<story><title>The Looting of ShapeShift</title><url>https://news.bitcoin.com/looting-fox-sabotage-shapeshift/</url></story><parent_chain><item><author>danielvf</author><text>This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker.&lt;p&gt;Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best practices guides on this?&lt;p&gt;One thing that the article showed is the importance of external security review to deal with the threat of internal incompetence or evil.</text></item></parent_chain><comment><author>illumin8</author><text>It&amp;#x27;s extremely expensive.  Many banks and companies in the finance industry (hedge funds) do this:&lt;p&gt;Hire at least 2 or 3 people for every job.  Have them watch each other whenever touching systems that connect to production or deploying code to production.  Never trust any one of them with the private keys or passwords to anything - they can only get half of a secret and their co-worker gets the other half.&lt;p&gt;To do this effectively, you have to build a zero trust environment, and rely on surveillance to ensure that nobody is a bad actor.  It really makes CIA&amp;#x2F;NSA level security look somewhat weak.&lt;p&gt;It&amp;#x27;s also very expensive, as you can imagine.</text></comment>
<story><title>The Looting of ShapeShift</title><url>https://news.bitcoin.com/looting-fox-sabotage-shapeshift/</url></story><parent_chain><item><author>danielvf</author><text>This is certainly the worst case scenario - your security officer installing remote access software on developers machines, stealing bitcoins from production, then selling the company source code, access credentials and access to the internal network to a Russian hacker.&lt;p&gt;Building a security system to handle this level of attack is a whole level beyond stopping even determined external attackers. Are there any best practices guides on this?&lt;p&gt;One thing that the article showed is the importance of external security review to deal with the threat of internal incompetence or evil.</text></item></parent_chain><comment><author>raesene9</author><text>Well the traditional banks have been dealing with exactly this kind of threat for a long time.&lt;p&gt;There&amp;#x27;s a load of practices that are designed to stop this kind of problem in that world.&lt;p&gt;Things like :-&lt;p&gt;- Enforced holidays.  Frauds are hard to maintain when you&amp;#x27;re not there to keep cooking the books.
 - Audit reviews.  an independant function with the ability and authority to review key processes
 - split authority.  Key actions need multiple people to complete (statistically fraud incidence drops a lot when you need multiple people involved)
 - Strong background checking.  When I worked at a bank they went back 10 years of employment history and required accounting for any gaps. + credit checking + criminal record checking etc.&lt;p&gt;It&amp;#x27;s all possible, just quite expensive...</text></comment>