Nick Percoco on security at Kraken exchange

0:00I'm Ashlyn Addison from event chain for investmentpitch media and FinTech news network and today on blockchain interviews we have Nick Percoco the chief security officer of Kraken exchange Nick thanks so much for coming on the show it's a pleasure to have you here today yeah thanks for having me you're very welcome it'd be great if you could start by explaining a little bit

0:19on how you got into cryptocurrency and your role as a security officer and what attracted you to become the chief security officer of cracking yeah so I've been chief security officer of crack in for about a year and a half but prior to that I have a pretty lengthy career in security itself I started out my career in the 90s doing ethical hacking penetration testing for banks

0:44and various trading exchanges and financial firms and hospitals and things like that all over the world and founded some companies and contributed to developing some security products really all in the security space and then recently a couple years ago I got in contact with Jesse Powell and other other folks at Kraken and it became really interesting to go someplace where

1:10the challenge is much greater and the stakes are much higher than say protecting the security of a manufacturing company or a small you know local bank or something along those lines no Kraken has a global crypto exchange four million customers all over the world 200 different countries it operates and we operate 24/7 and so the opportunity to go and take the reins of

1:36security at one of the oldest and considered one the most secure crypto currency exchanges in the world was a really really new copper unique opportunity and I I jumped at the chance that's great Nick and it's cryptocurrency as a growing industry is security is super important especially because there's all this technical expertise that people you know are

1:57unfamiliar even tech people can be fooled by things that are going on in the cryptocurrency industry because it's so new and some people are just they see something and they believe something that may not be in their best interest but it there are you guys are taking with crack and a lot of great security approaches can you talk a little bit about why

2:19security is such an important area for for crypto investors in this new industry yeah certainly I think one piece that most investors when they first get into crypto or maybe even consumers when they get into crypto don't quite understand is that the possession of your private keys is is paramount many people don't understand that because they're used to the more

2:40traditional financial world where your money is basically a number in a spreadsheet someplace at a bank and in the crypto space you actually get a chance to hold on to it and have it in your hand or it exists and you can take a hundred percent possession of that well when you combine that with the number of different threats that exist to two individuals if you're someone

3:01who's very sloppy with your security say you never patched your own system you have choose weak passwords and you just are very fast and loose with your personal security when that intersects with crypto it can be a disaster if someone takes that private key or that wallet from you all of your crypto is now gone and is in the possession of those criminals totally and it is

3:24possible and it to you know hold funds on exchange where you people are holding them but they don't realize that that exchange also has access to their private keys in order to trade those coins between you know between coins they need to have access to the private keys as well so leaving coins on an exchange if that exchange is compromised then so are the private keys as well

3:46right yeah certainly and we we speak to our customers and you know our clients around the world we often talk about only leaving the crypto on an exchange or even our exchange for what you need in your trading so you know for example say you have 100 Bitcoin and you're only gonna trade with one or two Bitcoin on a regular basis well keep 98% of those or

4:0798 of those in a harbor wallet encoded in your own cold storage no place that in a safe or vault someplace and only access it and you absolutely need it that's great and that sort of leads to the next question you know what do you recommend for crypto investors to protect themselves what are the necessary precautions to take to sure that their funds are always safe

4:29yeah I mean first comes down to just you know basic personal security so if you are creating an account at an exchange make sure that you're choosing a unique username a unique password or that exchange if that exchange has the ability like crack and does to enable 2fa making sure that you're enabling two-factor authentication on your account you know avoid things like SMS

4:52two-factor authentication you know stick to things like Google Authenticator or a UV key in order to actually you know secure your account and then you turn on everything you can from a security point of view you know and pay attention to when you get an email that says what drawl is actually happening pay attention to those types of things and make sure that you're aware of what's

5:11happening within your account and then of course if you you know are gonna you know use an exchange to buy cryptocurrency don't you know don't keep it all there you'll transfer it back to something like a hardware wallet make sure you secure that hardware wallets and then keep that offline and then also pay attention to the systems and the devices that you use to access your

