SmartState blog

January 30, 2023

What is Appchain

An Appchain (application-specific blockchain) is a type of blockchain dedicated to only one certain application (or a specific set of applications). They serve as subnets in such ecosystems as Polygon or Avalanche. Initially Appchains were defined as single-use (single application) blockchains, as opposed to multi-app ones, such as Ethereum.Appchains provide developers with freedom in forming new eco-systems, control architecture and ...

Read more
January 23, 2023

NFT Security. What to take care of

As any asset on the web, NFTs need the best possible security for the buyers to trust them, while, as is, they are not very secure. There are always ones who would try to put their hands on some else’s possessions. NFTs are stolen from time to time by shrewd hackers (like in the Nifty Gateway hack in 2021) or taken over by scammers (like the notorious situation with Coinbase). Tokens are not 100 percent secure. What threats waylay ...

Read more
January 18, 2023

What is SQUARE?

Security Quality Requirements Engineering (SQUARE) was created by the experts from Carnegie Mellon University and the Software Engineering Institute (SEI). This process offers a means for eliciting, categorizing and prioritizing security requirements for systems and applications. It aims at integrating security considerations at the earliest stages of the development process. It helps to document and analyze all security aspects and advise ...

Read more
January 13, 2023

Importance of decentralization in Web3. Centralization vs Decentralization. Comparison.

Centralization and decentralization are two antipodes, which are, however, both popular among the users and the developers in the web3 environment. They are not usually adopted exclusively, both have their strong and weak points and, in their way, both may be vulnerable to possible intrusion or other issues. What is the difference between centralized and decentralized systems and why users and developers make choices in favor of this or ...

Read more
January 9, 2023

CVSS Threat Modeling Method

CVSS (Common Vulnerability Scoring system) is used to rate vulnerabilities by a numeral severity score. It was created in the beginning of the century by NIST (National Institute of Standard and Technology) and maintained by FIRST (Forum of Incident Response and Security Teams), supported by CVSS Special Interest Group. It provides a common standardized scoring system for various cyber and cyber-physical platforms. It is often used along ...

Read more
January 5, 2023

Gray box testing method

‘Gray box’ testing (Translucent testing) is somewhat in between ‘Blackbox’ and ‘White box’, and implies deep knowledge of the tested application’s architecture, design and purpose, which is, however, not necessarily complete or up to date.. Gray box testing may be performed by either a third party or the developers themselves. The idea is to combine the best of Black and White box security testing ...

Read more
December 23, 2022

Blockchain Security Audit

A Blockchain audit is a code review of a blockchain development project which can be carried out only manually. This process involves extensive use of static code analysis tools, but the majority of the work consists of searching for bugs and vulnerabilities relying primarily on the experts.Why is it needed?Blockchain is a very secure technology by itself, still, errors, loopholes or vulnerabilities are possible. Security assessment of a ...

Read more
December 19, 2022

What is STO?

Security through Obscurity (STO) is the reliance on secrecy and confusing attackers instead of building proper controls to keep them out. It is based on secluding important data. It provides protection from attacks, but it is not a panacea. Hackers and bots can try to exploit the user’s plugins in order to access the system. If plugins' and themes’ names are hidden deep on the server inside a ‘.htaccess’ file, it ...

Read more
December 16, 2022

OCTAVE Threat Modeling method

OCTAVE (Operational Critical Threat, Asset and Vulnerability Evaluation) is a risk-based strategic assessment and planning method. It was developed in the beginning of the century by CERT (Computer Emergency Response Team). It focuses on evaluating organizational risks without addressing technological ones and its main aspects are: operational risk, security practices and technology. Its specifics concern the fact that all the analysis is ...

Read more
December 13, 2022

What is the Attack Trees Threat modeling method

Attack tree (threat tree) is a graphical formalism used to structure, model and analyze potential attacks. It starts with a security threat, modeled as its root, representing the attacker's top level goal. It divides into subgoals through logical gates, modeling how successful the attack steps may be. Basic attack steps are presented as leaves on the tree. It includes so-called ‘and-gates’ (when the attacker has to deliver ...

Read more