Chapter 11 — Web3, blockchain and cryptoasset security: assets and context
Lesson map
Lesson 11 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Inventory of ledger assets"]
N2["11.2 Stakeholders"]
N3["11.3 Protection priorities"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Inventory of ledger assets"]
N2["11.2 Stakeholders"]
N3["11.3 Protection priorities"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[11.1 Inventory of ledger assets]
|
v
[11.2 Stakeholders]
|
v
[11.3 Protection priorities]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) inventory ledger-related assets; (2) understand stakeholders; (3) set protection priorities.
11.1 Inventory of ledger assets
Lucas builds an inventory of ledger-related assets: the credit contract and its deployed address, the issuer multisig and its three signer keys, the administrator role and its timelock, three nodes with their keys and configurations, the issuing service, the booking database and backups of each. For each he records the owner, location, value to the makerspace and current protection. An inventory is the foundation of security work, because assets that are not known cannot be protected, monitored or recovered when something goes wrong with them.
11.2 Stakeholders
Stakeholders include members, workshop leaders, staff signers, the manager, the board, the developer who wrote the contract and the rack provider. Each cares about different things: members want fair credits and working bookings, signers want a manageable workload, the board wants low risk and cost. Lucas interviews three stakeholders briefly to understand their concerns. He learns that signers worry about signing something wrong, which suggests better batch summaries. Understanding stakeholders helps technologists design controls that people accept and actually use in their daily work.
11.3 Protection priorities
With the inventory and stakeholder views, Lucas sets priorities with the manager. Highest are the signer keys and the issuing service, because together they control credit creation. Next are node availability and backups, because bookings depend on them. Then the booking database's personal data. Priorities guide limited time and money: the makerspace cannot do everything at once. He records the priorities and the reasoning, and plans to revisit them after any significant change, such as adding a new type of credit or connecting to another organisation's ledger.
Worked example
Lucas inventories eleven asset types and, after stakeholder interviews, prioritises signer keys and the issuing service, then node availability.
Synthetic case. The assets and stakeholders are synthetic.
Errors and limits
Protecting assets in the order they come to mind wastes effort on low-impact items.
Exercises
- EX031 — Inventory field. Name one field recorded for each asset. Rubric: 3 = current protection;; 2 = owner;; 1 = colour;; 0 = none.
- EX032 — Signer concern. What do signers worry about? Rubric: 3 = signing something wrong;; 2 = mistakes;; 1 = vague;; 0 = none.
- EX033 — Top priority. What are the top protection priorities? Rubric: 3 = signer keys and the issuing service;; 2 = keys and service;; 1 = the website;; 0 = none.
Synthesis
Inventory, stakeholder understanding and agreed priorities direct limited security effort.
Continue studying — chapter 11 of 30
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →