Please describe your proposed solution.
Cyber-resilience is an increasingly important factor in the selection of digital services provided through a number of different methods (e.g. cloud or blockchain). Whilst resistance is at the core of the consensus model of Cardano, this is not protecting the underpinning infrastructure of the blockchain from technical vulnerabilities. Blockchains, which can demonstrate that they are taking also the technical resistance of the blockchain seriously, which have an advantage when it comes to the selection of solutions by commercial and industrial customers.
Problem
Currently, there is no existing service provided to the SPO community, which is scanning the technical infrastructure of the blockchain relays and block-producing nodes in a systematic manner. Cybersecurity is the wholesome responsibility of the SPO, without any professional help provided.
Solution
We will implement an independent vulnerability scanning and detection service (cardascan.io) for all SPOs. This service will be offering two different levels of assurance:
- Through frequent black-box scans of the infrastructure used by SPO, we will identify the current protection state of the relay and block-producing infrastructure and inform the relevant SPO about the existing vulnerabilities and areas of improvement (best practices).
- To increase resilience, we will offer a subscription-based advanced deep vulnerability scanning service accompanied by cybersecurity consulting. This service is not part of this proposal.
To create transparency, we will (after a grace period) inform the community via our website about SPO environments, which show vulnerabilities and where SPOs are not addressing these findings. During the grace period, we will work to our best ability with the SPO to address the identified vulnerabilities. The technical patching will remain the responsibility of the relevant SPO.
The value of this solution can be seen as follows:
Efficiency - providing a scanning solution centrally from within the community is a lot more resource-efficient, than a solution, which has to be performed by the SPO. The identification of issues at scale is just possible through a central solution.
Cost - providing a vulnerability scanning solution for just a number of servers is not cost-sensitive and requires an unproportionate effort. Scale effects make the service very cost-efficient once implemented.
Transparency - whilst SPO would be able to perform vulnerability scans themselves, it's natural that they would not make any detected vulnerabilities transparent, nor could it be assured that the relevant server would be patched. Through the disclosure after a grace period, we will keep the delegators informed about “underperforming” SPOs.
How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?
cardascan.io is bringing for the first time a transparent and independent vulnerability scanning solution to Cardano. The community will get an inside into the overall performance of the underpinning infrastructure of the blockchain and has the ability to identify SPOs, which are not performing to the general expectation of the delegator community.
Furthermore, will this new level of transparency create trust and assurance for business and industrial users of Cardano and thereby differentiate Cardano from other blockchains and those monitoring activities.
What is cardascan.io benefit?
cardascan.io brings a number of benefits, like:
- Assurance of blockchain users - the provided transparency through statistics and disclosure of ‘underperforming’ SPO create a new level of assurance to delegators
- Meeting expectations of commercial and industrial users – it is common practice to require vulnerability scanning of the infrastructure of a service provider in the commercial and/or industrial environment.
- Pathway to certifications – infrastructure providers of cloud environments commonly provide assurance through international certifications (e.g. ISO 27001 or SOC II) for the cybersecurity of their environments. While this is not common practice for distributed blockchains yet, providing assurance through vulnerability management is a first step in this direction.
How do you intend to measure the success of your project?
The success of the project can be easily measured - through statistics we will prove at least the following:
Quantitative measures:
- Reduction of the overall number of vulnerabilities detected in the Cardano infrastructure
- Number of detected vulnerabilities mitigated (measured through repeated scans of the infrastructure)
- Number of patch vulnerabilities within 30 days
- Number of SPO, who a proactively engaging in the remediation of vulnerabilities.
Qualitative measures:
- Reduction of the number of vulnerabilities with a high CVSS rating
- Feedback from the SPO community
- Feedback from the delegator community
Please describe your plans to share the outputs and results of your project?
Due to the nature of the topic, we will not share any results of the vulnerability scanning itself, but the following output will be shared, e.g. on Twitter Spaces or similar:
-
Statistics about e.g. :
-
the number of involved SPO (incl. disclosure of scanned SPOs/coverage of total SPO identified estate)
-
the scanning performance (number of relays/nodes scanned within a specific period)
-
the number of detected vulnerabilities (details about type and counts)
-
the number of SPOs, who did not patch within 30 days
-
the number of SPOs, who did not patch within the grace period
-
Disclosure of:
-
SPOs/stake pools, which were not patched during the grace period
-
Number of vulnerabilities according to CVSS rating
To protect the individual SPO, we will NOT disclose the actual vulnerability. Furthermore, a discussion, about how long the grace period should be is ongoing.