Coinbase conducted a detailed analysis of various ASM offerings and chose to use the IBM Security® Randori® Recon solution, including its IBM® X-Force® Attack Targeted service, which, as Lunglhofer says, “came out on top from a value perspective and from a pure capability perspective.”

Coinbase has now used Randori for several years and, as the company has rapidly evolved, it’s worked closely with the Randori team to continually test and strengthen its everchanging attack surface. Randori combines ASM automation software with X-Force Red, a human team of cybersecurity experts and ethical red team hackers. While the automation drives surface testing at scale, the people collaborate directly with Coinbase to address issues requiring deeper insight and nuance.

“I’ve always been incredibly impressed by the Randori team members that I’ve spoken with,” says Lunglhofer. “They spend a lot of time listening to our concerns, then they take that information and synthesize it into a really meaningful attack plan that shows us where we can tighten things. It really is next level, the deep understanding and spending hours on the phone talking through our business and getting very focused on the targeting. That’s a huge differentiator, that level of investment.”

Over time, Coinbase has adjusted how it uses Randori in order to maximize its effectiveness. In the first year or so, Coinbase had the Randori team operating almost independently, as a “very-red red team,” as Lunglhofer puts it, stealthily hunting across Coinbase’s network for any potential risks. There were some very valuable finds, but by and large, thanks to the skills of the Coinbase security team, the network was tight. It was difficult for the red team to find areas needing improvement.

Seeing potential for steadier value, Lunglhofer and team replaced cloak-and-dagger red teaming with more collaborative purple teaming, having the Randori red team work directly with Coinbase security “blue” teams in attack planning sessions. Now, Coinbase teammates with deep knowledge of the network guide the red team to the areas they most want to test. The result, Lunglhofer says, is “more impactful tests that more accurately simulate an adversary. It’s a much more consistent positive impact.”

Smith and colleague Paul Hodapp, Coinbase’s Director of Security Technical Program Management, relate two specific and varied examples of how they’ve put Randori to use:

Strengthening security in the existing network
When the Randori team recently noted a visibility gap in one environment, related to a particular beaconing protocol, Smith brought key personnel from the affected environment together with his Security Ops team and Randori personnel. “Everybody’s in the room together,” says Smith. “It gets our infrastructure people thinking about how to resolve this from a holistic level, our security people thinking about the types of detections they need to write. We coalesced all that into a package of solutions within a couple of days and closed the issue.”

Mergers and acquisitions (M&A) onboarding
In periods of rapid acquisition, Hodapp explains that his team used Randori to support a methodical, disciplined approach to aligning acquisitions to Coinbase’s high security standards. Upon finalizing an M&A agreement, Coinbase has the acquired company provide extensive information about its security domains. Then Coinbase will apply Randori to the environment as an objective check, and potentially to uncover forgotten or unknown elements (shadow IT). “It gives us more visibility and an independent data source,” says Hodapp. “We could pretty quickly look at the Randori platform and see if it’s all been cleaned up or that there’s still more to go. It’s peace of mind that there isn’t some piece of the attack surface we don’t know about and risks we don’t understand.”

For the Coinbase team, all the above comes back to trust. The company has built a sophisticated security program as a key component to earning and maintaining the trust of its customers, whether they’re advanced crypto users or beginners. But no connected technology or network is airtight. “So we look for partners who help constantly up-level our team,” says Smith. “That requires an equally sophisticated actor, and we’ve found that with Randori. It helps keep us sharp.”  

Coinbase (link resides outside of ibm.com) is on a mission to increase economic freedom for more than 1 billion people by ensuring that they can participate fairly in the economy through cryptocurrency. It aims to update the century-old financial system by providing a trusted platform that makes it easy for people and institutions to engage with crypto assets, including trading, staking, safekeeping, spending, and fast, free global transfers. Coinbase also provides critical infrastructure for onchain activity and supports builders who share its vision that onchain is the new online. And together with the crypto community, Coinbase advocates for responsible rules to make the benefits of crypto available around the world.