►
Description
Governance and Audit of Blockchain Networks - Scott Perry, Schellman
While blockchain technology creates strong cryptographic controls securing the integrity of data, successful, cooperative blockchain networks must establish trust between a variety of independent entities to create overall trust. In this presentation, Scott Perry will discuss how trust is created in at the blockchain layer of a Web 3.0 architecture stack that add trust within interoperable parties and reliance on external blockchains. As a Steering Committee member of the Trust Over IP Foundation, a Principal at Schellman leading a Crypto and Digital Trust practice and author of the first robust trust assurance model for blockchains, he will discuss how all blockchains networks can add accountability within stakeholder roles to ensure that blockchains are trustworthy above the embedded cryptographic trust assertions. The target of this presentation is leaders and participants in industry who are seeking greater acceptance and assurance in the trustworthiness of their network. Come learn which role systems auditors, cybersecurity professionals, and risk management experts will have to play to ensure trust must be built and maintained when adopting such cutting-edge technologies.
Sessions Details & Slides (if available): https://sched.co/14H48
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)
A
A
But
this
is
a
larger
audience
and
it
is
a
larger
topic,
and
this
is
a
lot
more
meaningful
topic
and
hopefully
you'll
get
some
out
of
this,
and
you
could
take
that
back
to
the
organizations
that
are
building
blockchains
and
talk
a
little
bit
about
a
topic.
That's
going
to
be
absolutely
key
in
that.
So
let
me
just
introduce
myself.
My
name
is
Scott
Perry,
so
I
am
a
I.T
auditor
by
trade
I'm,
a
crypto
auditor
by
trade
I'm,
a
certified
web
trust
auditor
and
I
audit.
A
The
traditional
use
of
cryptography
in
the
marketplace
with
certificate
authorities,
I
audit
public
certificate
authorities
that
protect
the
web.
I
audit,
a
digital
signature
certificate
authorities
that
issue
higher
level
security
credentials
to
U.S
government
contractors
and
agencies
for
their
purpose
for
high-level
communication.
Seven
years
ago,
I
started
a
journey
just
like
a
lot
of
all
of
you
did
in
moving
into
other
uses
of
cryptography
with
the
Advent
of
Bitcoin.
How
can
we
take
advantage
of
that,
especially
in
the
use
of
digital
identity?
A
And
so,
if
you
want
to
know
more
about
the
trust
over
IP
Foundation
I'll
be
talking
a
little
bit
about
that.
But
we
have
a.
We
have
a
place
upstairs
on
the
third
floor
and
we
can
more.
You
know
more
than
happy
to
talk
about
some
of
the
things
we're
doing
we're,
also
having
a
mini
Summit
later
this
week
as
part
of
the
open
source
Summit,
that's
going
on
here
in
Dublin,
and
so
I've
also
been
involved
on
this
topic
for
quite
a
bit
and
I've
I've
written
some
things.
A
I've
contributed
to
a
book.
That's
in
the
bottom,
that's
was
authored
and
the
main
contributor
is
Drummond
Reed,
my
co-chair
at
the
trust
over
IPS
governance
stack
working
group,
and
so
he
is
speaking
at
this
conference,
and
so
you
could
also
touch
base
with
him.
He's
also
someone
very
knowledgeable
about
the
topic
I'm
going
to
talk
about
today.
But
here's
the
deal.
So
why
is
this
topic
relevant?
So
you've
done
all
your
proof
of
Concepts
and
I've
been
basically
a
very
lonely
person
in
this
space.
A
So
I've
been
actively
involved
in
moving
forward
with
accreditation
schemes
in
a
number
of
countries,
the
U.S
Canada,
the
UK
small,
a
small
monarchy
in
the
middle
of
Asia
and
others
that
have
been
talking
to
me
about
governing
authorities
and
and
governance.
And
how
do
you
manage
the
tech
here,
and
so
the
tech
is
involved
around?
How
do
you
manage
governance?
What's
unique
about
blockchain
is
is
in
its
decentralized
properties.
