[Music]
hey how are you guys how's everything
well today I I had a workshop but they
but they told me okay you don't have an
hour you have five minutes so I'll make
it brief and I'll go to the conclusions
well I'm Pablo SAA I do we three
operational security uh at OBC where we
train and AIT companies for everything
that is not smart contract and I am a
contributor of c911 where we do incident
response for
blockchain so what are we going to talk
about today simple things that we can do
to enhance our obsc right so one thing
that is very important to know is that
it's not so important if I use Windows
or Mac Android or iPhone Chrome or
Safari or whatever the important thing
is how we configure the tools that we
use right so first thing I want to check
about very fast two Factor
Authentication
things that you not have to do do it
with SMS and we cannot do it anymore
with top apps like go like Google
Authenticator or AI those kind of tfas
can be fished and they're being fished
every day we need to use UV keys right
but not the UV key with the normal OTP
mode UV key with F2 that cannot be
fished this is happening a lot in the EO
system next SOA engineering we have to
be very very very careful for this
like professionals hack people not
systems right today is much cheaper to
attack someone and much easier than to
attack a system so be very careful with
suppose recruiters busy fans investor
and journalist that want to invite you
to some call or something never download
anything be very careful with PDFs that
you open they are usually infected and
if someone looks if something looks like
strange it's probably it's probably an
scam right and everything is an scam
until proven otherwise
everything next eventually all of us
will get hacked that will happen it's
not a matter of it will happen or not
it's just a matter of time so we need to
be able to contain the damage so that
you know when someone in your team has
been hacked the damage will be contained
even the founders even the ciso even the
CTO everyone use an antivirus and a
firewall people think that no I use a
Mac I don't need an antivirus use an
antivirus MacBook is not uh do the buers
alone there's a good foundation called
Objective C that has many tools for
security in Mac one more thing the
attack will come from a trusted Source
right for example we saw how they were
hacking the even brights of the events
at Devcon one hour before the event and
they send a message from the real
account to everyone hey you have to me
this nft you minted your wallet is
drained
completely uh you receive an email that
says that it's from treas and it's
really from treaser from the official
system but it has been hacked they send
you a drainer you are
done one more thing use a password
manager and never never ever reuse a
password right but let's use password
managers and we have to have to have
them configured very securely but never
ever ever and this is very important
very important never put a seed phrase
in a password manager right for sure
many of you have done it yeah and you
say oh we did it but it's okay my my
password manager is secure no it's not
if you have ever put a SE phrase in a
password manager you cannot use that
wallet anymore you have to move to a new
one use Hardware wallets hardare wallets
are
important many will think okay this
things that this guy are telling us are
very basic this basic stuff is the
reason why today 85% of lost of lost
funds uh are the are lost every day
right in blockchain is not anymore due
to Smart contracts we have gotten very
very good at security with with smart
contracts uh and money is being stolen
like this so you have to be really
really careful well I hope you you liked
it I will be here if you want to talk
more about this like this was a very
very very small uh resume but um
operational
security is important is the number one
reason H how uh we are being attacked by
very sophisticated third actors
something that is happening is that in
the industry we have one of the worst
obss in all the industries worldwide
because we don't have regulations so any
company does whatever they think that
it's okay and it's not and on the other
side we have very very sophisticated
threat actors from nation states that
are doing this kind of attacks and they
know what they're doing so be extra
extra careful I hope you like
it thank you
Pablo any questions for Pablo
yep oh there do you want to give a go
cuz it's on your side uh do you want to
throw I had to throw it there
okay oh sorry you're much better than
me um so what would you recommend to
people to store their seed phrases
securely because I think the challenge
is I mean I'm a CTO as well uh you you
either have to make it secure or if you
you you want to prevent people writing
it down on a post right so what I think
that writing down SE phrases is one of
the best ways to store them one hack
that you can use that is very very
simple was sold to me by one of the guys
from the red Guild is buying
anti-tampering bags the ones that
eCommerce use so you write it there and
wherever it is that you you save it you
save it with that so with that you are
sure that it has never been seen by
anyone if sometime it was seen by
someone they have to break that so
that's another very good way and I
really like Shamir like having your your
SE phrase and cutting it in places in
three lists but you only you need two of
those three lists that gives you
confidentiality and availability so I
think that's pretty good thank
you do we see any other questions oh
over there there was one question
y all right I actually wrote down my
question uh how do you choose a product
for Secrets like SSH Keys o tokens Etc
management across multiple Cloud
providers H so a product for what sorry
a product for Secrets management like
SSH Keys oo tokens across multiple Cloud
providers uh I don't have a good answer
for that so I'm not uh I'm not sure what
would I use
um the guys that are really because I
only talk about stuff I'm really really
good at right and the guys from the red
had a very good guide on on on that so
they will be maybe able to ask a
question far farther thank you than me
no thank
you okay
uh what do you think what is the most
secure U multiseq wallet or Hardware
wallet no I think that safe is good and
regarding hard wallets I consider that
all of them are also very good treas or
Ledger safe pal the think it's how you
use them right but I I think that all of
them are are very good and I think that
safe is also very very
good yeah there's a question over
there
okay all right uh you covered a lot of
stuff there but uh is there any uh
advice you give on browsers or how you
deal with browsers and that's generally
where a lot of Steelers are sitting or
what yeah yeah browsers be very very
careful with the extensions you download
like we have to be very very careful
with extensions there are lots of
malicious extensions and the other good
practice is to have more than one
session for example you use Chrome you
have five sessions one for work one one
for Def One for personal stuff one for
this for that for that and you also can
have an our rowers right uh or even
better than that is having an hour
session in a BBN right so you have it h
sorry in a virtual machine so you have
another virtual machine with another
browser if you want to keep it like
really separate and that's also pretty
good okay thank thank you very much