Hyperledger Foundation Hyperledger Global Forum 2020, 9 Mar 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Monitoring and Securing Your Blockchain: 5 Basics Everyone Should Know - Aaron Klein, BlocWatch

Description

Monitoring and Securing Your Blockchain: 5 Basics Everyone Should Know - Aaron Klein, BlocWatch

Blockchain and DLT adoption is rapidly growing with over 80% of Fortune 500 companies already actively exploring and evaluating use-cases. This technology, although offering users enormous transparency and security advantages, still requires user management. Attendees to this session will get the basics on how to effectively monitor and manage their chain. The session will highlight areas to monitor, what to look for in operational metrics, key elements for maintaining chain security, and how to identify suspicious behavior. All attendees should leave the session with a better understanding of how to apply traditional security, compliance, and operational fundamentals to this new technology.

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2020 #Blockchain

A

All right, great hi, I'm, Aaron Klein I, want to thank you for for coming to this I think I think for some reason, we're in the demo stage I'm not entirely sure. Why? Because we're gonna talk a little bit more about monitoring and securing your blockchain I'm, the founder and CEO of block watch, and this is something sort of near and dear to our heart. You know so I gotta I gotta give you the quick 15 seconds of what we do, because my marketing people kill me otherwise.

A

um Vockrodt really provide a comprehensive platform that supports multiple protocols enabling users to manage permission on Commission blockchain implementations. So in the real, the real sort of sound byte is we give you visual? We give you visualizations around, what's going on on your chain, what's going on in your environment, making sure that you meet compliance requirements, making sure that your operation, you have operational visibility, that you have security, visibility right.

A

We help enterprises, leverage up, blockchain technology, so sorta, maybe the basics in the start of what's going on and when we think about it right is, is really a thought that production systems and all sort of you know any any production system in an enterprise environment is going to require monitoring and I think we all know that right, we've all been in the space and maybe it gets lost when we think about block chains, because a lot of what blockchain has been sold is this fantastic system? That's you know that has great security.

A

That has great controls, but it still requires monitoring. And that's that's really. My message here right is that, as you move things forward, you still need to. You still need to understand. What's happening in your environment, you still have to meet your compliance needs. You still need to meet your operational needs. Your security needs alright, and none of this is new right. It's not a new paradigm, it's not anything earth-shattering, but it's still something worth repeating.

A

As we move forward into the adoption curve right, we said, and it's still early and we were talking about it's four years into sort of when hyper ledger was was launched and as we move forward, we still need to think about what we're doing as we're starting to push push projects forward, move them towards production, so it doesn't have to be difficult.

A

It doesn't have to be hard, but it is something that you need to do and maybe serve as an example right when you think about legacy and blockchain systems are they're, not so different right. They have different nomenclature, some different terminology, but conceptually again the ideas are very, very similar right. So you know so some things you know you need to translate what a network is. You need to translate what operational systems look like, but if you're looking at things like configuration, changes it's going to be exactly the same.

A

It's going to be the exact same of. What's going on, we put together, you know our our engineering team put together a little a little paper on sort of the translation to make life easy. This is a summary of it, the full ones available there or we're actually a exhibitor here and you're- welcome to go up to our booth and take a look at it and grab a handout.

A

But again it's you know. My message is simple. You know, do do the homework and and do some of the monitoring right, because for us to be successful for all of us at this conference for all of us looking for blockchain adoption, we need to be responsible right. So what are those core monitoring requirements all right? What is important all right, obviously, chain health, and you know, and when you think of chain health right, it's looking at node health, it's looking at who's attached. It's making sure transactions are going through right. It's okay performance!

A

It's understanding what you expect from performance. It's making sure that you're delivering that right, if you're putting a fabric chain or another chain into production, you're, probably running tens, if not hundreds of millions of dollars worth of transactions through there. You need to make sure that that they're running the way you expect you need to make sure that you're getting the performance. You expect all right. You need to look at activity and event monitoring you need to. You know you need to understand. What's going on, you need to you need transaction validation.