You
need
to
cooperate
under
a
governance
framework.
It
is
critical.
A
Okay,
you
don't
have
essential
Authority
dictating
certain
things.
You
need
to
come
together
and
you
need
to
have
a
process
whereby
which
those
governance
standards
make
sense
and
IT
addresses
risk,
and
then
it
can
be.
Actually
you
can
build
in
accountability
of
those
that
are
participating
in
blockchain
networks
for
for
risk
mitigation,
so
I'm
a
risk
guy
we're
going
to
talk
a
lot
about
risk
in
this
presentation.
Okay.
A
A
We're
moving
from
just
getting
information,
that's
a
low
risk,
read-only
type
of
things
to
collaborating
with
a
global
population
and
then
moving
now
with
actual
digital
assets
of
value
exchanged.
Risk
profiles
are
increasing.
We
need
to
manage
the
risk
associated
with
the
issuance
of
these
credentials,
the
transference
of
these
credentials
and
the
verification
of
these
credentials,
plus,
as
we
move
to
more
verifiable
digital
identity.
A
So
if
the
trust
over
IP
Foundation,
our
main,
this
is
the
you
know,
we
have
presentations
on
what
we
call
the
stack.
The
stack
is
an
architectural
model
that
is
broken
into
two
halves:
a
technology
end
where
you
have
multiple
players
in
a
variety
of
different
layers,
one
including
a
data
public
utility
layer
that
includes
blockchain.
If
that's
what
the
option
is
in
the
particular
area,
but
this
is
where
a
blockchain
can
reside,
and
then
you
have
the
wallet
layer,
peer-to-peer
communication.
A
Now,
what's
nice
about
this,
is
that
that
the
trust
over
IP
Foundation
has
recognized
that
we
have
to
match
all
of
these
layers
with
governance
at
each
layer,
because
the
governance
of
a
public
utility
is
going
to
be
different
than
the
governance
of
the
issuers
and
the
verifiers
okay,
different
rules
and
different
organ
different
structures
in
order
to
mitigate
risk
at
different
levels.
So
it's
the
risk
that
happens
at
different
places
and
you
need
to
match
your
governance
structure
to
manage
and
mitigate
that
risk.
A
Now
at
the
public
utility
layer.
Obviously
you
see
that
blockchain
has
a
role
here.
It's
not
the
only
role
we
can
deal
with
decentralized
file
systems.
What
we're
trying
to
do
in
in
a
in
this
particular
environment
is
to
get
the
links
out
to
public
keys
and
now
that
we
have
a
new
w3c
standard
on
on
decentralized
identifiers,
we're
going
to
get
there
quicker.
We
needed
that
endorsement.
That's
a
major
movement
into
endorse
this
technology.
Now
we
have
structures
associated
with
that,
but
we
don't
have
governance.
A
Okay,
we
don't
have
standards
associated
with
with
governance
of
blockchains
or
other
decentralized
file
systems,
and
that's
what
we're
going
to
talk
talk
about
today.
We
need
to
govern
all
of
the
roles
associated
at
this
level.
I
mean
we
have
a
governance
Authority
for
blockchains.
We
have
stewards
and
nodes,
we
have
the
operation
of
The
Ledger.
All
all
of
these
things
have
struck
need
to
have
structure,
to
address
risk,
we're
going
to
talk
about
those
risks.
A
So
let's
talk
about
governance
and
let's
talk
about
a
governance
process,
because
all
of
you,
I
assume,
is
not
governance,
experts
and
they're
just
trying
to
get
knowledge
of
what
is
this
topic
about
governance?
This
is
the
model,
that's
the
most
best
I'd
say
the
most
generally
accepted
model
for
governance,
and
it
starts
with
risk.
What's
risk
risk
are
what
could
happen
to
your
blockchain
network
or
what
you
can?
What
can
happen
in
it?
A
Processing
in
general
and
they're,
broken
up
to
the
likelihood
happening
and
the
impact
of
it
happening
and
both
need
to
be
considered.
