Secure your trading algorithms and servers – General Guide

What is trading algorithm and server security?

Trading algorithms and server security consist of a range of tactics that are meant to safeguard your trading server from threats such as hacking into the instance, stealing API keys, losing control of the server, various traffic attacks, and more.

Why should I secure my trading servers?

• To not allow anyone else access to your assets
• To not have your API keys stolen and misused
• To protect your privacy and trading activities
• To stop malicious actors from stealing your information such as the trading strategy
• To make sure that you are in full control of what’s happening on your servers

Why shouldn’t I secure my trading servers?

How to get started with securing your trading algorithms?

Disclaimer

Before we begin, I want to bring your attention to a disclaimer: I am not a cybersecurity specialist nor do I possess advanced hacking knowledge. Some of the information covered in this article might be incorrect or not eloquently explained. Please do your research and use your fair judgment.

If you are a professional, please feel free to message me with any updates or additional features that might benefit this article.

What are some security best practices?

Security best practices start even before you go coding your trading algorithms. Moreover, I’ve seen traders screw up while casually browsing the web or by mistakenly downloading something they really shouldn’t.

I had a work colleague that built security tools for Wall Street brokers in the 90s, he stated that most hacks and intrusions were due to people being lazy and having their passwords written down in their drawers. We can do better than that, can we?

We’ll start with the basic best practices and move up the ladder of security. Here’s a list of best practices we’re going to cover:

1. Strong passwords
2. Two-factor authentification
3. Tracking protection
4. Malware protection

Strong passwords

You need to have strong passwords. Most often we think that our passwords are strong, but they really aren’t that strong if they make “sense” and have some of your personal details inside of them.

Two-factor authentication

Two Factor Authentication (2FA) is an extra layer of protection used to ensure the security of an account beyond just a username and password. There are usually a couple of ways it can be done.

Most often you need to confirm your login by writing the code from your authenticator app, email, and or SMS. Make sure that you have 2FA for everything that touches your trading accounts, algorithms, and code (e.g., cloud provider, exchange accounts, GitHub, etc.).

Sometimes, hackers can observe your login attempts and send over a fake 2FA email and/or SMS. If your 2FA offers a custom phishing code you can set, please use it. This code will appear on every official SMS and email you get.

Tracking protection

Tracking Protection allows you to control which websites can track information from your system. You usually don’t want websites and/or malicious actors tracking you and learning about your daily patterns, personality, trading strategies and interests, and more.

Malware protection

Malware is a file or code, typically delivered over a network, that infects, explores, steals, and/or conducts virtually any behavior the attacker wants. When it comes to trading this might mean stealing your API keys, stealing your code, encrypting your code and asking for money to get it back, and more.

What are some code security best practices?

Having good code security by implementing best practices when trading will set you on a good path. This will also be your second line of defense if your development system was compromised in any way. We will cover the following best practices:

1. Trading algorithm and data encryption
2. Code security
3. Code obfuscation

Trading algorithm and data encryption

Your trading algorithm code, API keys, and other relevant data for your trading practices should be kept encrypted. Encryption is a process that makes your files unreadable to humans and unusable by machines.

Code security

It is important to consider how secure your code exactly is. You might ask yourself the following questions:

• Is my code set in a password-protected folder and encrypted?
• Is my env file with my API keys easily visible?
• Is my code easy to understand by a malicious user? (be careful with this one)

When it comes to your env file, it should only hold placeholder values or paper trading keys for testing purposes. Never disclose your API keys, but keep them safe in your trading account provider. Moreover, it is best practice to rotate/change your API keys every 2-3 months or so.

You might also explore developing your trading algorithms on the trading server that the algorithm will be run on. This way, you skip the step of opening communication channels to get the algorithm to your server.

When it comes to code readability, all live trading code could/should be obfuscated for an additional layer of security. This brings us to the next point.

Code obfuscation

Code Obfuscation is the process of modifying code in such a way that it is no longer useful to a hacker but remains fully functional. I recommend obfuscating your code that is ready to be used in a live environment while keeping the non-obfuscated version safe for future edits.

How to harden my Linux trading server?

