Consider the example of cannabis farmers who doubled as bitcoin miners outside of the U.K. city of Birmingham. Police inadvertently discovered their illegal bitcoin mine while raiding their illegal cannabis farm. It’s safe to say that the threats facing this cannabis-bitcoin venture were poorly modeled and mitigated, if at all.
For most technology companies, threat modeling usually involves code review and software changes. For most humans, day-to-day threat modeling is intuitive, which is why most people prefer well-lit walkways to dark alleys. For miners, the same sort of threat assessments affect a variety of software, firmware and hardware products.
Building A Home Bitcoin Mining Threat Model
Threat models can be as complex or simplistic as the creator wants. But a home miner can’t adequately prepare against potential threats if they don’t understand what risks they face.
Setting the scope of a threat model is the first and possibly most important step. Think carefully about what needs protecting (e.g., mining hardware, site access, electrical and cooling infrastructure, internet access, payout deposits and wallet storage) and who it needs protection from (e.g., friends and family, neighbors or unexpected visitors, targeted attacks). Of course, not every miner faces the same potential risks. Someone with two S9s in a suburban neighborhood deals with different risks than a landowner in the Midwest with a dozen S19s on 80 acres. But listing any possible attack scenario is key to setting the scope of the model.
The key to making this list is simply asking, “What could go wrong?” Any answer gets added to the list.
Focusing on pool accounts and payout withdrawals, for example, this aspect of a mining threat model would include pool account security and planning strategies and tools to account for vulnerabilities in password protection, two-factor authentication, payout address reuse, etc.
Likelihood and effort are two additional considerations. Take the “bad scenario” list and use basic probabilistic attack analysis to evaluate how likely each risk in the list is to happen. After ranking these scenarios, decide how much effort and preparation each item deserves. This involves two steps phrased as questions. First, what mitigatory steps are required for a particular risk? Second, based on the perceived likelihood of a given threat, how much effort is a miner willing to give to prevent it? There is no rulebook or answer key for this process. Each of these steps are up to the discretion of the miner.
“Let’s build a threat model” isn’t usually the first thought a home miner has when planning their operation, but this extra OPSEC work can avoid serious problems in the future. And threat modeling really isn’t that complex. But, like any other aspect of OPSEC, threat analysis is best thought of as an ongoing process that can always be adapted and refined, not a finished task.
Additional Resources
Nothing in this article is meant to be an exhaustive explanation of how to safeguard a home mining setup. Instead, the goal of this article is to provide a simple breakdown of what threat models are, how miners can use them and encourage home miners to begin building one of their own.
Continue reading about threat modeling and how to develop one for a mining operation with these resources:
The Electronic Frontier Foundation published a surveillance self-defense guide with an important chapter on developing a security plan.
Over a dozen security professionals published a “Threat Modeling Manifesto. ”
Carnegie Mellon’s Software Engineering Institute published a lengthy article on available methods for successful threat modeling.
One of the principal security solutions architects at Amazon Web Services also published a long article about how to approach threat modeling.
Conclusion
Small miners, especially at-home operators, are mostly left to fend for themselves regarding the security and threats facing their setups. Large institutional miners always have best operational security practices and threat models in place to safeguard their mining facilities. But there is no playbook or standardized manual for at-home mining security.
Even for miners who have been hashing for years, it’s never too early or too late to create a threat model for an at-home operation of any scale. Thinking carefully about all aspects of home mining and planning to safeguard them with a custom-made threat model is key to ensuring a miner’s long-term survival.
This is a guest post by Zack Voell. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.
