►
Description
On Thursday, September 22, Hyperledger Sweden hosted a discussion with Niklas Agerbech, CEO and Co-founder of cybersecurity company Danish Blockchain Lab, about ways to ensure the security of your blockchain product. In this video, Niklas discusses the measures that they take to ensure the security and integrity of blockchain networks. He believes that through knowledge sharing we can drive the advancement and development of blockchain technologies and further push for mass adoption.
More about the Danish Blockchain Lab is at: https://www.linkedin.com/company/danish-blockchain-lab/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)
A
A
We
find
it
very
interesting
that
a
lot
of
companies
are
choosing
blockchain
as
a
technology,
specifically
because
of
the
security
function
that
it
carries,
but
after
they
have
chosen
blockchain.
What
happens
very
often
is
that
security
in
the
everyday
continuously
integration
is
kind
of
moving
into
the
background.
So
we
see
a
lot
of
these
companies
have
chosen
blockchain
to
improve
security,
but
in
the
everyday
they
are
not
really
focusing
that
much
on
security,
and
that
is
some
of
the
points
that
I
would
be
focusing
on
in
this
presentation.
A
So
what
we
often
hear
is,
but
it's
a
blockchain,
so
it's
secure
right
and
we
often
meet
this
misconception.
That
blockchain
is
carrying
some
sort
of
security
magic
inside
it,
meaning
that,
once
you
have
chosen
blockchain
as
a
technology,
then
you
do
not
longer
have
to
focus
on
security
and
I
will
be
showing
you
some
numbers
and
I
bet
that
a
few
of
these
numbers
will
probably
show
that
this
is
definitely
a
misconception
within
this
industry.
A
A
So
these
are
some
numbers
from
from
this
year
from
some
of
the
largest
hacks.
That
happened
so
far.
That
may
have
happened.
A
few
more
hacks
since
I
created
this
presentation
only
a
week
ago,
but
I'm
pretty
sure
that
most
of
you
are
familiar
with
a
few
of
the
biggest
ones.
That
would
be
axi
Infinity
Wormhole
and
what
is
really
really
interesting
when
we
look
at
these
numbers
besides,
the
amounts
of
of
money
and
funds
being
stolen,
is
that
not
all
of
them
is
actually
targeted
through
the
smart
contracts.
A
So
what
do
I
mean
by
that?
Well,
what
I
mean
is
that
a
lot
of
the
companies
that
we
are
in
touch
with
the
first
meeting
that
we
have
them
with
them?
The
client
usually
ask
this
asks
us
if
we
can
conduct
a
smart
contract
audit
for
them
and,
yes,
definitely
we
can,
but
the
thing
is
that
smart
contracts
is
not
the
only
way
that
hackers
can
can
exploit
your
blockchain
product.
A
A
So
if
we
go
back
to
the
numbers
and
the
model
that
I
just
showed,
what
is
interesting
when
we
take
a
closer
look
here,
is
that
in
only
two
of
these
cases
the
hackers
actually
gain
access
to
the
funds
directly
through
the
smart
contracts
and
a
lot
of
the
other
cases.
Here,
the
hackers
got
in
in
different
ways
a
good
example
of
hacking
or
getting
hacked
not
getting
through
the
smart
contracts,
as
the
first
touch
point
is
especially
axi
Infinity
that
was
carried
out
by
a
well-known
hacking
group.
A
So
if
we
kind
of
divide
it
into
different
categories
here,
we
can
see
that
a
lot
of
the
cases
that
I
showed
you
right
before
actually
happened
through
phishing
and,
if
you're
not
that
familiar
with
fishing,
it's
a
type
of
like
social
engineering,
and
it's
often
a
way
that
hackers
trick
themselves
into
the
organization
either
by
it
could
be
that
they
are
scamming.
Your
domain
could
be
that
they're
creating
a
domain
that
is
very
much
looking
like
your
domain
and
what
they
will
do
is
that
they
will
be
sending
fake
mails.
A
They
will
be
getting
you
access
codes,
they
can
get
you
to
draw
out
money
and
all
sorts
of
stuff
like
that.
Another
huge
chunk
is
misconfigurations.
A
lot
of
the
cases
we
see
are
happening
due
to
the
fact
that
blockchain
is
such
a
new
technology,
meaning
that
it
is
very
difficult
to
gather
a
large
development
team
that
has
done
this
a
million
times
before
so
I
usually
say
that
this
is
one
of
the
the
rare
businesses
one
of
the
few
businesses
where
you
are
almost
considered
a
senior
after
only
one
year.
A
So
what
often
happens
is
that
if
you
like
to
scale
up
and
create
a
huge
team,
you
will
be
ending
up
with
one
senior
and
a
lot
of
developers
who
may
be
doing
this
for
the
first
time,
and
that
means
that
a
lot
of
them
will
be
skipping
some
Corners.
They
will
be
copy
pasting,
a
code
from
different
repositories,
which
can
be
totally
fine.
If
you
know
what
the
repository
is
contain
and
what
the
code
actually
do,
so
what
the
hackers
can
use
here
is,
of
course
they
can
go
through
the
smart
contracts.
A
A
Another
way,
of
course,
as
most
of
you
probably
know,
is
the
vulnerabilities
in
the
smart
contracts,
and
that
would
be
exploiting
blocks
around
abilities
in
the
smart
contracts,
and
that's
definitely
a
fact
to
that
that
you
need
to
kind
of
take
into
consideration
as
well.
Even
though
that
we
see
a
lot
of
these
attacks
is
actually
directed
at
organizations
where
the
general
level
of
security
is
low
right.
So
what
do
you
actually
need
to
take
into
consideration
when
we
want
to
increase
the
security
of
blockchain
products?
A
A
So
we
have
worked
on
projects
where
our
experts
in
tokenomics
have
saved
the
projects
from
being
misused
by
Bad
actors
solely
to
to
poor
tokenomics,
there's
also
a
huge
need
for
looking
through
the
blockchain
network
security,
by
that
it's
very
important
to
have
a
focus
on
the
whole
network
surrounding
the
blockchain,
because
there
will
be
infrastructure,
databases,
service
and
stuff
like
that.
That
can
be
exploded.
A
So,
as
you
are
considering
to
focus
on
Smart
contracts,
you
need
to
have
the
same
Focus
also
on
the
infrastructure
and
on
your
server
side
as
well,
all
right
A,
lot
of
these
applications
that
are
being
used
together
with
the
blockchain.
They
can
contain
a
lot
of
vulnerabilities
also,
so
you
need
to
take
into
consideration
how
strong
is
the
user
authentication
and
how
are
the
endpoints
set
up?
Who
has
access
to
what,
if
it's
a
permission,
blockchain
or
access
and
use
are
only
open
to
edited
and
known
participants?
A
This
may
include
variable
levels
of
access
that
could
change
over
time,
so
you
need
to
think
about
who
has
access
now
and
what
are
the
the
scenarios
that
can
come
in
into
the
future?
What
happens
if
our
chair,
if
our
staff
changes
who
can
take
over
and
who
has
access
to
what?
Where
are
the
keys
stored
within
the
applications?
How
do
we
make
sure
that
we
are
not
having
a
decentralized
blockchain,
but
we
have
a
centralized
database
of
all
the
private
Keys.
A
We
have
seen
that
also
so
there's
plenty
of
room
to
to
look
through
within
the
the
application
security
itself.
Another
very
interesting
part
here
is
to
Institute
real-time
analytics,
and
what
does
that
mean?
Well,
in
fact,
it
means
that
you
have
monitor
systems
monitoring
parts
of
your
infrastructure.
It
could
also
be
your
your
protocol
itself
and
looking
for
anomalies.
A
A
So
we
point
that,
at
the
best
within
the
industry,
within
domain
intelligence,
we
work
together
with
a
very
very
cool
company
called
fio,
and
what
they
do
is
that
they
can
actually
monitor
your
domain
and
for
you,
and
what
it
will
do
is
that
you
will
get
notified
right
away
if
there
is
a
look-alike
domain
coming
up.
That
might
be
a
good
advantage
to
be
off
by
by
scammers
other
than
that
they
actually
have
people
that
can
jump
in
and
and
take
down
the
the
scan
domains
for
you.
A
So
what
is
really
really
important
after
that?
You
have
set
up
a
lot
of
systems,
for
monitoring
is
actually
to
have
a
plan
about
who
will
actually
act.
If
something
happens,
what
we
see
a
lot
is
that
of
course,
is
very,
very
well
known
that
if
you
as
an
organization,
do
not
have
any
systems
to
monitoring,
then
of
course
your
security
level
is
very
low.
A
A
So
it's
very
very
important
to
have
a
strategy
about
your
audits.
What
part
of
your
your
structure
and
your
product
are,
you
actually
auditing,
and
why
are
you
doing
it?
A
lot
of
the
audits?
That's
being
done
today
are
very
retrospective,
meaning
that
it
will
tell
a
lot
about
if
your
product
has
been
unsecure
or
secure
up
until
now,
and
once
you
have
done
the
fixes,
then
you
will
actually
probably
be
outdated
within
a
few
weeks,
meaning
that
an
audit
will
probably
never
look
into
the
future.
A
A
Last
but
not
least,
it's
very
very
important,
of
course,
only
to
use
trusted
Auditors
and
it's
very
important
to
make
sure
that
you
are
aligned
with
the
Auditors
and
you
understand
what
kind
of
methods
that
they
use.
The
worst
case
scenario
is
that
the
audit
company
will
tell
you.
Well,
everything
is
okay,
we
didn't
find
anything,
but
they
don't
tell
you
how
they
they
conducted
the
audit.
They
did
not
tell
you
about
what
kind
of
blind
spots
they
may
have,
or
they
did
not
tell
you
about
the
method,
meaning
how
and
what?
A
What
areas
are
they
leaving
out
of
this?
Because
if
you
do
not
understand
the
methods
and
if
you
do
not
understand
the
blind
spot
that
it
may
leave
you
with,
you,
don't
fully
understand
the
the
risk
afterwards,
then
you
could
have
this
as
like
a
false
security
and
that's
definitely
not
good
for
anyone.
It's
not
good
for
the
Audio
company.
It's
not
good
for
the
clients
who
have
false
security
within
the
space.