Skip to content

Commit 8beaa71

Browse files
authored
Chore: making Monitoring, DevSecOps, Supply Chain, AI Security and Incident Management additions visible on .org (#437)
* making Monitoring, DevSecOps, Supply Chain, AI Security and Incident Management new additions visible on the org site * chore: order the domains in alphabetical order
1 parent 02c108f commit 8beaa71

File tree

2 files changed

+358
-379
lines changed

2 files changed

+358
-379
lines changed

docs/pages/intro/overview-of-each-framework.mdx

Lines changed: 101 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,12 @@ import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter, Dev
2323
This document provides an overview of the various frameworks covered in the Security Frameworks by SEAL. Each framework
2424
addresses a specific aspect of Web3 security, providing best practices and guidelines to help secure your projects.
2525

26-
## Community Management
26+
## AI Security
2727

28-
This framework explores best practices for securing and managing online communities associated with Web3 projects,
29-
covering platforms like Discord, Twitter, Telegram, and Google. It focuses on establishing secure communication channels
30-
and community guidelines.
28+
This framework covers emerging AI-native security risks and controls, including prompt injection defenses, runtime
29+
execution-path enforcement, and sandboxing strategies for agentic systems.
3130

32-
[Go to the Community Management framework →](/community-management/overview)
31+
[Explore the AI Security framework →](/ai-security/overview)
3332

3433
## Awareness
3534

@@ -38,63 +37,53 @@ understanding threat vectors, cultivating a security-aware mindset, and staying
3837

3938
[Read more about the Awareness framework →](/awareness/overview)
4039

41-
## Operational Security (OpSec)
42-
43-
This comprehensive framework addresses day-to-day security practices for Web3 teams, covering fundamentals, governance,
44-
risk management, control domains, lifecycle management, monitoring, incident response, and continuous improvement.
45-
46-
[Explore the OpSec framework →](/opsec/overview)
47-
48-
## Wallet Security
40+
## Community Management
4941

50-
This section delves into the crucial aspect of managing cryptographic keys in Web3 projects, discussing various wallet
51-
types (cold vs hot, custodial vs non-custodial), hardware wallets, signing schemes, and software wallets.
42+
This framework explores best practices for securing and managing online communities associated with Web3 projects,
43+
covering platforms like Discord, Twitter, Telegram, and Google. It focuses on establishing secure communication channels
44+
and community guidelines.
5245

53-
[Go to the Wallet Security framework →](/wallet-security/overview)
46+
[Go to the Community Management framework →](/community-management/overview)
5447

55-
## Multisig for Protocols
48+
## DevSecOps
5649

57-
This comprehensive framework provides security guidelines for managing multisig wallets in protocols, covering
58-
planning and classification, setup and configuration, signer onboarding, hardware wallet setup, transaction
59-
verification, emergency procedures, and incident reporting.
50+
This framework focuses on integrating security practices into the development and operations processes, covering code
51+
signing, CI/CD, IDE security, repository hardening, and security testing.
6052

61-
[Read more about the Multisig for Protocols framework →](/multisig-for-protocols/overview)
53+
[Explore the DevSecOps framework →](/devsecops/overview)
6254

63-
## External Security Reviews
55+
## Insider Threats (DPRK IT Workers)
6456

65-
This framework provides guidance on conducting and preparing for external security audits and reviews, including setting
66-
expectations, preparation, security policies, and vendor selection.
57+
This framework addresses the organizational and personal risks related to insider threats, most commonly associated with
58+
North Korean hacker-freelancers. It covers identifying, recognizing, and mitigating risks from insider threat actors,
59+
including hardening hiring processes and organizational defenses.
6760

68-
[Explore the External Security Reviews framework →](/external-security-reviews/overview)
61+
[Go to the DPRK IT Workers framework →](/dprk-it-workers/overview)
6962

7063
<DevOnly>
7164

72-
## Vulnerability Disclosure
65+
## Encryption
7366

74-
This section discusses best practices for handling and disclosing vulnerabilities in Web3 projects, including
75-
establishing security contacts and managing bug bounty programs.
67+
This comprehensive section covers various encryption methods and their applications in protecting data, including cloud
68+
data encryption, communication encryption, database encryption, and various types of storage encryption.
7669

77-
[Go to the Vulnerability Disclosure framework →](/vulnerability-disclosure/overview)
70+
[Explore the Encryption framework →](/encryption/overview)
7871

7972
</DevOnly>
8073

81-
## Infrastructure
82-
83-
This section covers the fundamental aspects of securing the underlying infrastructure of Web3 projects, including asset
84-
inventory, cloud infrastructure, DDoS protection, DNS security, IAM, network security, and zero-trust principles.
85-
86-
[Read more about the Infrastructure framework →](/infrastructure/overview)
74+
## ENS
8775

