Ecosystem security

(Section: Ecosystem and Network)

1) Goals and principles

The goal is to ensure the confidentiality, integrity, and availability (CIA) of services and data while scaling the ecosystem and evolving protocols.

• Zero-Trust by design: distrust networks/hosts, check each action by context.
• Least Privilege (PoLP) and need-to-know: access is minimal and measurable.
• Cryptographic assurance: signatures/attestations/anchors instead of "default trust."
• Observation by default: security signals are built into protocols.
• Defense-in-Depth: layered protection (identichnost→set→dannyye→vypusk).
• Secure-by-default: "closed" by default, explicit allow lists.

2) Threat model (High-level)

Network and perimeter: DoS/L7 floods, BGP/Anycast abuse, MITM, DNS spoofing.
Identities and keys: key compromise, vulnerable tokens, signature retry.
Data: PII exfiltration, telemetry leak, metadata manipulation.
Supply chain: malicious dependencies/builds, artifact substitution, vulnerable SDKs.
Protocols/bridges: reorgs, fake proofs, DA delays, replay cross-chain messages.
Internal risks: errors of configs, excessive rights, weak processes of deprecate.

3) Identities and trust

Identities: 'org _ id', 'peer _ id', service accounts, users.
Authentication: mTLS (X.509), OAuth2/OIDC (short-lived JWT, DPoP/PoP), WebAuthn for people.
Authorization: multilevel RBAC/ABAC + policy-as-code (OPA/Rego).
Capability negotiation when shaking hands: declaring versions, QoS, limits and allowed domains.

Policy (YAML)

yaml authz:
roles:
operator. p0: [payouts:write, events:subscribe, bridge:finalize]
reader. api: [rpc:read, catalog:read]
abac:
- when: {org_tier: "gold", region: "eu"}
allow: [qos:P0, data_class:P1]
tokens:
ttl_s: 900 rotation: "7d"

4) Network security and transportation

Шлюзы/edge: WAF, L7-rate-limit, circuit-breaker, outlier-ejection.
Traffic encryption: TLS1. 3/mTLS, PFS, strict ciphers, QUIC/HTTP/3.
Isolation: segmentation of environments (prod/stage/dev), private grids, egress control, eBPF firewall.
P2P: message signatures, anti-replay windows, peer control (allow/deny), gossip limits.

Example of Network Rules

yaml network:
ingress:
allow: ["443/tcp","443/udp"]     # HTTPS/HTTP3 deny: [""]
egress:
allow_domains: [".trusted. psp",".oracle","crl. ocsp."]
waf:
block: ["sql-injection","xss","proto-smuggling"]
dos:
rps_per_ip: 200 burst: 400

5) Data protection

Data classes: P0 (payment/keys), P1 (operational), P2 (log/diagnostics).
Encryption: at-rest (AES-GCM/ChaCha20-Poly1305), per-region/tenant keys, HSM/KMS, envelope encryption.
PII tokenization and pseudonymization; PII ban in telemetry/labels.
Residency: regional volts and object warehouses, export whitelists.
Integrity: hash addressing of artifacts, journal merclization.

Storage Policy Catalog (SQL)

sql
CREATE TABLE data_policies(
data_class TEXT, region TEXT, residency TEXT, kms_key TEXT, retention_days INT,
pii BOOLEAN, export_whitelist TEXT[]
);

6) Manage secrets and keys

Generation in HSM/KMS, rotation on schedule and event (compromise/dismissal).
Separation of powers (SoD) and M-of-N for critical operations.
Secrets only in the secret manager (not in environment variables/repositories).
Key pinning for inter-service mTLS, OCSP-stapling/CRL.

Key Policy

yaml keys:
rotation_days: 30 pinning: true revoke_on:
- "suspicious_use"
- "employee_exit"
audit_required: ["signing_keys","bridge_keys"]

7) Secure supply chain (SLSA approach)

Provenance: signatures of artifacts (sigstore/cosign), SBOM, assembly attestation.
Assembly isolation: hermetic builds, reproducibility, scan dependencies (SCA).
Release policy: canary/blue-green, SLO gates, kill-switch, hash rollbacks.
SDK/client: CSP/Referrer-Policy, integrity attributes, anti-tamper.

yaml supply_chain:
require_sbom: true attestations: ["build","test","scan"]
deploy:
strategy: "canary"
gates: { error_rate_pct: 0. 4, tti_p95_ms: 2500 }

8) Accesses and privileges

RBAC/ABAC - Role/Attribute Rights, Temporary Escalations (JITs)

Services: read/write/admin delimitation, prohibition of wildcard rights.
Operators: break-glass access by multifactor, with session recording.
Audit: unchanged logs (append-only), correlation 'request _ id/trace _ id'.