Okay
and
it's
it's
a
doom,
it's
a
doom.
You
know
it's
a
doom
day
scenario.
It's
forget
about
any
governance
requirement
or
any
controls
that
you
have
in
place
or
any
of
the
cryptographic
controls
that
even
exist
in
in
blockchain.
You
need
to
consider
what
could
happen
in
general,
the
use
of
blockchain
and
the
reason
why
I've
been
so
Advocate
about
attending
and
being
involved
here
is
blockchain.
A
The
structure
itself
mitigates
risk,
which
is
a
great
thing,
but
it
doesn't
do
everything
and
that's
a
challenge
that
I
hear
is.
We
could
just
press
automated
controls,
but
automated
controls
are
run
by
humans,
humans,
Define
them.
They
have
to
establish
those
requirements
to
address
the
risks
so
that
all
participants
can
address
the
risk
fairly
and
clearly
what
their
role
is
in
ecosystems
in
a
decentralized
network.
A
Now,
if
they're,
not,
if
there's
exceptions
to
the
things
that
you're,
that
your
that
organizations
are
supposed
to
be
meeting
and
they
come
up
with
non-conformance
to
the
requirements,
they
need
to
be
reviewed
to
see.
Okay,
is
there
outstanding
risk?
What
does
that
mean?
Do
we
drop
a
node
because
they're
not
participating
in
the
way
that
we're
expecting
them
to
do?
This
is
a
collaborative
government
process.
This
is
a
dictatorial
as
we're
dealing
with
a
decentralized
governance,
but
that
doesn't
change.
A
It
needs
to
follow
this
process
and
to
move.
So
my
presentation
is
going
to
go
into
some
of
the
areas
and
we're
going
to
start
with
risk,
so
my
professional
Society
isaka
has
looked
at
blockchain
and
has
identified
five
categories
of
risk
and
I'm
not
going
to
go
into
the
details
of
this.
My
presentation
is
available
and
you
can
you
can
review
that,
but
but
it
starts
with
governance.
A
How
are
you
managing
really
all
the
the
the
the
oversight
guidelines
of
how
it
works,
the
choice
of
consensus,
algorithms,
the
the
the
acceptance
in
a
permissioned
ledger
of
nodes
to
the
network?
How
are
you
managing
that?
How
what
what
requirements
are
you
putting
on
these
nodes
so
that
they
participate?
If
it's
permission,
if
it's,
if
it's
access
rules
to
add
records
to
The
Ledger?
What
are
those
rules
and
is?
Are
those
rules
transparent
and
is?
Does
it
effectively
manage
the
risk
of
the
data
that's
exposed
within
the
blockchain
Okay,
so.
A
Governance
is
key.
The
infrastructure
supporting
the
activity
with
it
within
the
network
has
risks
how
the
operation
of
a
consensus
mechanism
or
the
management
structure
or
interoperability
with
other
blockchains,
as
we've
talked
a
little
bit
at
the
conference
today.
Is
it
going
against
standards
and
and
are
they
operating
it
does?
Does
all
of
the
nodes?
Have
appropriate
software
vulnerability
Management
in
place?
Can
we
trust
it
and
that's
what
relying
parties
and
jurisdictions
want?
They
are
looking
for,
an
organization
that
is
managing
their
risk
and
managing
the
things
associated
with
it.
How
about
the
data
itself?
A
Okay?
How
is
off
chain
and
on-chain
data
interacting
okay,
and
and
is
the
data
truth
treated
as
a
source
of
Truth
for
the
business
for
a
business
purpose?
Is
there
proper
evidence
in
transactions?
Okay,
some
things
can
be
Unchained.
Some
things
can
be
off
chain,
but
the
overall
view
of
both
pieces
need
to
be
considered.
A
Key
Management
we're
dealing
with
keys
in
a
blockchain
environment.
How
are
you
managing
Keys,
okay,
as
well
as
in
the
smart,
since
we
have
the
novel
opportunity
to
use?
You
know
automated
controls
in
a
smart
contract
within
blockchains?
