Certain solution components are more critical than others, and these critical components should use trusted platform modules. This helps with storing cryptographic material — enabled by HSMs. They also enable privacy-preserving chaincode execution such that the node’s administrator cannot tamper with the execution without being detected.

APIs are the primary form of communication between the different parts of a blockchain solution. APIs need to be protected from any improper use and limited to the scope of the transaction. While API security encompasses a number of things, three key controls should be enforced for all APIs: identification, authentication, and authorization. It’s important to leverage an industry standard like OAUTH, not only to standardize the interactions but also to secure the APIs.

Use a PAM solution to ensure that the appropriate users with the appropriate privileges access the components for administrative or change management purposes. This is especially important since the platform may have confidential information, including payment transactional data for users and members.

A PAM solution should be put in place with password rotation and efficient separation of duties. It’s also important to configure end-to-end logging to capture flows from entry to exit. Access to secrets should be linked to a ticketing system, and every secret release should have a reviewer. Every instance of administrative access should be traced to an approved ticket or change.