Best Practices for Securing Crypto Currency exchange

In our last blog on crypto we discussed on a case study related to penetration testing of crypto exchange.

Today we are going to discuss on best security practices for securing crypto exchange sites.

Web Application Level

1) Implement Two factor authentication at login and withdrawal sections of the application of currency or fiat money. Ensure two factor authentications for all the critical functions on the website.
2) Developers can incorporate OWASP Top 10 recommendations into their work while developing the application.
https://www.owasp.org/index.php/Main_Page
3) Enforce Strong Password policy for every user account.
4) All data transmitted should be on HTTPS
5) If your exchange provides API then ensure below security controls are implemented such as below:

• API data should only be accessible with valid authentication with protected endpoints.
• Session Validation should be configured for all API’s.
• Ensure encryption of all sensitive data
• Limit API requests through Rate limit.
• Validate User input to avoid common vulnerabilities (e.g. XSS, SQL-Injection, Remote Code Execution, etc).
• Ensure all login, access control failures are logged and monitored.

For more information you can follow https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

6) For Mobile Application used in trading platforms ensure the following best security practices .

  • Never store any personal and wallet data on the mobile device.
  • Use certificate and public key pinning for secure communication between app and server application.
  • All entry points in Mobile application should be secured.
  • Implement two factor authentications for all critical functions like withdrawal of crypto or Fiat money.

7) Implement continuous monitoring program of the application that can continuously assess and monitor ,data, application & infrastructure behaviours for potential security threats

Business Logic

  1. Make sure KYC verification process is not bypassed and all the required controls should be implemented for a successful KYC.
  2. Trade Engine Security

A matching or trading engine is a piece of software that keeps a record of all open orders in a market and generates new trades if the two orders can be fulfilled by each other.

Writing a secure trade engine requires understanding on open orders, close orders, limit orders, market order & stop order.

Following points should be take care while writing a Trade Engine

  • Crypto currency and Transaction Verification should match.
  • Verify Primitives and transaction verification, implementation are correct.
  • Contract primitives to ensure expected execution is performed.
  • Keep logs of API with a view of all customer’s balances, soft/hard withdrawing limits and payment history

For more information on Trade Engine you can follow below link.

https://around25.com/blog/building-a-trading-engine-for-a-crypto-exchange/

Wallet Security

A crypto currency wallet is a secure digital wallet used to store, send, and receive digital currency like Bitcoins. Most coins have an official wallet or a few officially recommended third-party wallets. In order to use any crypto currency, you will need to use a crypto currency wallet.

The Main Concerns for exchange is how they want to store the user private wallet keys.

Private keys of wallets can be stored in two different forms such as Cold Wallet & Hot Wallet and most of the exchanges keep the keys in Hot wallet.

The Main difference is Hot Wallets are stored on the same application server and Cold wallets are stored offline in form of paper wallet or in dedicated hardware wallet.

You can read more information of hardware security modules

https://cryptocurrencyfacts.com/what-is-a-cryptocurrency-wallet/

https://safenet.gemalto.com/data-encryption/hardware-security-modules-hsms/

The Above methods are based on our experience to kick start information security best practices for crypto exchange.

 

About Manjunath NG,

Manjunath is an Information security enthusiast and Director at “ ISECURION Technology and Consulting Pvt Ltd.”

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.