@@ -23,13 +23,12 @@ import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter, Dev
2323This document provides an overview of the various frameworks covered in the Security Frameworks by SEAL. Each framework
2424addresses a specific aspect of Web3 security, providing best practices and guidelines to help secure your projects.
2525
26- ## Community Management
26+ ## AI Security
2727
28- This framework explores best practices for securing and managing online communities associated with Web3 projects,
29- covering platforms like Discord, Twitter, Telegram, and Google. It focuses on establishing secure communication channels
30- and community guidelines.
28+ This framework covers emerging AI-native security risks and controls, including prompt injection defenses, runtime
29+ execution-path enforcement, and sandboxing strategies for agentic systems.
3130
32- [ Go to the Community Management framework →] ( /community-management /overview )
31+ [ Explore the AI Security framework →] ( /ai-security /overview )
3332
3433## Awareness
3534
@@ -38,63 +37,53 @@ understanding threat vectors, cultivating a security-aware mindset, and staying
3837
3938[ Read more about the Awareness framework →] ( /awareness/overview )
4039
41- ## Operational Security (OpSec)
42-
43- This comprehensive framework addresses day-to-day security practices for Web3 teams, covering fundamentals, governance,
44- risk management, control domains, lifecycle management, monitoring, incident response, and continuous improvement.
45-
46- [ Explore the OpSec framework →] ( /opsec/overview )
47-
48- ## Wallet Security
40+ ## Community Management
4941
50- This section delves into the crucial aspect of managing cryptographic keys in Web3 projects, discussing various wallet
51- types (cold vs hot, custodial vs non-custodial), hardware wallets, signing schemes, and software wallets.
42+ This framework explores best practices for securing and managing online communities associated with Web3 projects,
43+ covering platforms like Discord, Twitter, Telegram, and Google. It focuses on establishing secure communication channels
44+ and community guidelines.
5245
53- [ Go to the Wallet Security framework →] ( /wallet-security /overview )
46+ [ Go to the Community Management framework →] ( /community-management /overview )
5447
55- ## Multisig for Protocols
48+ ## DevSecOps
5649
57- This comprehensive framework provides security guidelines for managing multisig wallets in protocols, covering
58- planning and classification, setup and configuration, signer onboarding, hardware wallet setup, transaction
59- verification, emergency procedures, and incident reporting.
50+ This framework focuses on integrating security practices into the development and operations processes, covering code
51+ signing, CI/CD, IDE security, repository hardening, and security testing.
6052
61- [ Read more about the Multisig for Protocols framework →] ( /multisig-for-protocols /overview )
53+ [ Explore the DevSecOps framework →] ( /devsecops /overview )
6254
63- ## External Security Reviews
55+ ## Insider Threats (DPRK IT Workers)
6456
65- This framework provides guidance on conducting and preparing for external security audits and reviews, including setting
66- expectations, preparation, security policies, and vendor selection.
57+ This framework addresses the organizational and personal risks related to insider threats, most commonly associated with
58+ North Korean hacker-freelancers. It covers identifying, recognizing, and mitigating risks from insider threat actors,
59+ including hardening hiring processes and organizational defenses.
6760
68- [ Explore the External Security Reviews framework →] ( /external-security-reviews /overview )
61+ [ Go to the DPRK IT Workers framework →] ( /dprk-it-workers /overview )
6962
7063<DevOnly >
7164
72- ## Vulnerability Disclosure
65+ ## Encryption
7366
74- This section discusses best practices for handling and disclosing vulnerabilities in Web3 projects , including
75- establishing security contacts and managing bug bounty programs .
67+ This comprehensive section covers various encryption methods and their applications in protecting data , including cloud
68+ data encryption, communication encryption, database encryption, and various types of storage encryption .
7669
77- [ Go to the Vulnerability Disclosure framework →] ( /vulnerability-disclosure /overview )
70+ [ Explore the Encryption framework →] ( /encryption /overview )
7871
7972</DevOnly >
8073
81- ## Infrastructure
82-
83- This section covers the fundamental aspects of securing the underlying infrastructure of Web3 projects, including asset
84- inventory, cloud infrastructure, DDoS protection, DNS security, IAM, network security, and zero-trust principles.
85-
86- [ Read more about the Infrastructure framework →] ( /infrastructure/overview )
74+ ## ENS
8775
88- <DevOnly >
76+ This section covers Ethereum Name Service security considerations, including data integrity, cross-chain compatibility,
77+ smart contract integration, interface compliance, and name handling.
8978
90- ## Monitoring
79+ [ Go to the ENS framework → ] ( /ens/overview )
9180
92- This framework discusses the importance of continuous monitoring in Web3 projects, focusing on setting up effective
93- monitoring systems and defining appropriate thresholds for alerts.