5:31exchange account and the hardware wallets you know it really does you no good if you have a really old computer that has been patched in three years that might be you know have a ton of different pieces of malware or botnet you know you know technology you know what sort of embedded in it and sort of infested there and now you're accessing your exchange account there's a lot of

5:50that metal or will do things like keystroke log and basically send your username password to the criminals and the next thing they do is they log into your account and try to try to expose extra trade all their all your funds from your account yeah that's great information and it just goes to show that it's not just you know make sure you have a secure password and make sure

6:09the exchange isn't compromised because if you're any of your backup emails or your 2fa as you said with the SMS I've heard of many crypto investors more than a few that have had their their phones jacked from the phone company and then once you have access to one email they use that to to slither to their way through another email and reset your password to get access to your account

6:33yeah I'm you know a big target for the criminals is either your phone and specifically your phone you know doing a sim swap where they actually call up the telco or they pay someone inside a telltale Co to swap your phone number to another sim so they can then get access to the SMS messages that would normally be going to your phone that's one that's one target for

6:56criminals and another actually more juicier target in many cases they should have email and so if you have an email account you know with whatever provider you need to make sure that you are choosing unique passwords and enabling to a PHA on those on those email accounts because as a criminal if I put on the the criminal hat if I get into your email account it's essentially the

7:17hub of your entire life and I can go and start resetting passwords approving things just from that email account and you know your your security and your financial security involves apart pretty quickly when that happens definitely well I've heard that crackin is one of the most trusted and secure exchanges around and it has been for a long time so do you guys have any you know unique

7:40value propositions on why it's so secure or you just guys have all the functions needed to protect people's funds yeah I think the big differentiator is that we don't treat security as just one small team off in the corner of an office every one of our employees goes through extensive security training personal security training security awareness and

8:02people live and breathe and act like essentially we work at a security company and so people within our company are cracking i'ts essentially are you know what we would call productive productively paranoid in in their existence within our company and so anything that looks out of the ordinary anything that you know may be suspicious or anything that may they're

8:24not Oh certain sure of in order if they're gonna do something they circle back and consulting and we my team specifically gets to be advisors to many aspects of our business where in traditional companies security just comes knocking and asking questions and maybe doesn't audit every once in a while we're very very collaborative with every department within within bracket

8:46hmm that's great to hear and maybe could elaborate on how big is your team now are you guys centrally located as well so we are not centrally located you know our company is a global company and we have people all over the world my team is no different from that um you know I you know we have 45 people today in security which is a fairly large number for a company of you know around

9:10800 employees and you know it's growing and so you know I've I've built teams in the past you know high-performing you know very very highly focused security teams in the past and it's not just security when we talk about security at crackin we have people who are experts in application security we have people who are experts in doing detection and response activities and I have experts

9:34that are that are essentially hackers right we've called our red team and they basically hack us on a regular basis and so we all wear all wear different hats with insecurity and we're all very very focused on those specific groups and those specific tasks to ensure from many many angles and many many aspects that we maintain the high level of security

9:54that work that we're known for well and you also have the Kraken security labs initiative as well what do you guys focus on on that project yeah Kraken security Labs is an initiative that we launched last year and it really stems a lot from my background you know I mentioned earlier that I was in the security industry for a number of years actually a couple of decades and I was

10:18very deep in security research for a long period of time and so when I joined Kraken I had an idea to basically launch a security research initiative that doesn't focus on our internal systems in our own devices they basically flip around and focus on the technology and devices that our clients may use so things like hardware wallets software wallets other

10:41software technology we essentially are very focused on things that intersect with the cryptocurrency community to find flaws to responsibly responsibly disclose that those flaws to the vendors collaborate with the vendors on a fix to the problem and then talk about this with the community and so essentially to raise awareness to our clients that maybe there's a flaw and something that