How
are
these
smart
contracts
operating
we're
going
to
go
into
that
in
a
little
more
depth?
A
So
in
blockchain
governance,
I'm
just
going
to
point
out
a
couple
of
pieces,
you
know
we're
dealing
with
another
one.
That's
not
on
the
list
is
that
a
consensus
algorithm
is
insufficient
to
detect
the
protocol
and
smart
contract
changes.
So
these
are
technical
level.
Governance
risks
that
deal
with
the
operation
of
a
blockchain,
and
these
are
key.
Some
of
these
are
you
know
they
could
be
catastrophic,
okay
to
an
organization.
A
What
are
those
controls
we're
just
going
to
give
permission
to
any
entity
that
wants
to
operate
or
do
they
have
to
meet
certain
governance
standards?
Okay,
so
the
risk
is
that
we're
just
willy-nilly
giving
access
to
an
organization
that
doesn't
play
by
the
rules.
Okay,
and
we
want
to
make
sure
that
the
you
know
from
an
infrastructure
standpoint.
A
A
Because
the
key
thing
in
this
particular
slide
is
I,
can
sign
and
put
on
the
blockchain
a
lie?
Okay,
just
because
it's
on
the
blockchain
doesn't
mean
that
it's
that
that
it
actually
is
the
source
of
Truth
it.
Maybe
it
has
an
imperfect
evidence
supporting
the
data
in
and
that
could
be
a
very
key
risk
in
this
area.
We
want
to
make
sure
that,
if
we're
putting
records
on
an
immutable
source
of
truth,
that
is
the
source
of
Truth,
okay,.
A
And
then
Key
Management,
obviously
you
know
as
we're
dealing
with
cryptography.
The
protection
of
the
private
key
is
absolutely
critical
and-
and
you
know
if
we're
expect,
if
we're
extending
private
keys
to
people
that
are
not
familiar
with
the
careful
consideration
and
management
of
those
keys,
that's
a
high
risk
so
who
we,
who
are
we
giving
control
to
Key
Management
to,
and
are
they
knowledgeable
in
doing
that?
And
we
want
to
make
sure
that
that
they're
appropriately
managing
the
risk
that
they
have
within
this
infrastructure
and
the
technology.
A
Finally,
within
smart
contracts,
the
key
things
around
smart
contracts
and
the
risk
is
the
lack
of
business,
Regulatory
and
legal
enforcement
governments
don't
understand
smart
contracts,
they
don't
know
if
it's
enforceable
and
so
it's
very
key
to
have
a
transparent
need
of
what
are
the
smart
contracts.
How
does
it
operate?
How
is
it
being
controlled,
because
the
key
thing
is
having
smart
contracts
written
and
not
having
you
know
the
governmental
approval
and
endorsement
of
of
those
of
those
situations,
contracts,
agreements
as
well
as
as
we
let's
say,
we
find
errors.
A
A
So
if
we
look
on
the
governance
side,
what
is
available
in
the
marketplace
to
give
guidance?
Okay,
ISO
has
put
together
a
technical
specification.
Okay,
this
is
not
a
standard.
Okay
I
want
to
be
clear
about
that.
Sometimes
they
have
advisory
reports.
Sometimes
they
have
specifications
they
you
know
so.
Iso
has
technology
governance
as
part
of
standards
and
technical
specifications.
They
you
know,
ISO
looked
at
blockchain
and
set
aside
some
governance
considerations.
A
Around
the
managements-
and
so
if
you
want
to
pay
I,
think
280
some
odd
US
Dollars
you
can
go
and
access.
This
is
a
valuable
piece
of
information,
but
I
I.
Think
if
you
don't
want
to
pay
for
it,
there
are
other
governance,
standards
and
models.
So
my
associate
that
works
with
me
within
the
trust
over
IP
Foundation
is
leading
the
IEEE
blockchain
governance
standard.
Her
name
is
Savita
faruki.
