The Deputy Chief Information Security Officer of Mysten Labs Discusses the Security Design and Practices of the Sui Blockchain

Recently, we had the privilege of having an in-depth conversation with Christian Thompson, the Deputy Chief Information Security Officer of Mysten Labs, where we discussed his insights on the interconnections of security practices and his observations and evaluations of the security practices for Sui developers.

Responsibilities of a CISO in a Technology Company

The Chief Information Security Officer's responsibilities are broad and crucial for protecting the security of the digital environment. Core tasks include gathering threat intelligence and gaining deep insights into the mindset, motivations, and capabilities of potential attackers. With a clear understanding of potential adversaries, proactive measures can be taken to protect the systems.

The CISO is also responsible for building a real-time alert system to respond quickly when suspicious activities are detected. Responsibilities cover multiple areas including cybersecurity, data management, risk assessment, architecture design, compliance, governance, resilience, and reporting. In addition, the CISO must also pay attention to the security of internal team members, especially when they travel to high-risk areas.

Security Considerations of Sui Blockchain

For L1 blockchains like Sui, it is necessary to integrate various functions and services to create a cohesive defense strategy. This strategy not only focuses on weak points but also needs to protect the interests of the entire ecosystem, including the network and developers building applications on the Sui platform.

To address the security challenges faced by small companies, the Sui Foundation is developing a product that extends high-level security measures to a broader ecosystem. This will provide smaller companies with security tools and services that are typically only available to large organizations, ensuring they can develop in a more secure environment.

Blockchain Security Tools and Services

Christian Thompson presented a chart outlining the types of services and tools used by skilled security teams. These tools cover various aspects from brand defense to vulnerability detection. He emphasized that true effectiveness lies not only in the individual existence of each service but also in the interactions and synergies between them.

The Sui network uses specific tools or relies on service providers to deploy these security components. The Sui Foundation plans to package these components and provide them to enterprises with demand. Different types of companies may need to customize different toolkits based on their unique needs.

Challenges and Methods for Keeping Public Blockchain Secure

Despite the core of public chains being their decentralized and permissionless characteristics, maintaining network security is still crucial. Christian Thompson emphasized three key factors:

1. The ability to build necessary tools
2. Promote education and raise awareness
3. Information exchange within the community

This three-pronged approach aims to provide knowledge, industry insights, and practical tools to enable the community to understand and actively influence the security of the ecosystem.

Communication Methods in the Sui Ecosystem

The Sui ecosystem communicates through various channels, including:

• Verification Node Summit
• Builder Houses event
• Daily communication platforms such as Discord and Telegram
• A series of security-related articles planned to be released by the Sui Foundation

These channels promote interaction between verification nodes, node operators, and other stakeholders, creating an evolving knowledge-sharing platform.

The Security Advantages of Sui Move

Christian Thompson confirmed that Sui Move is designed to be more secure than other blockchain programming languages. He added that many security experts were part of the early development team for Sui, which ensured that the various components were built with security in mind, thereby enhancing its resistance to attacks.

The Impact of Web3 Security Incidents on Sui

The security incidents occurring in the Web3 space have provided Sui with valuable learning opportunities. The Sui Foundation team has invested significant resources in studying these threats to understand the identity, capabilities, and motivations of the attackers. These lessons have enabled Sui to optimize and strengthen its security strategies to guard against similar risks.

The Future Outlook of Web3 Security

Christian Thompson is full of expectations for the future of Web3, as he envisions that technologies such as artificial intelligence, machine learning, augmented reality, and virtual reality will bring about significant changes. In the field of security, he imagines the possible emergence of AI security assistants in the future, and even scenarios where AI combats AI. Thompson stated that Sui is expected to be at the forefront of the application of these advanced technologies.