Over the last few years we’ve been expanding our Ecosystem Support by including various Security Consulting offerings to meet the needs of the different ecosystems with which we are working. Although our main offering is still Security Audits of codebases and specifications for projects, we also offer consultation sessions, and we have now expanded into community engagement efforts. We have the capability to cover a wide spectrum of Web3 technologies and programming languages, allowing us to provide comprehensive support in this area.
As the advancements in consensus algorithms prompted the development of emerging blockchain protocols, the launch of these new networks and corresponding infrastructure has incentivized the growth of ecosystems around them. These new ecosystems include applications that interact and depend on the network protocols, along with services necessary to continue their decentralized operation. From the increase in the usage of zero-knowledge proofs to the necessity of different types of secure wallets, we’ve been engaging with these ecosystems to help them improve the security of these systems.
Our security research and consulting efforts allow us to advance the security of systems and contribute to the community of developers who build within these ecosystems. Independent security research and consulting efforts directly benefit the target of the review – whether for the advancement of the network protocol development or the projects that rely on it – and result in the advancement of these technologies and more effective management of security risks.
Additionally, when this work is performed transparently and the reports are published, it contributes to the growth of the ecosystem and the dependent communities, including other development teams, investors, and the users, thus allowing a better understanding of the security efforts and position of the technologies. While no audit is a guarantee, security reviews are far more than a mere marketing feature, and a publicly reviewable security audit will contribute to the overall health and security of a given project
For some ecosystems we support, we co-develop a security roadmap and perform security support services in alignment with the goals of the ecosystem. However, our work can also be ad hoc, too. For example, our security audits can either be comprehensive for a specification, component, or system, or timeboxed for a specific goal. The teams will jointly coordinate the auditing approach that will be followed, the areas of concern to be considered, as well as which part(s) of the project specifications or code must be prioritized for the review.
For a more flexible and expeditious option for security feedback, we offer short consultation sessions tailored to specific questions that you might have, including, but not limited to:
- Incident response investigation and remediation;
- Security-by-design guidance;
- Privacy-by-design guidance;
- Strategic planning for security goals;
- Secure development strategies;
- Management of data privacy in systems;
- Use of encryption and other cryptography-related feedback; and
- Threat modeling and adversarial analysis.
This approach works within a structured ecosystem program, such as an accelerator or grant program, with a set framework for the projects to acquire support from different sources. Each planned consultation session includes our preparation time, a meeting via video/voice call, follow-up analysis, and the creation of a short summary. Additionally, within ecosystems with a more active community, our engagement can be more dynamic and consist of regular open office hours, discussions on forums, as well as liaisons with other parties and organizations about opportunities for enhancing security. For these, we offer a flexible approach where the timeline and deliverables are dependent on the ecosystem’s current needs.
We believe that people have a fundamental right to privacy and that the use of secure solutions enables people to more freely use the internet and other connected technologies. We provide security consulting services to help others make their solutions more resistant to unauthorized access to data and unintended manipulation of the system. We support teams from the design phase through the production launch and after.
Connect with us to learn more by sending an email to consulting@leastauthority.com or schedule a call to discuss our security consulting services and how we might be able to help you.