How the Gravity Protocol Team Implements a Security Development LifecycleEnsuring the security of a blockchain networkRecent security incidents with the DAO, Ethereum Krypton 51% attack, and “epic” vulnerabilities discovered in EOS by Chinese security researchers at Qihoo 360 (luckily fixed) once again tell us that security concerns are paramount for open blockchain networks supported by communities.
First of all, we need to understand — “What is security?” The CIA security triad model, composed of three areas; (1) Confidentiality, (2) Integrity and (3) Availability will be referenced throughout this paper.
According to the National Institute of Standards and Technology (NIST):Confidentiality refers to “The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes”;
Integrity is defined as the “guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity”.
Availability references the concept of “ensuring timely and reliable access to and use of information”
What does it take to ensure security in your software system? It means that your engineering team has a certain level of maturity and implements rigorous Secure Software Development Lifecycle (S-SDLC).
The S-SDLC process ensures that security assurance activities such as code review, architecture analysis, and attack modelling, are an integral part of the development effort. The main advantages of pursuing a Secure SDLC approach with regards to an open blockchain are:
- Increased quality and security of software as security is a continuous concern.
- Awareness of security considerations by stakeholders and the community.
- Early detection of flaws and vulnerabilities in the system.
- Overall reduction of intrinsic business risks for the community.
Since Gravity Protocol is an open blockchain offering solutions for small and medium businesses, secure software is our highest priority. See how we implement similar to SDL development process
here on our blog.