Hardening your Linux trading server is very important. Most often traders use Linux for running trading algorithms as they have much control over it without the bloatware that Windows introduces. Moreover, most cloud resources will be based on Linux.

The trading server will essentially be forward facing and it might be very interesting to hackers. Most of the ones you get out of the box are basic and not adequately hardened for security. This is our third line of defense and making sure that the live trading algorithms aren’t interrupted is important.

Here are a few ways that can make our trading servers more secure:

1. Not all Linux distributions are for secure trading
2. Frequent updates
3. Kernel Hardening
4. Use secure ways of data transfer
5. Remove unneeded software and features

Not all Linux distributions are for secure trading

Considering what Linux distribution to choose for trading is important in terms of security. If you Google what the most secure Linux distribution is you might get results such as Kali Linux, Parrot OS, and similar. Although these are created for pentesting purposes, it doesn’t make them inherently safer than others.

If you are using a cloud provider, you will be constrained by the Linux distribution images it offers. I usually roll with Ubuntu as I’m most comfortable with it. When considering your distribution, research its release cycles, community, and update types.

I’d personally advise staying away from Debian.

Frequent updates

Linux distributions are frequently updated to stay ahead of the vulnerability game, thus I advise frequently updating your trading servers. To do so, run the following command:

sudo apt-get update && apt-get upgrade

Kernel Hardening

Kernel Hardening is a process of making your Linux kernel more secure against malicious users by changing its default behavior. Here are some quick things we can do to make our kernel more secure:

1. Restrict access to kernel logs.

sudo echo "kernel.dmesg_restrict = 1" > /etc/sysctl.d/50-dmesg-restrict.conf

2. Restrict access to kernel pointers.

sudo echo "kernel.kptr_restrict = 1" > /etc/sysctl.d/50-kptr-restrict.conf

3. Enable ExecShield to reduce the risk of worms or other automated remote attacks on Linux systems.

echo "kernel.exec-shield = 2" > /etc/sysctl.d/50-exec-shield.conf

4. Randomize memory space to prevent memory corruption vulnerabilities.

echo "kernel.randomize_va_space=2" > /etc/sysctl.d/50-rand-va-space.conf

5. Enable IP spoofing protection to protect your server from DDoS attacks and malware execution.

sudo sysctl -w net.ipv4.conf.all.rp_filter=1

Use secure ways of data transfer

Remove unneeded software and features

Depending on the Linux distro and cloud provider, your trading server will come with some unneeded software and features which you can remove. By removing them, you burn possible bridges between your server and malicious users.

Let’s start by exploring the software we have on our server:

dpkg --list

If you see something that you know is surely unneeded remove it by writing:

sudo apt-get remove packageName

Have in mind that this is more of an advanced step for users that surely know what their Linux servers don’t need. This will greatly depend on your coding language and the services you use for trading.

The next thing that we can do is to disable unwanted services. To get a list of services run:

service  --status-all

. To disable a service issue the following command:

service serviceName stop

How to protect my API keys on the cloud?

Protecting your API keys on the cloud (or anywhere else) is very important. Usually, newer traders tend to place them inside of the trading script, an environment file, inside docker containers, or manually export the API keys to the environment where the script is executed.

All of these aren’t the safest options. If your trading server is hacked your environment files and code files can be accessed. If your code is obfuscated, you can’t really be sure that there isn’t a person that knows how to de-obfuscate it.

The files in a docker container can be simply printed out. Although, Docker did recently add something to protect secrets inside of its containers.

As I dislike the practice of having env files with your API keys ready to be read, I often use the AWS KMS (Keyword Manager Service) to securely store my API keys and read them when needed with the AWS SDK.

How to protect my API keys with AWS KMS service?

Where can I learn more about security?

Closing thoughts

In this article, we have covered some of the ways that you can secure your trading servers and algorithms. This is in no way an exhaustive list but it is something that will make you more conscious of your privacy and security when trading.

You can use this article as an introduction to these topics, and if it turns out to be useful I’ll create more deep dives into topics of interest. Before you go, keep this sentence in mind: “Everything is hackable if given enough time”.