As any asset on the web, NFTs need the best possible security for the buyers to trust them, while, as is, they are not very secure. There are always ones who would try to put their hands on some else’s possessions. NFTs are stolen from time to time by shrewd…

Security Quality Requirements Engineering (SQUARE) was created by the experts from Carnegie Mellon University and the Software Engineering Institute (SEI). This process offers a means for eliciting, categorizing and prioritizing security requirements for systems and applications. It aims at integrating security considerations at the earliest stages of the development process…

Centralization and decentralization are two antipodes, which are, however, both popular among the users and the developers in the web3 environment. They are not usually adopted exclusively, both have their strong and weak points and, in their way, both may be vulnerable to possible intrusion or other issues. …

CVSS (Common Vulnerability Scoring system) is used to rate vulnerabilities by a numeral severity score. It was created in the beginning of the century by NIST (National Institute of Standard and Technology) and maintained by FIRST (Forum of Incident Response and Security Teams), supported by CVSS Special Interest Group. It…

‘Gray box’ testing is somewhat in between ‘Black box’ and ‘White box’, and implies deep knowledge of the tested application’s architecture, design and purpose, which is, however, not necessarily complete or up to date.. Gray box testing may be performed by either a third party or the developers themselves. The…

A Blockchain security audit is a code review of a blockchain development project which can be carried out only manually. This process involves extensive use of static code analysis tools, but the majority of the work consists of searching for bugs and vulnerabilities relying primarily on the experts. Why is it needed? Blockchain is…

Security through Obscurity (STO) is the reliance on secrecy and confusing attackers instead of building proper controls to keep them out. It is based on secluding important data. It provides protection from attacks, but it is not a panacea. Hackers and bots can try to exploit the user’s plugins in…

OCTAVE (Operational Critical Threat, Asset and Vulnerability Evaluation) is a risk-based strategic assessment and planning method. It was developed in the beginning of the century by CERT (Computer Emergency Response Team). It focuses on evaluating organizational risks without addressing technological ones and its main aspects are: operational risk, security practices…

Attack tree (threat tree) is a graphical formalism used to structure, model and analyze potential attacks. It starts with a security threat, modeled as its root, representing the attacker’s top level goal. It divides into subgoals through logical gates, modeling how successful the attack steps may be. Basic attack steps…