{"id":559167,"date":"2023-11-04T18:08:59","date_gmt":"2023-11-04T18:08:59","guid":{"rendered":"https:\/\/uniquehot.com\/?p=559167"},"modified":"2023-11-04T18:11:23","modified_gmt":"2023-11-04T18:11:23","slug":"automatic-incident-response-the-key-to-robust-institutional-cybersecurity","status":"publish","type":"post","link":"https:\/\/uniquehot.com\/news\/company\/automatic-incident-response-the-key-to-robust-institutional-cybersecurity\/","title":{"rendered":"Automatic Incident Response \u2014 The Key to Robust Institutional Cybersecurity"},"content":{"rendered":"
Web3 users lost nearly $1 billion<\/a> to various hacks, scams, and exploits as of August 2023. Q3 2023 alone saw over $700 million<\/a> in losses.<\/p>\n Experts from the Forta community identified<\/a> that projects fail to act in time and stop attacks, despite real-time threat detection by efficient detector bots. This stems from an excessive (or, obsessive) focus on code<\/em>, vis-\u00e0-vis a more holistic approach to smart contract security.<\/p>\n Proactive threat mitigation is thus the need of the hour as blockchain-powered use cases regain traction<\/a> after a year-long slump. The stakes are growing<\/a> with a rise in daily Unique Active Wallet (dUAW) interactions, trading volumes, and institutional participation.<\/p>\n Forta\u2019s Attack Detector Bot<\/a> has already proven its mettle in real-time threat and anomaly detection using advanced AI and ML models. Their developers\u2019 community is now leveraging OpenZeppelin\u2019s innovative Incident Response<\/a> (IR) framework to solve the prevention side of the problem.<\/p>\n Web3 is one of the fastest growing industries, yet most Web3 protocols can\u2019t stop an exploit even when it\u2019s detected minutes in advance.<\/p>\n They \u2018can\u2019t do anything that fast<\/em>.\u2019 It takes about 24 hours<\/a> to pause the protocol<\/em>, which is often the only option to prevent identified threats. For an industry where scaling means succeeding, that\u2019s more than an eternity.<\/p>\n An exchange or marketplace, where thousands of users move assets worth millions of dollars can\u2019t take an entire day to respond to a threat. Because malicious actors are constantly inventing new ways to execute more devastating exploits\u2014it\u2019s their way of scaling.<\/p>\n The Web3 industry must either keep pace with its enemies or perish. There are no two ways about it.<\/p>\n However, hyper-centralized security architecture of Web2 isn\u2019t an option. It\u2019s crucial to build and adopt Web3-native systems based on progressive principles: decentralization, automation, transparency, and community-orientation.<\/p>\n To this end, code-based, self-executing threat mitigation and response systems are a perfect alternative. They unlock a holistic security paradigm where efficient detector bots and circuit breakers work in sync. And this groundbreaking development will particularly well serve institutional use cases, where the cost of exploit and cybersecurity are both very high.<\/p>\n OpenZeppelin integrated IR into its Defender v2, enabling \u2018you to instantly detect, respond, and resolve threats and attacks with predefined actions and scenarios.<\/em>\u2019<\/p>\n Besides conducting attack simulations and testing real-world scenarios, you can use IR to:<\/p>\n IR has two types of actions as its key building blocks: Automatic Actions<\/em><\/strong> and Transaction Templates. <\/em><\/strong>The former involves automated transactions triggered by Relayer data or multisigs; <\/em>the latter represents on-demand transactions defined via no-code forms<\/em>.<\/p>\n In simple terms, Actions are an intuitive, developer\/user-friendly way of constructing IR scenarios. They can be used, for example, to pause smart contracts, blacklist potentially malicious addresses based on data analysis and pattern recognition, notify team members via on-call paging systems or other channels, pull critical information for threat analysis, revoke privileged access if necessary, etc.<\/p>\n Though easy to use, IR Actions cover every key aspect of Web3 threat mitigation, at least from the PoV of external or systemic attack vectors. When combined with high-quality, bug-free code, this will ensure the resilience Web3 ecosystems need as they mature.<\/p>\n Now, let\u2019s see how automatic threat response will shape the future of web3 security.<\/p>\n Since October 2022, Forta\u2019s ML-powered detector bots have identified many major hacks\/exploits before they occurred: Team Finance<\/a> ($15.8 million), DFX Finance<\/a> ($7.5 million), and, above all, Euler Finance<\/a> ($197 million).