryption algorithm for the TEE environment. Especially, D’Amo KMS is optimized for corporate systems that require more than one manager which requires authority distribution in order to prevent accidents caused by employees in advance. 

Lastly, since digital asset transactions are also financial transactions, it is necessary to prevent the system from phishing attacks and malicious transactions via an abnormal transaction detection system (FDS). Security strategies used in the existing IT environment are crucial in the digital asset management environment.

It has been a decade since blockchain technology was first outlined by Stuart Haber and W. Scott Stornetta, the two researchers who wanted to implement a system where document timestamps could not be tampered with. As blockchain-based digital assets are attracting more attention these days, cyberattacks are occurring more frequently than ever. Exchange companies and even individuals that handle digital assets are in great need of security measures and therefore, optimized security strategies for not only the existing IT environment but also for a specific environment is fundamental. Get to know more about Penta Security’s security solutions here today.