SmartState blog

February 8, 2023

NFT Security. How to protect?

NFT is not a completely secure technology and is vulnerable to malicious activities. Thus, users are searching for ways to protect their property. Phishing attacks and fake NFT makers appear all the time, hackers try to break in and steal improperly stored NFTs, and when the safety rules are ignored, these attempts often end up successful. What actions should be taken to reach a sufficient level of security?Ways of protectionThere is a list ...

Read more
January 30, 2023

What is Appchain

An Appchain (application-specific blockchain) is a type of blockchain dedicated to only one certain application (or a specific set of applications). They serve as subnets in such ecosystems as Polygon or Avalanche. Initially Appchains were defined as single-use (single application) blockchains, as opposed to multi-app ones, such as Ethereum.Appchains provide developers with freedom in forming new eco-systems, control architecture and ...

Read more
January 23, 2023

NFT Security. What to take care of

As any asset on the web, NFTs need the best possible security for the buyers to trust them, while, as is, they are not very secure. There are always ones who would try to put their hands on some else’s possessions. NFTs are stolen from time to time by shrewd hackers (like in the Nifty Gateway hack in 2021) or taken over by scammers (like the notorious situation with Coinbase). Tokens are not 100 percent secure. What threats waylay ...

Read more
January 18, 2023

What is SQUARE?

Security Quality Requirements Engineering (SQUARE) was created by the experts from Carnegie Mellon University and the Software Engineering Institute (SEI). This process offers a means for eliciting, categorizing and prioritizing security requirements for systems and applications. It aims at integrating security considerations at the earliest stages of the development process. It helps to document and analyze all security aspects and advise ...

Read more
January 13, 2023

Importance of decentralization in Web3. Centralization vs Decentralization. Comparison.

Centralization and decentralization are two antipodes, which are, however, both popular among the users and the developers in the web3 environment. They are not usually adopted exclusively, both have their strong and weak points and, in their way, both may be vulnerable to possible intrusion or other issues. What is the difference between centralized and decentralized systems and why users and developers make choices in favor of this or ...

Read more
January 9, 2023

CVSS Threat Modeling Method

CVSS (Common Vulnerability Scoring system) is used to rate vulnerabilities by a numeral severity score. It was created in the beginning of the century by NIST (National Institute of Standard and Technology) and maintained by FIRST (Forum of Incident Response and Security Teams), supported by CVSS Special Interest Group. It provides a common standardized scoring system for various cyber and cyber-physical platforms. It is often used along ...

Read more
January 5, 2023

Gray box testing method

‘Gray box’ testing (Translucent testing) is somewhat in between ‘Blackbox’ and ‘White box’, and implies deep knowledge of the tested application’s architecture, design and purpose, which is, however, not necessarily complete or up to date.. Gray box testing may be performed by either a third party or the developers themselves. The idea is to combine the best of Black and White box security testing ...

Read more
December 23, 2022

Blockchain Security Audit

A Blockchain audit is a code review of a blockchain development project which can be carried out only manually. This process involves extensive use of static code analysis tools, but the majority of the work consists of searching for bugs and vulnerabilities relying primarily on the experts.Why is it needed?Blockchain is a very secure technology by itself, still, errors, loopholes or vulnerabilities are possible. Security assessment of a ...

Read more
December 19, 2022

What is STO?

Security through Obscurity (STO) is the reliance on secrecy and confusing attackers instead of building proper controls to keep them out. It is based on secluding important data. It provides protection from attacks, but it is not a panacea. Hackers and bots can try to exploit the user’s plugins in order to access the system. If plugins' and themes’ names are hidden deep on the server inside a ‘.htaccess’ file, it ...

Read more
December 16, 2022

OCTAVE Threat Modeling method

OCTAVE (Operational Critical Threat, Asset and Vulnerability Evaluation) is a risk-based strategic assessment and planning method. It was developed in the beginning of the century by CERT (Computer Emergency Response Team). It focuses on evaluating organizational risks without addressing technological ones and its main aspects are: operational risk, security practices and technology. Its specifics concern the fact that all the analysis is ...

Read more