OWASP SCS Infrastructure Security Handbook¶
OWASP Smart Contract Security Project
Part of the OWASP SCS Handbook Series. Built to the series conventions.
Purpose and Scope¶
This handbook secures the infrastructure layer underneath a Web3 project: the servers, cloud accounts, nodes, and network paths that keep contracts reachable and front ends online. It covers asset inventory, cloud and node infrastructure (including remote procedure call (RPC) and archive nodes), distributed denial-of-service (DDoS) protection, DNS and domain security, network hardening, operating system baselines, and zero-trust design, aligned with current operational practice rather than a theoretical ideal.
The guidance draws on NIST's Zero Trust Architecture (SP 800-207 and SP 1800-35), cloud security posture checklists built around least-privilege identity and access management (IAM), policy-as-code enforcement, Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) concepts, and continuous monitoring practice. Each chapter translates these frameworks into checklists a node operator, DevOps engineer, or site reliability engineer (SRE) can act on directly, rather than leaving them as abstract compliance language.
Target Audience¶
Engineers and developers building on Web3 infrastructure, security specialists reviewing that infrastructure, and DevOps, cloud, and SRE practitioners who operate it day to day. Anyone accountable for keeping an RPC node, a validator, or a project's cloud footprint online and defensible will find direct guidance here.
How to Use This Handbook¶
Start with Part I to establish why infrastructure sits underneath every other Web3 security control and to build an asset inventory before anything else. Parts II through V are reference material organized by domain: node and compute infrastructure, network and availability, DNS and domain security, and identity and access management. Part VI consolidates the checklists into operational form for pre-deployment, ongoing operations, and incident readiness. Part VII holds the glossary, printable checklists, tool references, and bibliography. An SRE hardening a fresh RPC deployment can jump straight to Part II and the checklists in Part VI; a team preparing for a domain-security review should start with Part IV.
Relationship to SCSVS, SCSTG, and SCWE¶
The Smart Contract Security Verification Standard (SCSVS) defines the properties a secure system must satisfy at the application and infrastructure boundary; the controls in this handbook, cloud IAM, node hardening, and DNS integrity among them, are the operational implementation of those infrastructure-facing requirements. The Smart Contract Security Testing Guide (SCSTG) describes how to test a system's security; the checklists in Parts II, III, and VI extend that testing discipline to cloud posture, network configuration, and DNS records rather than contract code. The Smart Contract Weakness Enumeration (SCWE) catalogs weaknesses in contract logic, and the failure modes covered here (exposed RPC endpoints, missing DNSSEC, stale IAM grants) sit one layer below the contract and fall largely outside SCWE's scope. This handbook overlaps most closely with the DNS and Hosting Security Handbook (02), which goes deeper on domain and hosting-provider risk, and feeds directly into the Incident Response Handbook (06), which owns the response process once an infrastructure control fails.
Contents¶
Part I: Foundations - 1. Introduction to Infrastructure Security in Web3 - 2. Asset Inventory
Part II: Node and Compute Infrastructure - 3. Node Infrastructure Security - 4. Cloud Infrastructure - 5. Operating System Security
Part III: Network and Availability - 6. Network Security - 7. DDoS Protection - 8. Zero-Trust Principles
Part IV: DNS and Domain Security - 9. DNS and Domain Registration - 10. DNS Security (DNSSEC, CAA, etc.) - 11. Email and Communication Security (SPF, DKIM, DMARC) - 12. DNS and Hosting Attack Playbooks (Overview)
Part V: Identity and Access Management - 13. Identity and Access Management for Infrastructure - 14. Integration with IAM Framework
Part VI: Checklists and Operations - 15. Node Infrastructure Security Checklist (Consolidated) - 16. Infrastructure as Code (IaC) Security - 17. Monitoring and Logging
Part VII: Appendices - 18. Appendix A: Glossary - 19. Appendix B: Node Infrastructure Security Checklist (Printable) - 20. Appendix C: DNS and Domain Security Checklist - 21. Appendix D: Tool and Provider References - 22. Appendix E: References and Further Reading