This document discusses the threats, risks, and controls related to:<\/p>\n
systems that provide digital asset custodian services and\/or exchange services to their customers (consumers and businesses) and management of security when an incident occurs;<\/p>\n<\/li>\n
asset information (including the signature key of the digital asset) that a custodian of digital assets manages.<\/p>\n<\/li>\n<\/ul>\n
This document is addressed to digital asset custodians that manage signature keys associated with digital asset accounts. In such a case, certain specific recommendations apply.<\/p>\n
The following is out of scope of this document:<\/p>\n
core security controls of blockchain and DLT systems;<\/p>\n<\/li>\n
business risks of digital asset custodians;<\/p>\n<\/li>\n
segregation of customer\u2019s assets;<\/p>\n<\/li>\n
governance and management issues.<\/p>\n<\/li>\n<\/ul>\n
| PDF Pages<\/th>\n | PDF Title<\/th>\n<\/tr>\n | ||||||
|---|---|---|---|---|---|---|---|
| 2<\/td>\n | National foreword <\/td>\n<\/tr>\n | ||||||
| 7<\/td>\n | Foreword <\/td>\n<\/tr>\n | ||||||
| 8<\/td>\n | Introduction <\/td>\n<\/tr>\n | ||||||
| 9<\/td>\n | 1 Scope 2 Normative reference 3 Terms and definitions <\/td>\n<\/tr>\n | ||||||
| 10<\/td>\n | 4 Abbreviated terms <\/td>\n<\/tr>\n | ||||||
| 11<\/td>\n | 5 Basic description of a model of online system for digital asset custodianship 5.1 General 5.2 Example of a system for digital asset custodians and its functional components <\/td>\n<\/tr>\n | ||||||
| 12<\/td>\n | 5.3 Examples of transactions <\/td>\n<\/tr>\n | ||||||
| 13<\/td>\n | 5.4 Description of keys used for signature and encryption 5.4.1 Type of keys <\/td>\n<\/tr>\n | ||||||
| 14<\/td>\n | 5.4.2 Flow for key generation and key usage <\/td>\n<\/tr>\n | ||||||
| 16<\/td>\n | 5.4.3 Using multiple keys 5.4.4 Suspension of keys 5.5 Characteristics of digital assets held in DLT \/ blockchain systems 5.5.1 General 5.5.2 Importance of signature keys <\/td>\n<\/tr>\n | ||||||
| 17<\/td>\n | 5.5.3 Diversity of implementations 5.5.4 Possibility of blockchain forks <\/td>\n<\/tr>\n | ||||||
| 18<\/td>\n | 5.5.5 Risks for unapproved transactions 6 Basic objectives of security management for digital asset custodians <\/td>\n<\/tr>\n | ||||||
| 19<\/td>\n | 7 Approaches to basic security controls <\/td>\n<\/tr>\n | ||||||
| 20<\/td>\n | 8 Digital asset custodians\u2019 risks 8.1 General 8.2 Risks related to the system \/ platform of the digital asset custodian 8.2.1 General <\/td>\n<\/tr>\n | ||||||
| 21<\/td>\n | 8.2.2 Signature key risks <\/td>\n<\/tr>\n | ||||||
| 24<\/td>\n | 8.2.3 Risks on asset data 8.2.4 Risks related to suspension of systems and operations <\/td>\n<\/tr>\n | ||||||
| 25<\/td>\n | 8.3 Risks from external factors 8.3.1 General 8.3.2 Risks related to the internet infrastructure and authentication infrastructure <\/td>\n<\/tr>\n | ||||||
| 26<\/td>\n | 8.3.3 Risks inherent to digital asset DLT systems \/ blockchains <\/td>\n<\/tr>\n | ||||||
| 27<\/td>\n | 8.3.4 Risks arising from external reputation databases and anti-money-laundering regulations <\/td>\n<\/tr>\n | ||||||
| 28<\/td>\n | 9 Consideration on security controls of digital asset custodians 9.1 General 9.2 Basis for considerations about security management <\/td>\n<\/tr>\n | ||||||
| 29<\/td>\n | 9.3 Considerations about security controls on digital asset custodians 9.3.1 Guidelines for the information security management 9.3.2 Information security policies 9.3.3 Organization of information security 9.3.4 Human resource security 9.3.5 Asset management <\/td>\n<\/tr>\n | ||||||
| 30<\/td>\n | 9.3.6 Access control <\/td>\n<\/tr>\n | ||||||
| 31<\/td>\n | 9.3.7 Security controls on signature keys <\/td>\n<\/tr>\n | ||||||
| 35<\/td>\n | 9.3.8 Physical and environmental security <\/td>\n<\/tr>\n | ||||||
| 36<\/td>\n | 9.3.9 Operations security <\/td>\n<\/tr>\n | ||||||
| 38<\/td>\n | 9.3.10 Communications security <\/td>\n<\/tr>\n | ||||||
| 40<\/td>\n | 9.3.11 Supplier relationships 9.3.12 Information security incident management 9.3.13 Information security aspect of business continuity management <\/td>\n<\/tr>\n | ||||||
| 41<\/td>\n | 9.3.14 Compliance 9.4 Other digital asset custodian system specific issues \u2014 Advance notice to user for maintenance <\/td>\n<\/tr>\n | ||||||
| 43<\/td>\n | Bibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":" Blockchain and distributed ledger technologies. Security management of digital asset custodians<\/b><\/p>\n |