11:06they rely on maybe they think well hey this hardware wallet is where I should keep all of my funds it's bulletproof no one's gonna ever get me get into it and oh by the way there's a potential flaw there that does it pose you immediate danger to you and in in and bring you at risk but you need to be aware that if you perhaps maybe lose that hardware wallet a criminal doesn't

11:29just look at that and say oh there's no way I can get into it there may be a way and so you need to really understand that and understanding your threat model and a better way to protect yourself in those situations well that's super great that you guys are looking out for the community and outside of the crack and exchange as well and the interacting

11:46partners that's amazing and speaking of hardware wallets I did see that the security labs recently saw a flaw in was it the keep key wallet can you explain how that happened and is that fixed or they just brought that to the attention of the community yeah so um yeah so that's something that we we did research on we actually have an initiative right

12:06now where we're looking at many many different types of harbor walls on the key key one was just the first one that we actually did a disclosure on but there's there's more to come essentially what we wanted to find out is what would it take if a harbor wallet specifically was lost and got into the hands of an adversary or a criminal and the folks that we have within crack and security

12:29Labs went very deep very deep technical hardware hacking techniques basically trying to extract and glitch chips that are within those within that within the wallet essentially then tried to be able to you know crack a pin that's associated with it and extract the seeds and so we were successful in doing so we reported it to Kiki they were great in the responsiveness and and they are you

12:54know there's there's things that they're working on in order to learn to fix that problem because it is a hardware flaw it's a little more difficult to just put out and just put out a software patch there are some vendors we're talking to where you software fix especially in like a mobile app is the only so is the real solution obviously now you know the

13:12big piece there is you know really to raise awareness now to be able to understand as a client you know I have this device you know I have to make sure I don't lose it right and I can make sure to keep it in my possession that was the big piece that our but essentially we're doing this with lots of different hardware lost trying to find flaws I'm trying to

13:30report these to the vendors really to push the envelope I did this in the non cryptocurrency community for a number of years where various large vendors whether it's you know places like Google or Apple or Microsoft where myself and my team in a previous life when I ran spider labs we would disclose vulnerabilities all the time to those types of vendors and really try to

13:50improve security and push the envelope there you know every time we find something everybody learns we learn the vendor learns the developers of those products learn and the community learns on what not to do and ways to improve the entire ecosystem that's awesome Nick I'm glad you guys are pushing the envelope and keeping everybody else on their toes as they should be as more

14:13people start getting into crypto currency especially with you know prices rising people that aren't normally into investing or knowing how to manage funds all of a sudden start getting interested and and see cracking and come on and get some cryptocurrency and what do you think is the biggest challenge for you guys as the industry continues to grow and new people that are non-technical

14:34start getting into the industry yeah I think for us is trying to make the security you X so the security experience whether it's within our exchange or also working with the community you make it make it simpler make it just as a fact or even more effective but make it simpler for someone to use it shouldn't be chock-full of jargon it shouldn't be confusing it shouldn't be you know

14:56broken screens and buggy you know when you're trying to you know load the crib you know send the crypto to your your own wallet and it shouldn't be error proof right that's a big challenge right being able to go through and make that very very clean and simple and as effective or even more effective than what we see today for the everyday user I think is the real challenge and us and

15:19many other companies are making strides in that way but there's there's a lot of work to do yeah well I'm a bit of a techie myself but the user experience for me on Kraken has been great so far so it looks like you guys are doing a great job and keep that up and we're running out of time for the inner but how can the viewers learn more information or follow along with the

15:39security labs or just learn more about Kraken sure I'll obviously learn more about Kraken at Kraken comm you can follow along what we have going on within our security labs we do blog posts every couple of weeks and that's blog Kraken calm and of course you can follow us on Twitter as well so it's Kraken Kraken FX is the is the handle for us on Twitter great I'll

16:01leave those links in the description box below thank you so much for your time Nick it's been a pleasure speaking with you and let's follow up in the near future yeah thanks for having me