A
And
Savita
they
are
just
ready
to
publish
a
governance
document
on
blockchain
and
IEEE
is
a
valued
source
of
information
and
a
body
to
to
to
be
listened
to
and
their
focus
as
it.
You
know
we
always
look
at
you,
know:
machine,
readable
governance
and
all
that
deals
with
the
core
tenants
that
I've
been
sharing
with
you.
It's
the
people,
it's
a
still
a
people
managed
process,
initially
people
process
policy
and
practices.
These
are
the
standard
set
when
you're
right
when
you're
addressing
risk
they're
driven
by
that.
A
But
what's
neat
about
it,
she
calls
it
the
4p
plus
I
is
there
is
incentives
in
a
blockchain
network?
You
need
to
consider
how
the
incentives
are
built
in
the
other
novel
thing
that
IEEE
has
done
is
they've
they've
talked
about
how
governance
gets
applied
to
the
different
components
of
a
block
of
a
blockchain?
A
This
is
the
table
of
contents,
and
these
are
subsequent
other
pieces
of
information
that
need
to
be
considered
when
you're
developing
the
governance
rules.
Okay,
what
you
know
who's
the
authority
who's
administering
it.
What
purpose
do
you
have
for
this?
What
is
the
overall
scope
the
boundaries
of
control?
What
are
the
objectives
of
the
blockchain
network?
A
A
If
you
want
to
demonstrate
that
you're
that
you're,
you
have
a
process
in
place
to
to
hold
the
players
that
are
participating
in
this
governance
framework
accountable
and
there's
also
a
a
guidance
document
to
explain
the
very
the
varying
means
of
of
trust
Assurance,
you
could
self-attest,
you
could
have
third
party
Auditors,
you
can
have
an
ISO
certification
built
in.
There
are
different
degrees
based
on
the
risk
that
you're
trying
to
mitigate.
A
So,
basically,
at
the
end
of
the
day,
from
a
governance
standpoint,
you
have
a
constitution
and
the
Constitution
needs
to
be
available
transparent
so
that
those
that
that
are
looking
to
rely
upon
it
understand
its
rules.
Transparency
is
key
and
that's
what
I
don't
see
in
the
marketplace
today,
I
see
a
lot
of
very
Innovative
blockchains,
but
I,
don't
know
what
their
underlying
governance
is
is
trying
to
move
forward.
How
are
they
mitigating
risk?
How
why
should
I
trust
it?
A
A
One
of
the
first
things
that
happened
when
the
UK
issued
a
digital
trust
framework
is,
they
said
we
need
an
accreditation
standard
body
associated
with
it
and
we
need
to
Institute
some
certification
bodies
and
Auditors
around
individual
individual
companies
that
want
to
add
to
our
identity
infrastructure,
and
so
my
firm
is
one
of
the
first
audit
firms
that
will
be
auditing
in
the
UK,
the
identity
proofers.
The
certificate
the
certificate
issuers
of
of
identity,
as
well
as
those
that
manage
kind
of
the
orchestration
layer
underneath
it
all
right.
A
Then
it
needs
to
organize
with
audit
accreditors
that
set
aside,
that
that
will
accredit
Auditors
that
will
will
audit
governed
parties,
participants
in
the
blockchain
network,
against
the
governance
framework
and
a
test
that
they
are
meeting
the
requirements
of
the
governance
framework
and
and
for
the
items
that
are
not.
They
will
be
included
in
a
compliance
report
so
that
the
residual
risk
that
exists
from
non-conformance
can
be
considered.
A
So
the
trust
Assurance
framework-
you
know
there
are
variances
around
that.
Well,
what
is
the
scope
of
it?
Okay,
are
we
dealing
with
you
know?
What
are
the
roles
that
would
be
audited
the
players,
the
nodes
of
a
blockchain
network?
You
may
be
self-auditing
the
governing
authorities.
The
jurisdiction
wants
to
make
sure
that
they're
having
governance
processes
that
are
appropriately
mitigating
risk.
A
Is
there
levels
of
assurance
that
we
can
provide
in
tears.