Role/Rights Register (SQL)

sql
CREATE TABLE roles(name TEXT PRIMARY KEY, description TEXT);
CREATE TABLE permissions(role TEXT, resource TEXT, action TEXT, PRIMARY KEY(role,resource,action));

9) Observability, SLI/SLO and safety signals

• AuthN/AuthZ Success%, Anomalous Deny%;
• Key/Cert Drift (expiry/nonconformance);
• Integrity Violations (signatures, CSP);
• Abuse Signals: rate-limit hits, DoS/scan events;
• Data Residency Violations;
• Error Budget Burn по P0.

• Auth p95 ≤ 200 мс, Success ≥ 99. 95%;
• Signed events ≥ 99. 9%;
• Violation CSP ≤ 0. 05% hits;
• Residence violations = 0.

Дашборды: Security Posture, Keys & Certs, Supply Chain, Abuse/DoS, Residency & DLP.

10) Incident Response (IR) and SOAR

Readiness: runbook 'and on P0/P1, responsible 24 × 7, communication channels.
Detection: signatures/behavioral rules, correlation in SIEM, SOAR automation.
Containment: token/key block, deny route list, quarantine topics.
Eradication/recovery: rotations, patches, reassembly, recovery from snapshots.
Post-mortem: within 72 hours, action sites, policy/test updates.

SOAR rules (example)

yaml soar:
playbooks:
key_compromise:
trigger: ["anomalous_sign","suspicious_kid"]
actions: ["revoke_key","rotate","notify_owners","enable_strict_mode"]

11) Compliance and Residency

Regulatory requirements: data storage/deletion (DSR), reporting, RNG/cryptography certification.
Residence: per-region keys and volts, export by white lists.
Processes: regular audits, change log, timelock for critical policies.

yaml residency:
eu: { pii: "tokenized", export: ["anonymized_metrics"] }
uk: { pii: "tokenized", export: [] }
compliance:
dsr:
erase_sla_days: 30 export_sla_days: 30

12) DR/BCP and robustness

RPO/RTO targets: P0 services - RPO ≤ 5 min, RTO ≤ 15 min.
Geo-replication: asset-liability/asset-asset, periodic recovery tests.
Isolated mode: finalized-only, cache-only, limitation of "expensive" operations.
Backup channels: independent IX/providers, encrypted interregional tunnels.

DR Policy

yaml dr:
rpo_min: 5 rto_min: 15 exercises: ["quarterly-failover","annual-blackhole"]

13) Safety metrics and testing

Chaos-security: тесты MITM/DNS-poison/packet-loss/latency.
Red/Blue Team: phishing scenarios, token hijacking, supply-chain injections.
Tabletop-drills: decision-making and communications modeling.
Autotests: SAST/DAST/IAST, fuzzing protocols, policy linters.

14) Incident playbooks

A. Member Key Compromise

1. 'revoke _ key' → 'rotate' → update the trusted registry;

2. enable strict-mode signatures; 3) replay critical batches; 4) report to partners.

B. Violation of residency

1. Immediate export block; 2) redaction/deletion; 3) notify DPO/Compliance; 4) update tests.

C. Supply-chain injection

1. Hash rollback, kill-switch; 2) validate SBOM/attestation; 3) rotation of CI tokens; 4) post-mortem.

D. Mass DoS/L7 flood

1. Activation of enhanced rate limits/WAF; 2) Anycast-drebling; 3) P0 prioritization; 4) communication with providers.

E. Drift policies/contracts

1. Enable deny for incompatible schemas; 2) release of adapters; 3) update linters/registers.

15) Implementation checklist (by steps)

1. Enter the identity model (org/peer/service/user) and mTLS + OIDC.
2. Describe policy-as-code (RBAC/ABAC), PoLP, and JIT escalation.
3. Encrypt data "on the go" and "at rest," tokenize PII, configure residency.
4. Enable Supply-chain protection: artifact signatures, SBOM, attestation, canary + kill-switch.
5. Set up WAF/Rate-limits/DoS guards and egress control.
6. Raise SIEM/SOAR, describe SLI/SLO, alerts and Security dashboards.
7. Regulate key/cert rotations and break-glass accesses.
8. Work out DR/BCP and isolated modes, conduct exercises.
9. Organize auditing/logging and regular post-mortems.
10. Review policies quarterly, automate audits.

16) Glossary

Zero-Trust is a model where each action is checked regardless of location.
PoLP is the principle of minimum necessary rights.
Policy-as-Code - access control/rules through declarative policies.
SLSA - software supply chain security levels.
RPO/RTO - Data loss/recovery time targets.
DPoP/PoP - binding a token to a specific TLS channel/client.
Strict-mode - a mode that prohibits inappropriate schemes/signatures.

Bottom line: ecosystem security is not a "firewall and TLS," but a fusion of cryptographic trust, strict access policies, observability, and operational discipline. Following Zero-Trust, PoLP, supply-chain controls, and measurable SLOs turns security into a managed engineering practice that resists disruption, attack, and regulatory change.