<\/p>\n In the Euler Finance case, for example, Forta raised three critical alerts before the exploitation. First, when the hackers funded their attack using Tornado Cash. Second, when they created the suspicious contract. Third, when they deployed the contract from a TC-funded EOA.<\/p>\n Forta\u2019s victim identification bot could also identify Euler Finance as the target, before the attack. But even with multiple real-time alerts through all the attack stages, we couldn\u2019t stop 2023\u2019s biggest DeFi hack. It\u2019s a collective failure.<\/p>\n Using IR, however, will help prevent such incidents in the future. Team members, project managers, and developers have little control over Web3 protocols once they\u2019re deployed\u2014it\u2019s a good thing, even if it makes life difficult from a cybersecurity perspective. The point is: one can\u2019t altogether blame them for not acting in time to stop attacks\u2014they simply can\u2019t.<\/p>\n Yet, with pre-defined, community-vetted incident response scenarios, it\u2019s now possible to automatically trigger preventive measures based on alerts from Forta\u2019s bots. For example, you can flag transactions involving Tornado Cash funding<\/a> or suspicious Flashloans<\/a> using alerts from respective detector bots.<\/p>\n It\u2019s an effective way to delay attack transactions, at the least, giving the community or team members the time to take further action. And these are only two examples.<\/p>\n Since Forta is a community-driven network, you can build custom detector-mitigator bots to best serve your needs. You can also earn for your contributions via bounties, subscriptions, community rewards, and other revenue streams.<\/p>\n We\u2019re promoting an all-inclusive, win-win scenario so that individual security analysts, developers, and end-users reap lucrative benefits while Web3 becomes more secure, more robust, and more resilient as a whole.<\/p>\n It\u2019s a mission to transform the future of cybersecurity in a decentralized, community-driven manner. You are welcome to join us on this journey, scaling new heights all the way from the very beginning.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Web3 users lost nearly $1 billion to various hacks, scams, and exploits as of August 2023. Q3 2023 alone saw over $700 million in losses. Experts from the Forta community identified that projects fail to act in time and stop attacks, despite real-time threat detection by efficient detector bots. This stems from an excessive (or, obsessive) focus on code, vis-\u00e0-vis a more holistic approach to smart contract security. Proactive threat mitigation is thus the need of the hour as blockchain-powered use cases regain traction after a year-long slump. The stakes are growing with a rise in daily Unique Active Wallet (dUAW) interactions, trading volumes, and institutional participation. Forta\u2019s Attack Detector Bot has already proven its mettle in real-time threat and anomaly detection using advanced AI and ML models. Their developers\u2019 community is now leveraging OpenZeppelin\u2019s innovative Incident Response (IR) framework to solve the prevention side of the problem. The Significance of Automatic Threat Prevention Web3 is one of the fastest growing industries, yet most Web3 protocols can\u2019t stop an exploit even when it\u2019s detected minutes in advance. They \u2018can\u2019t do anything that fast.\u2019 It takes about 24 hours to pause the protocol, which is often the only option to prevent identified threats. For an industry where scaling means succeeding, that\u2019s more than an eternity. An exchange or marketplace, where thousands of users move assets worth millions of dollars can\u2019t take an entire day to respond to a threat. Because malicious actors are constantly inventing new ways to execute more devastating exploits\u2014it\u2019s their way of scaling. The Web3 industry must either keep pace with its enemies or perish. There are no two ways about it. However, hyper-centralized security architecture of Web2 isn\u2019t an option. It\u2019s crucial to build and adopt Web3-native systems based on progressive principles: decentralization, automation, transparency, and community-orientation. To this end, code-based, self-executing threat mitigation and response systems are a perfect alternative. They unlock a holistic security paradigm where efficient detector bots and circuit breakers work in sync. And this groundbreaking development will particularly well serve institutional use cases, where the cost of exploit and cybersecurity are both very high. How Incident Response (IR) Works OpenZeppelin integrated IR into its Defender v2, enabling \u2018you to instantly detect, respond, and resolve threats and attacks with predefined actions and scenarios.