Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The case and the role"]
N2["1.2 Core principles"]
N3["1.3 Practice standards"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The case and the role"]
N2["1.2 Core principles"]
N3["1.3 Practice standards"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The case and the role]
|
v
[1.2 Core principles]
|
v
[1.3 Practice standards]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) apply core security principles at work; (2) relate them to cryptoasset custody; (3) set personal practice standards.
1.1 The case and the role
Marcus Delgado is an IT and finance systems officer taking a six-month professional programme at the fictional Kestrel Professional Academy, supervised by Ms Ingrid Holm. His employer, the fictional Bayview Charity Network, has begun accepting cryptoasset donations into a multi-signature treasury wallet and converting them to local currency monthly. Every person, address and figure here is synthetic. Marcus already manages the charity's accounts and servers, and the programme helps him apply security principles to this new area responsibly, without pretending he must become a blockchain developer to do so.
1.2 Core principles
Marcus revisits core principles: confidentiality, integrity and availability; least privilege; defence in depth; separation of duties; and accountability. He applies them to donations. Integrity means every donation received is recorded correctly; separation of duties means the person recording donations is not the only person who can move funds; least privilege means signers can approve payments but cannot change the signer list alone. He writes one sentence for each principle explaining how it applies at Bayview. The exercise turns familiar principles into concrete expectations for a new kind of asset.
1.3 Practice standards
Ms Holm asks each participant to set personal practice standards. Marcus commits to: acting only within written authorisation, keeping evidence of his checks, never handling signing keys on general-purpose computers, reporting problems promptly and honestly, and asking for help when a task exceeds his knowledge. He shares the standards with his manager. Professional standards protect the practitioner and the organisation, especially in an area where mistakes can move funds irreversibly. Writing them down early makes them easier to follow when work becomes busy or pressured.
Worked example
Marcus maps five principles to Bayview's donations, such as separating recording from fund movement, and sets five personal practice standards.
Synthetic case. Marcus Delgado, Ms Ingrid Holm, Kestrel Professional Academy, Bayview Charity Network and all figures are synthetic.
Errors and limits
Treating cryptoassets as needing entirely new principles ignores well-tested security foundations.
Exercises
- EX001 — Donation flow. What happens to cryptoasset donations at Bayview? Rubric: 3 = held in a multisig treasury and converted monthly;; 2 = multisig and conversion;; 1 = spent directly;; 0 = none.
- EX002 — Separation applied. How is separation of duties applied? Rubric: 3 = the recorder is not the only one who can move funds;; 2 = different people;; 1 = one person does all;; 0 = none.
- EX003 — Least privilege applied. What can signers not do alone? Rubric: 3 = change the signer list;; 2 = alter signers;; 1 = approve payments;; 0 = none.
- EX004 — Personal standard. Name one of Marcus's standards. Rubric: 3 = never handle signing keys on general-purpose computers;; 2 = act within authorisation;; 1 = work alone;; 0 = none.
- EX005 — Standards purpose. Why do written standards matter here? Rubric: 3 = mistakes can move funds irreversibly;; 2 = irreversibility;; 1 = they do not;; 0 = none.
Synthesis
Familiar principles, applied concretely and backed by personal standards, ground cryptoasset work.