88-
<DevOnly>
76+
This section covers Ethereum Name Service security considerations, including data integrity, cross-chain compatibility,
77+
smart contract integration, interface compliance, and name handling.
8978

90-
## Monitoring
79+
[Go to the ENS framework →](/ens/overview)
9180

92-
This framework discusses the importance of continuous monitoring in Web3 projects, focusing on setting up effective
93-
monitoring systems and defining appropriate thresholds for alerts.
81+
## External Security Reviews
9482

95-
[Explore the Monitoring framework →](/monitoring/overview)
83+
This framework provides guidance on conducting and preparing for external security audits and reviews, including setting
84+
expectations, preparation, security policies, and vendor selection.
9685

97-
</DevOnly>
86+
[Explore the External Security Reviews framework →](/external-security-reviews/overview)
9887

9988
<DevOnly>
10089

@@ -107,32 +96,6 @@ web and mobile application security, common vulnerabilities, and security tools.
10796

10897
</DevOnly>
10998

110-
## Incident Management
111-
112-
This section outlines protocols for handling security incidents, including communication strategies, detection and
113-
response procedures, lessons learned, and playbooks, including specific guidelines for SEAL 911 War Room.
114-
115-
[Read more about the Incident Management framework →](/incident-management/overview)
116-
117-
<DevOnly>
118-
119-
## Threat Modeling
120-
121-
This framework provides guidance on creating and maintaining threat models, as well as identifying and mitigating
122-
potential threats to Web3 projects.
123-
124-
[Explore the Threat Modeling framework →](/threat-modeling/overview)
125-
126-
</DevOnly>
127-
128-
## Insider Threats (DPRK IT Workers)
129-
130-
This framework addresses the organizational and personal risks related to insider threats, most commonly associated with
131-
North Korean hacker-freelancers. It covers identifying, recognizing, and mitigating risks from insider threat actors,
132-
including hardening hiring processes and organizational defenses.
133-
134-
[Go to the DPRK IT Workers framework →](/dprk-it-workers/overview)
135-
13699
<DevOnly>
137100

138101
## Governance
@@ -146,60 +109,69 @@ establishing accountability, compliance with regulatory requirements, risk manag
146109

147110
<DevOnly>
148111

149-
## DevSecOps
112+
## Identity and Access Management (IAM)
150113

151-
This framework focuses on integrating security practices into the development and operations processes, covering code
152-
signing, CI/CD, IDE security, repository hardening, and security testing.
114+
This framework covers best practices for managing user identities and access control in Web3 projects, including
115+
role-based access control and secure authentication.
153116

154-
[Explore the DevSecOps framework →](/devsecops/overview)
117+
[Go to the IAM framework →](/iam/overview)
155118

156119
</DevOnly>
157120

158-
<DevOnly>
121+
## Incident Management
159122

160-
## Privacy
123+
This section outlines protocols for handling security incidents, including communication strategies, detection and
124+
response procedures, lessons learned, and playbooks, including specific guidelines for SEAL 911 War Room.
161125

162-
This section explores tools and practices for maintaining privacy in the Web3 ecosystem, including secure browsing, data
163-
removal, digital footprint management, encrypted communication, and privacy-focused operating systems.
126+
[Read more about the Incident Management framework →](/incident-management/overview)
164127

165-
[Go to the Privacy framework →](/privacy/overview)
128+
## Infrastructure
166129

167-
</DevOnly>
130+
This section covers the fundamental aspects of securing the underlying infrastructure of Web3 projects, including asset
131+
inventory, cloud infrastructure, DDoS protection, DNS security, IAM, network security, and zero-trust principles.
168132

169-
<DevOnly>
133+
[Read more about the Infrastructure framework →](/infrastructure/overview)
170134

171-
## Supply Chain
135+
## Monitoring
172136

173-
This framework addresses the security implications of dependencies and third-party components in Web3 projects,
174-
including dependency awareness and supply chain levels for software artifacts.
137+
This framework discusses the importance of continuous monitoring in Web3 projects, focusing on setting up effective
138+
monitoring systems and defining appropriate thresholds for alerts.
175139

176-
[Read more about the Supply Chain framework →](/supply-chain/overview)
140+
[Explore the Monitoring framework →](/monitoring/overview)
177141

178-
</DevOnly>
142+
## Multisig for Protocols
179143

180-
<DevOnly>
144+
This comprehensive framework provides security guidelines for managing multisig wallets in protocols, covering
145+
planning and classification, setup and configuration, signer onboarding, hardware wallet setup, transaction
146+
verification, emergency procedures, and incident reporting.
181147

182-
## Security Automation
148+
[Read more about the Multisig for Protocols framework →](/multisig-for-protocols/overview)
183149

184-
This framework focuses on using technology to perform security tasks with minimal human intervention, covering
185-
compliance checks, infrastructure as code, and threat detection and response to improve efficiency and reduce human
186-
error.
150+
## Operational Security (OpSec)
187151

