CryptoCurrency Security Standard (CCSS) Aspect 1.04

1.04.1 Grant/Revoke Documentation

Aspect Control Overview: This aspect requires checklists covering all tasks completed when personnel vacate or transition into key-holder roles.

Checklists must exist and outline all grant and revoke activities. To ensure adherence to least privileged principles while granting necessary permissions as required, these checklists are reviewed by knowledgeable personnel. Proper documentation minimizes risks associated with overlooked privileges or retained access to key material by individuals who no longer require it.

1.04.2 Approved Communication Channel

Aspect Control Overview: This aspect requires that all key-holder grant and revoke requests are conducted exclusively through Approved Communication Channels. The use of Approved Communication Channels provides strong assurance of the identities of all parties involved in the grant/revoke processes. This reduces a variety of risks including impersonation, unauthorized privilege changes, or fraudulent access.

Approved Communication Channels is defined in the CCSS glossary as: A communication channel that provides high confidence of the identities of the communicating parties. This could be a voice call where the sound of their known voice is verified, a digitally-signed message (using strong encryption such as PGP/GPG or S/MIME), or a combination of multiple separate channels that are unlikely to be simultaneously compromised, such as an email + an SMS message + an instant message via Slack. (https://cryptoconsortium.org/cryptocurrency-security-standard-auditor-ccssa-glossary/) 

1.04.3 Grant/Revoke Audit Trail

Aspect Control Overview: This aspect ensures that grant/revoke processes include a verifiable and accountable audit trail. The checklists record the identity of personnel performing each grant or revoke. Each entry is attested to by the individual who carried out the task, which maintains the integrity of the records and reinforces accountability. An audit trail validates the proper completion of procedures and supports post-event review, investigation, or compliance verification.

Click to learn more about the CCSS.

This article was written by Shreya Patel.