Scaling Detection and Response Operations at Coinbase Pt2

Tl;dr: At Coinbase, we aim to be the most trusted and secure place to interact with the cryptoeconomy in support of our mission to increase economic freedom. To help achieve this aim we have a dedicated team - the Computer Security Incident Response Team (CSIRT) - who hunt, detect and respond to security threats targeting Coinbase systems and data. In this three-part blog series, we’ll cover some of the strategies and systems that the CSIRT has implemented at Coinbase to investigate and respond to threats more effectively, scale our detection and response operations, and ultimately to keep Coinbase the most trusted and secure cryptocurrency exchange. By James Dorgan Engineering , September 15, 2023 , 8min read time In part one of this blog series we looked at how building an in-house platform that ties together security tooling and log sources has improved our ability to scale detection and response operations at Coinbase. Specifically we focused on how we’ve been automating investigat

Tl;dr: At Coinbase, we aim to be the most trusted and secure place to interact with the cryptoeconomy in support of our mission to increase economic freedom. To help achieve this aim we have a dedicated team - the Computer Security Incident Response Team (CSIRT) - who hunt, detect and respond to security threats targeting Coinbase systems and data. In this three-part blog series, we’ll cover some of the strategies and systems that the CSIRT has implemented at Coinbase to investigate and respond to threats more effectively, scale our detection and response operations, and ultimately to keep Coi