81+ ## External Security Reviews
9482
95- [ Explore the Monitoring framework →] ( /monitoring/overview )
83+ This framework provides guidance on conducting and preparing for external security audits and reviews, including setting
84+ expectations, preparation, security policies, and vendor selection.
9685
97- </ DevOnly >
86+ [ Explore the External Security Reviews framework → ] ( /external-security-reviews/overview )
9887
9988<DevOnly >
10089
@@ -107,32 +96,6 @@ web and mobile application security, common vulnerabilities, and security tools.
10796
10897</DevOnly >
10998
110- ## Incident Management
111-
112- This section outlines protocols for handling security incidents, including communication strategies, detection and
113- response procedures, lessons learned, and playbooks, including specific guidelines for SEAL 911 War Room.
114-
115- [ Read more about the Incident Management framework →] ( /incident-management/overview )
116-
117- <DevOnly >
118-
119- ## Threat Modeling
120-
121- This framework provides guidance on creating and maintaining threat models, as well as identifying and mitigating
122- potential threats to Web3 projects.
123-
124- [ Explore the Threat Modeling framework →] ( /threat-modeling/overview )
125-
126- </DevOnly >
127-
128- ## Insider Threats (DPRK IT Workers)
129-
130- This framework addresses the organizational and personal risks related to insider threats, most commonly associated with
131- North Korean hacker-freelancers. It covers identifying, recognizing, and mitigating risks from insider threat actors,
132- including hardening hiring processes and organizational defenses.
133-
134- [ Go to the DPRK IT Workers framework →] ( /dprk-it-workers/overview )
135-
13699<DevOnly >
137100
138101## Governance
@@ -146,60 +109,69 @@ establishing accountability, compliance with regulatory requirements, risk manag
146109
147110<DevOnly >
148111
149- ## DevSecOps
112+ ## Identity and Access Management (IAM)
150113
151- This framework focuses on integrating security practices into the development and operations processes, covering code
152- signing, CI/CD, IDE security, repository hardening, and security testing .
114+ This framework covers best practices for managing user identities and access control in Web3 projects, including
115+ role-based access control and secure authentication .
153116
154- [ Explore the DevSecOps framework →] ( /devsecops /overview )
117+ [ Go to the IAM framework →] ( /iam /overview )
155118
156119</DevOnly >
157120
158- < DevOnly >
121+ ## Incident Management
159122
160- ## Privacy
123+ This section outlines protocols for handling security incidents, including communication strategies, detection and
124+ response procedures, lessons learned, and playbooks, including specific guidelines for SEAL 911 War Room.
161125
162- This section explores tools and practices for maintaining privacy in the Web3 ecosystem, including secure browsing, data
163- removal, digital footprint management, encrypted communication, and privacy-focused operating systems.
126+ [ Read more about the Incident Management framework →] ( /incident-management/overview )
164127
165- [ Go to the Privacy framework → ] ( /privacy/overview )
128+ ## Infrastructure
166129
167- </DevOnly >
130+ This section covers the fundamental aspects of securing the underlying infrastructure of Web3 projects, including asset
131+ inventory, cloud infrastructure, DDoS protection, DNS security, IAM, network security, and zero-trust principles.
168132
169- < DevOnly >
133+ [ Read more about the Infrastructure framework → ] ( /infrastructure/overview )
170134
171- ## Supply Chain
135+ ## Monitoring
172136
173- This framework addresses the security implications of dependencies and third-party components in Web3 projects,
174- including dependency awareness and supply chain levels for software artifacts .
137+ This framework discusses the importance of continuous monitoring in Web3 projects, focusing on setting up effective
138+ monitoring systems and defining appropriate thresholds for alerts .
175139
176- [ Read more about the Supply Chain framework →] ( /supply-chain /overview )
140+ [ Explore the Monitoring framework →] ( /monitoring /overview )
177141
178- </ DevOnly >
142+ ## Multisig for Protocols
179143
180- <DevOnly >
144+ This comprehensive framework provides security guidelines for managing multisig wallets in protocols, covering
145+ planning and classification, setup and configuration, signer onboarding, hardware wallet setup, transaction
146+ verification, emergency procedures, and incident reporting.
181147
182- ## Security Automation
148+ [ Read more about the Multisig for Protocols framework → ] ( /multisig-for-protocols/overview )
183149
184- This framework focuses on using technology to perform security tasks with minimal human intervention, covering
185- compliance checks, infrastructure as code, and threat detection and response to improve efficiency and reduce human
186- error.
150+ ## Operational Security (OpSec)
187151
188- [ Explore the Security Automation framework →] ( /security-automation/overview )
152+ This comprehensive framework addresses day-to-day security practices for Web3 teams, covering fundamentals, governance,
153+ risk management, control domains, lifecycle management, monitoring, incident response, and continuous improvement.
189154
190- </ DevOnly >
155+ [ Explore the OpSec framework → ] ( /opsec/overview )
191156
192157<DevOnly >
193158
194- ## Identity and Access Management (IAM)
159+ ## Privacy
195160
196- This framework covers best practices for managing user identities and access control in Web3 projects, including
197- role-based access control and secure authentication .
161+ This section explores tools and practices for maintaining privacy in the Web3 ecosystem, including secure browsing, data
162+ removal, digital footprint management, encrypted communication, and privacy-focused operating systems .
198163
199- [ Go to the IAM framework →] ( /iam /overview )
164+ [ Go to the Privacy framework →] ( /privacy /overview )
200165
201166</DevOnly >
202167
168+ ## Safe Harbor
169+
170+ This framework provides guidance on establishing safe harbor protocols for security researchers, including key terms,
171+ protocols, technical outlines, and whitehat guidelines.
172+
173+ [ Read more about the Safe Harbor framework →] ( /safe-harbor/overview )
174+
203175<DevOnly >
204176
205177## Secure Software Development
@@ -211,46 +183,40 @@ coding standards, code reviews, and secure design principles.
211183
212184</DevOnly >
213185
214- ## Security Testing
215-
216- This framework explores various methods of testing Web3 projects for security vulnerabilities, including dynamic and
217- static application security testing, fuzz testing, and security regression testing.
218-
219- [ Explore the Security Testing framework →] ( /security-testing/overview )
220-
221186<DevOnly >
222187
223- ## AI Security
188+ ## Security Automation
224189
225- This framework covers emerging AI-native security risks and controls, including prompt injection defenses, runtime
226- execution-path enforcement, and sandboxing strategies for agentic systems.
190+ This framework focuses on using technology to perform security tasks with minimal human intervention, covering
191+ compliance checks, infrastructure as code, and threat detection and response to improve efficiency and reduce human
192+ error.
227193
228- [ Explore the AI Security framework →] ( /ai- security/overview )
194+ [ Explore the Security Automation framework →] ( /security-automation /overview )
229195
230196</DevOnly >
231197
232- ## ENS
198+ ## Security Testing
233199
234- This section covers Ethereum Name Service security considerations, including data integrity, cross-chain compatibility,
235- smart contract integration, interface compliance , and name handling .
200+ This framework explores various methods of testing Web3 projects for security vulnerabilities, including dynamic and
201+ static application security testing, fuzz testing , and security regression testing .
236202
237- [ Go to the ENS framework →] ( /ens /overview )
203+ [ Explore the Security Testing framework →] ( /security-testing /overview )
238204
239- ## Safe Harbor
205+ ## Supply Chain
240206
241- This framework provides guidance on establishing safe harbor protocols for security researchers, including key terms ,
242- protocols, technical outlines, and whitehat guidelines .
207+ This framework addresses the security implications of dependencies and third-party components in Web3 projects ,
208+ including dependency awareness and supply chain levels for software artifacts .
243209
244- [ Read more about the Safe Harbor framework →] ( /safe-harbor /overview )
210+ [ Read more about the Supply Chain framework →] ( /supply-chain /overview )
245211
246212<DevOnly >
247213
248- ## Encryption
214+ ## Threat Modeling
249215
250- This comprehensive section covers various encryption methods and their applications in protecting data, including cloud
251- data encryption, communication encryption, database encryption, and various types of storage encryption .
216+ This framework provides guidance on creating and maintaining threat models, as well as identifying and mitigating
217+ potential threats to Web3 projects .
252218
253- [ Explore the Encryption framework →] ( /encryption /overview )
219+ [ Explore the Threat Modeling framework →] ( /threat-modeling /overview )
254220
255221</DevOnly >
256222
@@ -266,6 +232,24 @@ transaction verification protocols.
266232
267233</DevOnly >
268234
235+ <DevOnly >
236+
237+ ## Vulnerability Disclosure
238+
239+ This section discusses best practices for handling and disclosing vulnerabilities in Web3 projects, including
240+ establishing security contacts and managing bug bounty programs.
241+
242+ [ Go to the Vulnerability Disclosure framework →] ( /vulnerability-disclosure/overview )
243+
244+ </DevOnly >
245+
246+ ## Wallet Security
247+
248+ This section delves into the crucial aspect of managing cryptographic keys in Web3 projects, discussing various wallet
249+ types (cold vs hot, custodial vs non-custodial), hardware wallets, signing schemes, and software wallets.
250+
251+ [ Go to the Wallet Security framework →] ( /wallet-security/overview )
252+
269253## SEAL Certifications
270254
271255This framework provides a certification system developed by SEAL with standardized guidelines and evaluation criteria
0 commit comments