Philosophy and Evolution of Security at ChangeNOW

Jul 19, 20264 min read

Crypto Content Manager | ChangeNOW

Reviewed by

Security is the foundation a crypto platform should be built on. At ChangeNOW, the security approach shapes the rules and habits we hold ourselves to internally, as a team.

Today we talk with Nikolas B., Technical Lead at ChangeNOW, to discuss where our approach comes from and what we've learned along the way.

Key Takeaways

Security runs on three fronts at once: people, systems, and processes.
Every sensitive operation needs sign-off from 2-3 different people.
Mistakes are treated as fuel for tightening security.
The smallest-looking rules are often what stop a real incident.
The strategy going forward is to stay ahead of threats.

Core Security Philosophy

Security at ChangeNOW is a mindset that runs across the company on several fronts at once.

"The first is, of course, people," says Nikolas. "No matter how well-protected a system is, a person can become an attacker's way in."

At ChangeNOW, the team runs regular workshops and training on security awareness and digital hygiene. Access across the company follows the principle of least privilege.

The Principle of Least Privilege (PoLP) is a cybersecurity concept where users, systems, and processes are granted only the minimum permissions and access levels necessary to perform their tasks

The second front is the systems themselves. Two-factor authentication, hardened API gateways, and encryption of data in transit, at rest, and in memory are treated as baseline requirements. Automated monitoring watches continuously for intrusion attempts and attempts to exploit vulnerabilities, and the results are checked regularly through periodic security audits.

The third front is the process. Specifically, how people are allowed to interact with critical systems. Every sensitive operation at ChangeNOW runs through what the team calls a "two-key" system: no single employee can execute it alone, since it requires approval and action from two or more people.

Work on critical infrastructure itself is confined to restricted, time-limited sessions, carried out under the direct oversight of a designated person responsible for that session.