4 ms·

If I were a crypto startup I'd be more worried about insider threat than anything sophisticated. Protecting against a rogue employee also adds defence against

If I were a crypto startup I'd be more worried about insider threat than anything sophisticated. Protecting against a rogue employee also adds defence against employee computer compromise.

verroq 7y ago
Insider threat is probably non-existant. You know all your employees and if a hack happens there is an easy list of people to investigate. Also trying to cash out large amounts of stolen crypto is going to be difficult with the amount of blockchain analysis going on and all fiat exchanges requiring KYC.
- camjohnson26 7y ago
  I wouldn’t be so sure. There have been situations where insiders stole crypto and then claimed they were hacked to cover it up. Looks like Gelfman Blueprint is an example and there are almost definitely others.
- nodesocket 7y ago
  Or if the insider slowly siphoned off tiny amounts from lots of accounts over a long period of time. That sort of thing would probably be very hard to catch. I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH
  - deleted 7y ago
    [deleted]
  - leppr 7y ago
    A good wallet would show the last transactions prominently. Also you can setup email alerts for ETH transfers from/to your account with a tool like etherscan.io. That's the advantage of public ledgers, it's way easier to monitor for abnormalities. You don't need to tell your employees about all the checks you have put in place either.
  - gruez 7y ago
    >I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH note to self: only keep round amounts in online wallets.
- JumpCrisscross 7y ago
  > there is an easy list of people to investigate If the criminal has an ounce of brains, they'd execute the hack while on an overseas vacation.
- chatmasta 7y ago
  KYC should really be renamed CYA (cover your ass), because it's borderline useless as a real security measure against determined threat actors. For anyone willing to commit fraud and/or identity theft, it would be relatively easy to "pass" a KYC process under an assumed identity, especially when no in-person/biometric verification is required.
- rdl 7y ago
  Insider threat is absolutely a risk. The other risk if you don't fully and publicly mitigate insider threat is someone applying pressure to your employees to do something bad. (The intel community and other high risk environments have long had this threat model). This is basically identical to insider threat at time of pressure, although there are some different countermeasures leading up to it. The low end of this is catching someone doing something they shouldn't (browsing porn on a work computer, having a relative with legal difficulties, etc.) and applying that as leverage. Usually "report early, no action will be taken against you" is a good policy for minor things. I would NEVER expect (or want) someone to do anything but fully comply with an attacker who has kidnapped his kid and credibly threatens to do something horrible unless he authorizes a payment. My instructions to the insiders are "comply; we have technical countermeasures which will make those attacks fail".
- eggsome 7y ago
  According to this story (https://news.bitcoin.com/looting-fox-sabotage-shapeshift https://news.bitcoin.com/looting-fox-sabotage-shapeshift) the threat is real and at least one person got away with it.

If I were a crypto startup I'd be more worried about insider threat than anything sophisticated. Protecting against a rogue employee also adds defence against employee computer compromise.

verroq 7y ago

Insider threat is probably non-existant. You know all your employees and if a hack happens there is an easy list of people to investigate. Also trying to cash out large amounts of stolen crypto is going to be difficult with the amount of blockchain analysis going on and all fiat exchanges requiring KYC.

camjohnson26 7y ago
I wouldn’t be so sure. There have been situations where insiders stole crypto and then claimed they were hacked to cover it up. Looks like Gelfman Blueprint is an example and there are almost definitely others.
nodesocket 7y ago
Or if the insider slowly siphoned off tiny amounts from lots of accounts over a long period of time. That sort of thing would probably be very hard to catch. I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH
- deleted 7y ago
  [deleted]
- leppr 7y ago
  A good wallet would show the last transactions prominently. Also you can setup email alerts for ETH transfers from/to your account with a tool like etherscan.io. That's the advantage of public ledgers, it's way easier to monitor for abnormalities. You don't need to tell your employees about all the checks you have put in place either.
- gruez 7y ago
  >I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH note to self: only keep round amounts in online wallets.
JumpCrisscross 7y ago
> there is an easy list of people to investigate If the criminal has an ounce of brains, they'd execute the hack while on an overseas vacation.
chatmasta 7y ago
KYC should really be renamed CYA (cover your ass), because it's borderline useless as a real security measure against determined threat actors. For anyone willing to commit fraud and/or identity theft, it would be relatively easy to "pass" a KYC process under an assumed identity, especially when no in-person/biometric verification is required.
rdl 7y ago
Insider threat is absolutely a risk. The other risk if you don't fully and publicly mitigate insider threat is someone applying pressure to your employees to do something bad. (The intel community and other high risk environments have long had this threat model). This is basically identical to insider threat at time of pressure, although there are some different countermeasures leading up to it. The low end of this is catching someone doing something they shouldn't (browsing porn on a work computer, having a relative with legal difficulties, etc.) and applying that as leverage. Usually "report early, no action will be taken against you" is a good policy for minor things. I would NEVER expect (or want) someone to do anything but fully comply with an attacker who has kidnapped his kid and credibly threatens to do something horrible unless he authorizes a payment. My instructions to the insiders are "comply; we have technical countermeasures which will make those attacks fail".
eggsome 7y ago
According to this story (https://news.bitcoin.com/looting-fox-sabotage-shapeshift https://news.bitcoin.com/looting-fox-sabotage-shapeshift) the threat is real and at least one person got away with it.