188-
[Explore the Security Automation framework →](/security-automation/overview)
152+
This comprehensive framework addresses day-to-day security practices for Web3 teams, covering fundamentals, governance,
153+
risk management, control domains, lifecycle management, monitoring, incident response, and continuous improvement.
189154

190-
</DevOnly>
155+
[Explore the OpSec framework →](/opsec/overview)
191156

192157
<DevOnly>
193158

194-
## Identity and Access Management (IAM)
159+
## Privacy
195160

196-
This framework covers best practices for managing user identities and access control in Web3 projects, including
197-
role-based access control and secure authentication.
161+
This section explores tools and practices for maintaining privacy in the Web3 ecosystem, including secure browsing, data
162+
removal, digital footprint management, encrypted communication, and privacy-focused operating systems.
198163

199-
[Go to the IAM framework →](/iam/overview)
164+
[Go to the Privacy framework →](/privacy/overview)
200165

201166
</DevOnly>
202167

168+
## Safe Harbor
169+
170+
This framework provides guidance on establishing safe harbor protocols for security researchers, including key terms,
171+
protocols, technical outlines, and whitehat guidelines.
172+
173+
[Read more about the Safe Harbor framework →](/safe-harbor/overview)
174+
203175
<DevOnly>
204176

205177
## Secure Software Development
@@ -211,46 +183,40 @@ coding standards, code reviews, and secure design principles.
211183

212184
</DevOnly>
213185

214-
## Security Testing
215-
216-
This framework explores various methods of testing Web3 projects for security vulnerabilities, including dynamic and
217-
static application security testing, fuzz testing, and security regression testing.
218-
219-
[Explore the Security Testing framework →](/security-testing/overview)
220-
221186
<DevOnly>
222187

223-
## AI Security
188+
## Security Automation
224189

225-
This framework covers emerging AI-native security risks and controls, including prompt injection defenses, runtime
226-
execution-path enforcement, and sandboxing strategies for agentic systems.
190+
This framework focuses on using technology to perform security tasks with minimal human intervention, covering
191+
compliance checks, infrastructure as code, and threat detection and response to improve efficiency and reduce human
192+
error.
227193

228-
[Explore the AI Security framework →](/ai-security/overview)
194+
[Explore the Security Automation framework →](/security-automation/overview)
229195

230196
</DevOnly>
231197

232-
## ENS
198+
## Security Testing
233199

234-
This section covers Ethereum Name Service security considerations, including data integrity, cross-chain compatibility,
235-
smart contract integration, interface compliance, and name handling.
200+
This framework explores various methods of testing Web3 projects for security vulnerabilities, including dynamic and
201+
static application security testing, fuzz testing, and security regression testing.
236202

237-
[Go to the ENS framework →](/ens/overview)
203+
[Explore the Security Testing framework →](/security-testing/overview)
238204

239-
## Safe Harbor
205+
## Supply Chain
240206

241-
This framework provides guidance on establishing safe harbor protocols for security researchers, including key terms,
242-
protocols, technical outlines, and whitehat guidelines.
207+
This framework addresses the security implications of dependencies and third-party components in Web3 projects,
208+
including dependency awareness and supply chain levels for software artifacts.
243209

244-
[Read more about the Safe Harbor framework →](/safe-harbor/overview)
210+
[Read more about the Supply Chain framework →](/supply-chain/overview)
245211

246212
<DevOnly>
247213

248-
## Encryption
214+
## Threat Modeling
249215

250-
This comprehensive section covers various encryption methods and their applications in protecting data, including cloud
251-
data encryption, communication encryption, database encryption, and various types of storage encryption.
216+
This framework provides guidance on creating and maintaining threat models, as well as identifying and mitigating
217+
potential threats to Web3 projects.
252218

253-
[Explore the Encryption framework →](/encryption/overview)
219+
[Explore the Threat Modeling framework →](/threat-modeling/overview)
254220

255221
</DevOnly>
256222

@@ -266,6 +232,24 @@ transaction verification protocols.
266232

267233
</DevOnly>
268234

235+
<DevOnly>
236+
237+
## Vulnerability Disclosure
238+
239+
This section discusses best practices for handling and disclosing vulnerabilities in Web3 projects, including
240+
establishing security contacts and managing bug bounty programs.
241+
242+
[Go to the Vulnerability Disclosure framework →](/vulnerability-disclosure/overview)
243+
244+
</DevOnly>
245+
246+
## Wallet Security
247+
248+
This section delves into the crucial aspect of managing cryptographic keys in Web3 projects, discussing various wallet
249+
types (cold vs hot, custodial vs non-custodial), hardware wallets, signing schemes, and software wallets.
250+
251+
[Go to the Wallet Security framework →](/wallet-security/overview)
252+
269253
## SEAL Certifications
270254

271255
This framework provides a certification system developed by SEAL with standardized guidelines and evaluation criteria

0 commit comments

Comments
 (0)