\u2019 Besides conducting attack simulations and testing real-world scenarios, you can use IR to: Build self-executing threat mitigation workflows that automatically perform preventive actions in pre-defined scenarios. Combine IR with real-time threat detection and monitoring protocols to leverage the power of ML and AI in cybersecurity, identifying anomalous patterns and threats before they occur. Reduce response time from ~24 hours to a few seconds at most. Access \u2018Runbooks\u2019 to decentralize and streamline security operations across the board. Actions IR has two types of actions as its key building blocks: Automatic Actions and Transaction Templates. The former involves automated transactions triggered by Relayer data or multisigs; the latter represents on-demand transactions defined via no-code forms. In simple terms, Actions are an intuitive, developer\/user-friendly way of constructing IR scenarios. They can be used, for example, to pause smart contracts, blacklist potentially malicious addresses based on data analysis and pattern recognition, notify team members via on-call paging systems or other channels, pull critical information for threat analysis, revoke privileged access if necessary, etc. Though easy to use, IR Actions cover every key aspect of Web3 threat mitigation, at least from the PoV of external or systemic attack vectors. When combined with high-quality, bug-free code, this will ensure the resilience Web3 ecosystems need as they mature. Now, let\u2019s see how automatic threat response will shape the future of web3 security. Preventing Web3 Attacks with IR Since October 2022, Forta\u2019s ML-powered detector bots have identified many major hacks\/exploits before they occurred: Team Finance ($15.8 million), DFX Finance ($7.5 million), and, above all, Euler Finance ($197 million). In the Euler Finance case, for example, Forta raised three critical alerts before the exploitation. First, when the hackers funded their attack using Tornado Cash. Second, when they created the suspicious contract. Third, when they deployed the contract from a TC-funded EOA. Forta\u2019s victim identification bot could also identify Euler Finance as the target, before the attack. But even with multiple real-time alerts through all the attack stages, we couldn\u2019t stop 2023\u2019s biggest DeFi hack. It\u2019s a collective failure. Using IR, however, will help prevent such incidents in the future. Team members, project managers, and developers have little control over Web3 protocols once they\u2019re deployed\u2014it\u2019s a good thing, even if it makes life difficult from a cybersecurity perspective. The point is: one can\u2019t altogether blame them for not acting in time to stop attacks\u2014they simply can\u2019t. Yet, with pre-defined, community-vetted incident response scenarios, it\u2019s now possible to automatically trigger preventive measures based on alerts from Forta\u2019s bots. For example, you can flag transactions involving Tornado Cash funding or suspicious Flashloans using alerts from respective detector bots. It\u2019s an effective way to delay attack transactions, at the least, giving the community or team members the time to take further action. And these are only two examples. Since Forta is a community-driven network, you can build custom detector-mitigator bots to best serve your needs. You can also earn for your contributions via bounties, subscriptions, community rewards, and other revenue streams. We\u2019re promoting an all-inclusive, win-win scenario so that individual security analysts, developers, and end-users reap lucrative benefits while Web3 becomes more secure, more robust, and more resilient as a whole. It\u2019s a mission to transform the future of cybersecurity in a decentralized, community-driven manner. You are welcome to join us on this journey, scaling new heights all the way from the very beginning. <\/p>\n","protected":false},"author":534,"featured_media":559168,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[79568],"tags":[],"class_list":["post-559167","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-company"],"acf":[],"yoast_head":"\nThe Significance of Automatic Threat Prevention<\/h3>\n
How Incident Response (IR) Works<\/h3>\n
\n
Actions<\/h4>\n
Preventing Web3 Attacks with IR<\/h3>\n