SIX STEPS TO SECURE CRYPTOGRAPHIC KEYS

SIX STEPS TO SECURE CRYPTOGRAPHIC KEYS

As more and more countries are exploring the benefits of having a cashless society, the issues of cryptocurrencies is widely debated among central banks and governments today. Late last year, the Monetary Authority of Singapore (MAS) advised the public to act with extreme cautiousness and to understand the significant risks they could face if they choose to invest in cryptocurrencies. MAS highlighted that there is also a risk of loss should the cryptocurrency intermediary be hacked, as it may not have sufficiently robust security features.

Cryptocurrency has grown exponentially because of its attractiveness to people looking to use this alternative money. The rapid growth in the value of cryptocurrency like Bitcoin over the past year has established it as an attractive investment which can have a positive impact on the wallets and trading practices of investors globally. Nevertheless, the number of cyber security threats is increasing each year, as well as the number of methods to illegally access data, exploit computer power and extort money. 

Over the past year, the Southeast Asia region witnessed a growing number of cryptocurrency startups, making it a very attractive target for cybercriminals.

As this form of currency gains more popularity and credibility, organizations in every industry will need to implement security controls to mitigate risk against crypto-credentials from becoming exposed.

Digital Wallets – The basics

There are two types of digital wallets: hot wallets and cold wallets. Hot wallets are used by individual users and organizations to store smaller amounts of currency, providing the need for more fluidity required for quick transfers and exchanges. There are many cryptocurrency services such as Coinbase and Bittrex, which are available in Singapore, that manage and store the wallet’s private key and provide users with easy access. Usually, this type of managed service is password protected.

As for cold wallets, it is used by organizations and security-savvy individuals and typically hold much larger amounts of digital currency. This type of wallet keeps its associated private key off the internet completely and often stores it on an offline computer. However, if the network becomes compromised, then the keys will follow suit shortly.

Don’t Get Digitally Robbed

Cryptocurrency private keys are not exclusively used by human users. There are many automated processes that perform cryptocurrency transactions as well. Securing private keys for all users (both human and machine) is a foundational first step, quickly followed by authenticating and identifying who has access to the keys, controlling the access and monitoring its usage.

Cryptocurrency private keys should be treated as another type of privileged credential that needs to be managed and protected. In essence, it should be handled similar to how we store a password with a few slight modifications and specific requirements.

Whether the private keys are accessed by humans or automated processes, it is critical to authenticate the access control and assure it has not been forged by a malicious insider or external attacker.

Here are six key considerations to secure and protect cryptographic keys:

Store cryptographic keys in a secure digital vault – Move keys into a digital vault with multiple layers of security wrapped around it, enforce multi-factor authentication to all users who have access to the vault.

Introduce role segregation – Control individual access to stored keys, preventing even the most privileged administrators from getting to them unless explicit permissions have been granted.

Enable secure application access – Restrict access to stored keys to authorized applications and verify that the applications are legitimate and untampered.

Audit and review access key activity – Audit all activities related to key access and implement trigger events to alert the necessary individuals of any key activity.

Enforce workflow approvals – Enforce workflow approvals for any activities considered to be highly sensitive and the same goes for accessing the keys.

Monitor cryptocurrency administrator activities – Facilitate connections – similar to an automated secure proxy/jump host – to target systems that are used to perform cryptocurrency administrator activities (e.g. the system hosting the wallet).