A

You need reporting and audit, because your your you know, your your customers or your consortium, members or your users are gonna. Need this information right. You've got to look for suspicious behavior, you have to have expectations around what's going to occur, and then you need to you need to set up alerts. You need to tract and see what's happening on that right and obviously part of that is looking at operations and configuration management. It's understanding, you know how things are set up, making sure things aren't changed and really really sort of tracking everything.

A

That's going on in your environment, all right so sort of, as we think of the key ideas all right. Let me break it into three key monitoring, ideas or three ways to look at and sort of a starting point for all this right. The first is is obviously, network monitoring, that's where that's where everything starts right, so you want to understand your chain health. You want to understand your chain performance all right. What's, let's look at what's happening from you know from an activity, let's look at what's happening from alerting, so just do all that.

A

The very first thing you need to do is really create an inventory right because you don't. You can't monitor anything. If you don't have an inventory of what notes are on there, what notes are active? What notes are healthy if you don't know where you're starting from right, if you don't know what your smart contracts, what that looks like you can't even begin to start up to hope to accomplish that and then once you have that right, you need to you need to keep that inventory. You need to look at active nodes and health right.

A

You need to understand your smart contracts. You need to know performance metrics, again rolling back into hey. This is what I expect. This is the speed. This is the validation. Is it happening all right you need to you know you need to look at activity monitoring in terms of, and we see it where you have a certain number of transactions, you're expecting you're expecting to come out of a certain area, you're expecting a certain type right. You need to identify anomalous behavior, you want to prevail.

A

You want pre-build alerts so that you can quickly respond and then you want to then obviously right when you see something you need to, you need to take action. I mean this is no different than other production systems.

A

The second piece you look at is you know, operation and configuration management. When we think of this I mean this is sort of baseline security 101. This is hey. You know, blockchains block chains are sold by the evangelists as a super, secure, fantastic news and- and it is there's a lot of great things, but you know what, if you don't control the access to it, if you don't control, who can join your network? If you don't look at that and monitor that, then sorry I'm, just melting up here, Oh.

A

If you don't monitor that, then you know you're, really you're you're compromising your security you're failing and your security needs, you're failing in your compliance needs. So what are you going to look at right, you're, gonna, look at Channel and configuration policies right, you're, gonna, make sure they're set up right, you're gonna make sure they don't get changed or if they do get changed understand why and create an audit trail around it.

A

You're gonna, look at your otter, orderer and raft configuration policies again understanding what you're giving permissions to understanding who can access your network understanding what sort of transactions had come through right and really all of these identify changes, track changes alert on changes. If your network is compromised, the first thing someone's going to do is they're going to go in and they're gonna they're gonna, you know, give themselves greater permissions, greater policies, they're gonna, give access to other bad actors, and so that's you know, really sort of a starting point from a security perspective.

A

Of what you want to look at.

A

The third piece of the puzzle is really independent transaction verification, and this is this is a bit to satisfy your users right. This is a bit to satisfy your compliance needs. This is making sure that transactions right and totals and inputs and smart contracts and making sure that everything matches and that you can create an easily accessible audit record for your compliance perspective that you can create records for your users right so so folks are gonna join your supply chain. Your suppliers are on the chain and they're looking at it.

A

They want to make sure that what they're seeing is real, not being manipulated and and so doing that you know tracking assets, visualizing your network understanding what's happening and then being able to display it both internally from a compliance perspective and externally to your customers builds trust. Right, builds use because the reality is right. We want to.

A

We want to build blockchain solutions, because we see this as a very efficient way to you know to improve business processes, to make it easier for our our suppliers to make it easier for our users, our customers, to build trust but step. One you know, and maybe fifteen twenty years from now it won't be as important but step. One is let's: let's build a trust today, let's show them, let's show them that that not only we saying this is going on, but we have independent third parties doing that.

A

So these are really sort of the core pieces of being successful and sort of monitoring and securing. What's going on in your chain right um and again, I'll give a little pitch for us right. We do this obviously right. This is. This is the essence of what we do. um You know we build dashboards, you see sort of an example of it and we make it easy and we do automated alerting- and we do you know some smart, intelligent filtering and we run hundreds of best practices checks.

