Chapter 7 — Web3, blockchain and cryptoasset security: controls and verification
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Implementing controls"]
N2["7.2 Verifying controls"]
N3["7.3 Tracking remediation"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Implementing controls"]
N2["7.2 Verifying controls"]
N3["7.3 Tracking remediation"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Implementing controls]
|
v
[7.2 Verifying controls]
|
v
[7.3 Tracking remediation]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) implement custody controls; (2) verify them with tests; (3) track remediation of findings.
7.1 Implementing controls
Following his findings, Marcus helps implement controls. The former officer is removed from the signer list through the multisig's change process, with two current signers approving. Signers receive dedicated hardware signing devices used only for treasury approvals. A recovery procedure is written: if a signer loses their device, the other two signers approve a signer replacement after identity checks, and the trustee holds sealed recovery instructions. A rule is added that large transfers above 2,500 units need all three signers. Each control traces back to a finding.
7.2 Verifying controls
Marcus verifies each control on a test network replica of the treasury with synthetic funds. A proposal approved by one signer cannot execute. A proposal with approvals from a removed signer does not count. A transfer above the large threshold with two approvals does not execute. A replacement signer can be added only with two approvals. He records each test and result. Verification on a replica allows confident testing without risk to donations, and it confirms the controls work as designed rather than as assumed.
7.3 Tracking remediation
Marcus tracks each finding in a simple register: description, owner, action, due date, status and verification evidence. All three original findings are closed within six weeks, each with evidence. He reports status monthly to the director and trustees. Tracking ensures findings do not stall after the review ends, which Ms Holm notes is common when reports are delivered and filed. A finding is closed only when verified, not when someone says it is fixed, so the register always reflects demonstrated rather than claimed progress.
Worked example
Marcus removes the departed signer, issues dedicated devices, adds a recovery procedure and a three-signer rule above 2,500, verifying each on a replica.
Synthetic case. The controls, tests and register are synthetic.
Errors and limits
Closing findings on someone's word, without verification, leaves claimed fixes unproven.
Exercises
- EX031 — Signer removal. How is the former officer removed? Rubric: 3 = through the change process with two current signers;; 2 = multisig change;; 1 = by deleting email;; 0 = none.
- EX032 — Large transfer rule. What applies to transfers above 2,500 units? Rubric: 3 = all three signers must approve;; 2 = three signers;; 1 = one signer;; 0 = none.
- EX033 — Verification environment. Where are controls verified? Rubric: 3 = a test network replica with synthetic funds;; 2 = replica;; 1 = live treasury;; 0 = none.
- EX034 — Remediation time. How long did closing all three findings take? Rubric: 3 = six weeks;; 2 = 6 weeks;; 1 = one year;; 0 = none.
- EX035 — Closure rule. When is a finding closed? Rubric: 3 = only when verified;; 2 = verified;; 1 = when reported fixed;; 0 = none.
Synthesis
Implemented, verified and tracked controls turn findings into lasting protection.
Continue studying — chapter 07 of 12
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →