Skip to content

docs: add Web3 workforce security guide + index fixes#386

Closed
artemisclaw82 wants to merge 4 commits intosecurity-alliance:developfrom
artemisclaw82:feat/workforce-security-and-index-fixes
Closed

docs: add Web3 workforce security guide + index fixes#386
artemisclaw82 wants to merge 4 commits intosecurity-alliance:developfrom
artemisclaw82:feat/workforce-security-and-index-fixes

Conversation

@artemisclaw82
Copy link

Summary

Adds Andrew Chang-Gu's Web3 Workforce Security guide and fixes several index page issues.

New Content

  • Web3 Workforce Security (/opsec/web3-workforce-security) — covers Discord session cookie theft, fake Zoom malware, Zero Trust for Web3 orgs, device security tiers, workforce verification, and DPRK IT worker threat. Research-enriched with verified sources (KnowBe4 2024 incident, Lazarus Zoom campaigns, Skuld infostealer, Chrome Enterprise Core).

Index Fixes

  • Certs index: 'Certified Partners' → 'Certified Auditors', added 'SFC:' prefixes for consistency, added Certified Protocols link
  • Account Management index: removed redundant '| Security Alliance' suffixes from all link titles
  • Wallet Security index: fixed URLs &and to match file renames from Rename files with '&' to 'and' for URL compatibility #372
  • Opsec index: added new workforce security page
  • fetched-tags.json: new page tags + path corrections

Verified

  • All enrichment facts independently verified (web sources)
  • Andrew's original content accepted as-is
  • Build clean (122s)

@vercel
Copy link

vercel bot commented Feb 18, 2026

@artemisclaw82 is attempting to deploy a commit to the Security Alliance Team on Vercel.

A member of the Team first needs to authorize it.

@scode2277
Copy link
Collaborator

@DicksonWu654 if you pull from develop most of these are already solved (indexes, tags, folder names)

@scode2277 scode2277 marked this pull request as draft February 23, 2026 14:42
@artemisclaw82
Copy link
Author

Disclosure: This content was written by Artemis, an AI assistant operated by @DicksonWu654. It has not yet been reviewed by a human. Dickson will review and revise before marking as ready for review.

- New page at opsec/web3-workforce-security covering:
  - Discord session cookie theft and fake Zoom malware scenarios
  - Traditional IT vs Web3 security gap analysis
  - Zero Trust / Identity as Perimeter for Web3 orgs
  - Three-tier device security model (managed, VDI, enterprise browser)
  - Workforce verification tiers, liveness checks, onboarding/offboarding
- Added Andrew Chang-Gu to contributors.json
- Research enrichment: KnowBe4 DPRK hire, Lazarus Zoom campaigns,
  Skuld Discord token stealer, Chrome Enterprise Core details
- Build verified clean
- Add Web3 Workforce Security page to opsec index
- Fix certs index: 'Certified Partners' → 'Certified Auditors', add SFC prefixes, add Certified Protocols link
- Clean account management index: remove redundant '| Security Alliance' suffixes
- Fix wallet-security URLs: '&' → 'and' (matches file renames from security-alliance#372)
- Update fetched-tags.json with new page tags + path fixes
@artemisclaw82 artemisclaw82 force-pushed the feat/workforce-security-and-index-fixes branch from 79e9542 to 3c9ad22 Compare February 24, 2026 05:57
@github-actions
Copy link

Sidebar Configuration Reminder

Documentation files update:

New in this push:

  • docs/pages/config/index.mdx (added) ← NEW
  • docs/pages/opsec/web3-workforce-security.mdx (added) ← NEW

Please ensure that:

  • The sidebar in vocs.config.tsx has been updated to include these files
  • New content has the dev: true parameter so it's marked as under development
  • Sidebar links match the file paths - use the preview deployment to verify

See Contributing Guide – Sidebar & Navigation for more details.


This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.

@artemisclaw82 artemisclaw82 force-pushed the feat/workforce-security-and-index-fixes branch from ec39621 to 9ec6823 Compare February 25, 2026 04:18
"avatar": "https://ui-avatars.com/api/?name=Andrew+Chang-Gu&background=8b5cf6&color=fff&size=200",
"github": null,
"twitter": null,
"website": "https://blockchang.com",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use his linkedin

- Engineer/Developer
contributors:
- role: wrote
users: [andrew-chang-gu]
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add us

@@ -0,0 +1,293 @@
---
title: "Web3 Workforce Security | Security Alliance"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm was this not avaialble to add anywhere else?

Also please refer to the original source material to assert that your information is accurate

@artemisclaw82
Copy link
Author

Addressed all three comments:

  1. LinkedIn: Updated Andrew Chang-Gu website to his LinkedIn (linkedin.com/in/achanggu/)
  2. Contributors: Added dickson as co-author
  3. Placement + accuracy: Opsec section is appropriate — content covers organizational operational security (device tiers, identity controls, workforce verification). Verified key claims:
    • ✅ Skuld malware: Golang infostealer, mid-2023, reported by Trellix — targets Discord tokens + browser credentials
    • ✅ KnowBe4 DPRK incident: July 2024, hired operative as Principal Software Engineer, passed video interviews + background check using stolen US identity with AI-enhanced photo
    • ✅ Discord bookmarklet token theft: documented 2023 attack wave against NFT/crypto servers
    • ✅ Lazarus Group fake Zoom/meeting attacks: well-documented DPRK tactic
    • ✅ GTIG documentation of DPRK IT workers using AI-generated profiles: confirmed
    • ✅ Zero Trust / IdP / conditional access guidance: standard industry best practices
    • ✅ Chrome Enterprise Core free with Google Workspace: confirmed
    • ✅ Andrew Chang-Gu (CISSP): confirmed at Mandiant/Google Cloud, Northwestern Kellogg

@artemisclaw82
Copy link
Author

Content from Andrew Chang-Gu's presentation has been redistributed to existing pages per review feedback:

Closing this PR in favor of the targeted additions above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants