When most people talk about security in web3, they are talking about the technical and social security for users, protecting against exploits and scams in dApps and other projects involved with crypto. For entrepreneurs in web3, however, there is another type of security needed as well: internal security.
Internal security is safeguards put in place to protect team members against costly mistakes, either by accident or by malicious actions from other team members. This is incredibly important for any business larger than one person to ensure that operations go as smoothly as possible.
We’re going to look at financial security measures first, as they have the scariest impact. At the end, we’ll briefly cover other best practices as well to help keep everything running without problems.
Financial Internal Security
Often times more than one team member needs access to company funds. This could be because different members are in charge of different projects or areas, because of different time zones/work schedules, or a multitude of other reasons. However, having multiple members with access to all of the financials of the company poses major security risks. Doubly so when most transactions involve cryptocurrency that is harder to create an audit trail for in certain circumstances.
There are several ways of handling this issue. In most businesses, any large expense must be signed off by the person ultimately responsible for that decision, often the manager or head of that department, depending on the size of the expense. Depending on the company, it is possible that any spending must be signed off by such a person. While it is often a good idea to have the heads of relevant departments (and your accounting team) looped in on any large spending decisions, there are a few additional layers we can add to further ensure that all funds are spent appropriately.
Fund Splitting
One way of limiting the damage that any one person or department can cause is to have accounts be separate. If the marketing team is only able to access the money in the marketing fund for instance, any mistakes in allocation there will not impact the other departments. They are only able to spend money in their account, and that account only has money that is intended to be used for marketing. This is called compartmentalization.
There are two major drawbacks to this approach.
1) Timeliness
Things tend to move very quickly in web3. Even if the details are set out early in the process, changes often happen shortly before funds need to be transferred. While this sometimes can be indicative of a scam, often it is just a natural part of the business process. If only a few team members are online when something needs to be changed, it can lead to delays while additional members get online to adjust that department’s funds or sign off on a transaction.
2) Complexity
The other drawback is complexity of book keeping. As more and more accounts are created, either for new departments or for individual projects, the overall complexity of financial record keeping increases. Often, each department has a large fund with different projects earmarked within that fund to prevent over-compartmentalizing. Modern record-keeping software helps tremendously with this, ensuring that each transaction has a record of which account was used and to whom it was sent.
Note: this can go the other way as well. Companies that have every transaction come from one wallet or one account can struggle to keep straight which transaction was for which project. The “right” number of accounts varies based on team preferences, company size, industry, and frequency.
Key Sharing
An unfortunately common method of giving multiple people access to funds is key sharing. This is when multiple members have access to a private key for a wallet, allowing any of those members to send and receive money, sign transactions, and make connections for that wallet. Again, this allows any of those members full access to everything in that wallet.
Most often this is used with fund splitting, so that any online member can make necessary transactions. However, this can be a dangerous practice.
The immediate threat that most people jump to is a rogue team member. This could be a disgruntled employee or somebody who decided that the funds in the wallet now belong to them. However, even if you fully trust your team members, key sharing can be a dangerous thing. As more keys are given out, it increases the number of places from which that wallet can end up with malicious tokens, more dApps the wallet might be connected to and not signed out, and less tracking. If a transaction is made and there are multiple private keys given out, it becomes very hard to track down who made that transaction, whether it was a problematic transaction or not.
Kelli Thompson wrote a great article on web3 wallet security for those looking to start learning about the subject.
Multi-signature Wallets
The solution that I think best addresses the major security concerns while remaining relatively simple is multi-signature (multi-sig) wallets. As the name suggests, these wallets require multiple people to sign off on a transaction in order for it to be approved.
I used Gnosis for most multi-sig transactions. The “master wallet(s)” are able to receive transactions without requiring anybody to be online, as usual. However, for any outgoing transactions, a certain number of authorized users must approve the transaction. The required number can be chosen by you, and can be updated by creating a new transaction (which will need the requisite number of signatures before it is approved).
With this method, you can add each appropriate team member as an authorized user, and set the number of required signatures to whatever makes sense for your business. You might require that over half the members sign, or that everybody must sign for a transaction to go through. You can also set a different number of required users for each master wallet.
One of the nicest things about this system is that each user can have their own wallet that they choose to act as their “vote”. This means that you only need one wallet that you sign into in order to act as an authorized user on as many Gnosis wallets as the company has.
Documentation and Software Access
Finally, I want to quickly touch on two other quality of life items to consider. While documenting decisions and taking meeting minutes can be cumbersome, it is also very important. In the world of web3, the environment is constantly changing. Having record of decisions (both in wallet signatures and in meetings) is useful for conflict resolution and for analysis when you encounter a new, similar problem. Document everything, whether in Notion, Google Docs, Confluence, or whatever your shared program of choice is.
Access to software is a staple of internal security in web2, and still holds true in web3. Having a list of all programs that are used for the business, and who has access to those programs on what level, simplifies things when that access needs to change, either because somebody is no longer employed there or because they need additional access to programs.
Thank you all for reading! If you have any other sources I missed, or useful tips on improving company security, drop them in the comments below. Looking forward to seeing you next month for the next edition!
English