This talk will seek to first cover the fundamentals of Blockchain technology for Incident Responders and show examples of blockchain based technology projects such as Smart Contracts. Then the talk will cover how to think about approaching incident response activities for blockchain based activity, and to speculate (a little) on how the projects that use this technology may affect the future workload of Incident Responders and Coordination Centers.
Incident Response and Incident Coordination teams have begun seeing an ever increasing share of incidents involving blockchain and cryptocurrency technologies. These types of incidents include Ransomware Payments, Money Laundering, Theft, Financial Transactions for : Criminal Activity, Sanctions Avoidance, and much more. In order to combat illegal activity, and to continue to respond to increasingly financially oriented incidents, these teams will need to develop increasing skill in Blockchain Technology, how it works, and how to approach Incident Response for blockchain related events.
The technology involved in cryptocurrencies (generally P2P networks, PKI, and Hash Functions) will be familiar to many Incident Responders but the ways in which they are being applied such as to create distributed networks, Smart Contracts, NFTs, Governance or Utility tokens, and other coins, and the sizable sums involved may be quite new. IR teams might need to understand blockchain ecosystems, culture, ethos, and activities to deal with current and future incidents. Practices may include: Cryptocurrency Forensics Investigations, Exchange Investigations, Tracking or Recovering Stolen Funds, Frauds, Digital Asset (NFT) Scams, Anonymization Tracking, Client Code Vulnerability Coordination, Smart Contract Vulnerability Coordination, Secure Coding, Bug Bounty Programs and more.
Samuel has been at CERT since 2011 and has performed research in a variety of areas including insider threat, vulnerability assessment, security incident and threat data analysis, threat modeling, information sharing, artificial intelligence, cognitive processes, formal methods, and incident management team development. Prior to CERT, Perl gained over 10 years of industry experience working with client organizations to manage their most challenging IT security risk issues. Perl holds a M.S. in Information Security Management from Carnegie Mellon University and a B.S in Information Systems from Carnegie Mellon University. He has also held appointments as an adjunct instructor in the Carnegie Mellon University's Information Systems (IS) program, Heinz College of Information Systems Policy and Management, and in the West Virginia University Honors College. He is also a member of the graduate faculty at the Florida Institute of Technology where he serves as a cybersecurity advisor on thesis and project committees.