A

So we do all that not obviously right I'm here, because we'd love to sell it to you. But if you don't use us, that's okay, too. All right, I mean candidly. You can. You know if you're early on, if you're just getting started, take a look at take a look at the open source tools, all right when you're just getting started, you're not running a complex network, definitely worthwhile to look at right. Write your own scripts.

A

You know it's another another, certainly valid way when you're running a small network, but our message is simple: right use us use an open-source tool, write your own script, but you really. You have to do it right for blockchain to move forward as an industry. You know for box chain to be successful for us to see enterprise adoption. You need to do this. It's it's just critically, critically important, all right, so sort of the the summary. The summary of the talk is really look. Blockchain systems are just like other legacy. Production systems.

A

Right I mean they're going to do some to go. Do some neat things, but they still require monitoring for for operational metrics to make sure it's performing the way you want it to perform. There's still girl require monitoring for security right you're, still going to make sure that the no despite despite people going. Oh, that data is great and the data can be immutable, but if you're letting anyone access your network and you're not controlling that access, then you have immutable garbage data, which really is no better.

A

Oh, and it's not that complicated all right, you know you just have to translate it a little bit. You have to think about some new issues right. There are sort of different ways to look about it, but it's not. You know it's not something that should scare you away or stop you from using blockchain. It's not shouldn't. Stop you from an implementation right and I mean, and what's the launch for is look it's just basic stuff. Watch for user and chain activity set benchmarks understand what you expect. Compare against those benchmarks.

A

Look for performance again understand what you expect. How fast should transactions be clearing? What should things look like and then set alerts for anomalous, behavior right, you know and and again keep doing it. This is not a one-off. This is like anything else. All right. People talk about security, it's defense-in-depth!

A

Well, monitoring is, and it's not like- hey I checked it once a week right, set up a system like I said: use us usually use an open-source tool but set up a system so that, as you push things into production, you know you're, prepared and, and your security team is happy and your operational folks are happy right. Your compliance is happy. Everyone, everyone's gonna, sign off on your project as it goes into production because you can show them the data and you can be successful all right so and that's it right.

A

They don't give us a whole lot of time here. But, but you know, I definitely want to thank everyone for their time, for their interest of slides will be available. I know that I know that they're putting you know, they're gonna, post everything. We have a booth, upstairs we'd love to show you a demo of the product or just talk to you and more in more detail around security, or you know not telling you, like Josh, one of our team members is sitting over here.

A

He'd love to talk to you about what you're doing right or show you. What's going on so thank you very much and that's it. I.

A

Don't know they ain't, give me a clock, so I don't know what my time is what we got a couple. We got two minutes of Q&A.

A

Yeah I mean so so it's configurable right so as you're gonna as you're gonna set up your chain in and put your chain we're going to ask a series of questions. We're gonna run it through a wizard and we're going to allow you, because every chain is different right. Fundamentally, you know different, as you point out right. Different chains are used for different reasons, collecting different data at different assets and so you're able to sort of user, define, what's important to you and then we're gonna run our rules engine against there.

A

Yeah well, so so what right? So so, obviously, all that afraid all the data is coming in specific areas, specific fields in a format and then and then what you're gonna you know we're gonna, we're gonna, look for you to say: hey in this field. This field means this right, because what we don't want is you know what would its software?

A

What we don't actually want to do is own your data and then and then you can just really very easily user-defined rules or use our pre-built rules, and you know, depending it, depending on what you label a field as what you want. Rules applied to right, you're going to get that answer.

A

A

Well so so today I mean that's and that's something, that's certainly on the roadmap. Today, it's more of a status, so it's going to catch it in terms of a status right where you're gonna see your get, you could set up an alert for all smart contracts with status. X right, you know to find as and it's going to show it that way. It's not I mean it's. It's again.

A

It's mining candle right, it's early and what's and what's going on in blockchain is early right, and this is you know in delving deeper into smart contracts. Is, is on our sort of very short-term roadmap. It's not gonna. Do it automatically you're gonna have to you're gonna have to set the alert, but once you set the alert, then it'll grab that information and display it. For you.

A

Cool any other questions awesome again, I mean I, encourage you, you know, take drop-by, upstairs you'd love to show it to you. You know and Bend you're here for five minutes and thanks so much for your time. Everyone.