14

If you wanted to assess the security of an online wallet service such as a bitcoin bank or ewallet, what would expect to see addressed?

Obviously SSL connections, but what about authentication, authorization, protection of staff from rubber hose attacks and so on?

Improve this question

2 Answers 2

Reset to default
7

It would be impractical to list every single expectation here, but the TradeHill exchange sets themselves up for PCI compliance. I think being PCI compliant is a great set of standards to keep your data safe and secure.

PCI compliance is basically security standards setup by the PCI Security Standards Concil for merchants who accept credit cards, online or offline. They have 4 sets of levels of PCI compliance, which I believe TradeHill to abide to the first level (at the bottom).

Common sense comes into play when storing Bitcoins. Keep a small percentage of them online for immediate usage, when your hot storage gets empty, fill it back up with funds stored offline. Keep multiple secure backups of your wallet files, so a 'bitomat' doesn't happen.

I don't think there is anything to protect a staff member from rubber hose attacks, but limiting the access of your staff members so that the information is accessed on a need-to-know basis through someone like you would help prevent sensitive data leaking. If they're attacking you, then you're fucked.

Improve this answer
2
  • +1 for a good answer - I like the idea of having a PCI compliant expectation
    – Gary
    Sep 3, 2011 at 16:52
  • 1
    Depending on the services rendered it may be more appropriate to go for PA-DSS (formerly PABP) compliance, which is similar to PCI but with a few different points. In either case, PCI or PA-DSS guidelines should be considered the minimum necessary amount of security - barely meeting either standard should not be considered acceptable.
    – David Perry
    Sep 7, 2011 at 3:46
2

From a consumer standpoint, PCI compliance is a useful hurdle to expect companies to meet, as it helps ensure that some amount of due diligence has been applied to security.

But note that from the standpoint of a savvy IT department, there are times that PCI can get in the way. E.g., potentially faced with a less-skilled PCI assessor without as much understanding of the technology, sometimes PCI can lead the team on a wild goose chase, or perhaps give management an excuse to under-invest in security, feeling they only have to satisfy the assessor. See e.g. Does PCI compliance really reduce risk and improve security? - IT Security - Stack Exchange

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.