Blockchain Transaction Lifecycle Security Standard Audit Framework

Contents | next: Tamper-Proof Logs

Use Strong Authentication

Statement of Requirement

All Roles MUST implement strong access control using industry-standard mechanisms

See it in the specification

Applicability

All Roles

Purpose

Minimize the risk that unauthorized parties can operate on transactions

Audit Procedure

Verify that Role implements industry-standard access control for all functions

Success Criteria

• A strong access control system is in place for all functionality, with industry-standard mechanisms for authentication

Best Practice

• Implement automated Role-based Access Control (RBAC)
• Configure access requirements, enforcing Multifactor Authentication and password/passphrase entropy requirements to provide sufficient security.
• Regular review of access control systems by the security team

Failure Criteria

• There is no RBAC mechanism or it is possible to sign other than through an appropriate control in the RBAC system
• It is possible to sign a transaction without using Multifactor Authentication

Key Evidence

• Mechanism for Enable Transaction Policies for Signing defining Access Control rights in terms of roles.

Contents | next: Tamper-Proof Logs