Our validators runs on a trusted cloud provider and we have implemented the following security measures at both the cloud and server level;
The identity & access management for access to the administration of the servers has a double layer; A VPN network that serves as an access gateway to the various validators (and other servers on the network), and access to the servers through SSH authenticated by asymmetric key. All accesses are recorded in an activity log.
The visibility of the servers to the outside is limited to those ports and services necessary for the execution of the validation tasks. This filtering is carried out, both at the cloud provider level to the entire network, and to each of the servers through an iptables configuration.
Observability is implemented on the servers (and in some cases even at the validator application layer) by collecting telemetry and events into a monitoring platform. Some operating and security alerts are implemented on top.
We are continuously connected to the blockchain and security communities, to implement all the significant improvements that come in the future, such as a better security model to protect the keys.
