OPSEC¶
Web3 OPSEC covers people, wallets, keys, devices, access, domains, and communications. It is a production security discipline, not a personal habit checklist.
Resources¶
| Resource | Tier | Use |
|---|---|---|
| SEAL Frameworks | Must learn | Crypto team security and response frameworks. |
| Security Alliance | Must learn | Ecosystem security coordination. |
| YubiKey Guides | Use in real audits | Phishing-resistant MFA and hardware key practices. |
| GitHub Security Hardening | Use in real audits | Repository, secret scanning, and dependency security. |
| Google Advanced Protection | Situational / advanced | High-risk account protection. |
| DigiBastion | Watchlist | Maintainer-labeled domain, DNS, and OPSEC posture resource. |
| DigiBastion Threat Intel | Use in real audits | OPSEC, supply-chain, personal-protection, and Web3 alert feed. |
Minimum Controls¶
- Phishing-resistant MFA for all admin, cloud, email, registrar, and GitHub accounts.
- Hardware wallets for treasury and admin keys.
- Multisig policies with signer separation and emergency backups.
- Access reviews for contractors, vendors, dashboards, CI/CD, and cloud accounts.
- Dedicated machines or profiles for signing and production administration.
- Predefined incident contacts and secure backup communication channels.