Maybe
you
know
we're
issuing
credentials
that
have
a
variety
of
different
you
know
means
in
the
marketplace,
for
example,
a
digital
identity.
Credential
that's
used
extensively
like
driver's
licenses.
Maybe
you
know
the
the
level
of
assurance.
We
need
to
know
about
that
person
that
person's
identity
is
more
than
a
credential
issued
for
a
membership
at
a
gym
okay.
A
So
we
really
need
to
understand
what
is
the
risks
Associated
with
with
the
issuance
of
data
records
on
a
blockchain
associated
with
a
with
an
ecosystem,
around
digital
trust
and
are
are
the
players
measured
against
the
level
of
assurance
that
that
would
meet
their
needs
and
when
that
is
a
so
when
that's
done,
we
have
governance
framework
and
we
have
trust
criteria
that
governing
governed
parties
need
to
ascribe
to
okay.
Now
in
the
marketplace,
your
companies
are
dealing
with
a
lot
of
compliance
Frameworks
and
they
have
to
assert
that
they're
meeting
certain
criteria.
A
That's
what
that
is.
You
know
if
you
look
at
PCI,
they
have
a
set
of
criteria
that
organizations
you
know.
You'll
have
a
third
party
auditor
audit
against
that
criteria
and
the
process
of
managing
you
know
the
audit
processing.
You
know
getting
data
from
Auditors
evaluating
the
results,
feeding
back
the
process
to
see
if,
if
there
are
improvements
that
are
required
by
by
you
know,
organizations
that
are
not
conforming
to
certain
criteria.
A
The
U.S
government
is
very
tough
on
that.
The
new
there
is
a
new
accreditation
scheme
called
cmmc
and
it
deals
with
controlled
information
from
the
U.S
government,
and
there
are
Auditors
that
are
going
into
government
contractors
and
will
will
evaluate
how
they
are
managing
the
that
controlled
information.
A
So
in
the
marketplace,
what
guides
you
know
the
development
of
I.T
for
the
last
30
years
has
been
an
organization
called
Koso,
or
he
sponsor
the
the
committee
of
sponsoring
organizations
and
they
had
developed
a
long
time
ago.
Internal
controls
for
financial
reporting,
which
was
the
embodiment
to
the
United
States
socks,
sarbanes-oxley
controls.
A
A
They
took
a
you,
know,
dissected,
those
and
applied
that
information
to
blockchain,
and
so,
if
you
Google
this,
you
know
Koso
blockchain,
internal
control,
I
think
this
is
a
valuable
piece
of
information
guidance
and
on
at
least
some
aspect
of
things
that
you
can
consider
in
adding
and
making
sure,
at
least
from
a
Readiness
standpoint.
Does
your
blockchain
meet
these
core
I.T
related
control?
Sets.
A
Now,
what
I
see
in
the
marketplace?
There
isn't
a
blockchain
standard
that
you
can
just
you
know,
get
a
trust
mark
on,
but
there
are
other
Associated
compliance
schemes
that
are
active
in
the
marketplace
that
many
blockchain
organizations
are
subscribing
to
another
one
was
nist
for
cyber
security.
I.
Remember
that
crypto.com
was
saying
we
got
this
for
cyber
security,
but
these
are
generally
accepted
schemes
in
the
marketplace
that
many
blockchain
organizations
are
subscribing
to,
especially
in
sock
sock
doesn't
have
necessarily
specific
controls
on
blockchain.
A
Now
you
know,
when
I
did
a
survey
of
what
could
I
as
an
auditor
use
in
the
marketplace
to
help
in
audits.
I
I
came
up
with
a
lot
of
crypto
stuff,
so
in
the
crypto
currency
Marketplace
there
has
been
a
you
know,
a
demand.
You
know
for
tools
to
be
used,
interrogation
tools
on
on
data,
that's
either
on
chain
or
off
chain,
and
so
that's
where
a
lot
of
things
are,
but
the
conversations
that
we're
having
this
week
doesn't
necessarily
fall
into
this.
A
But
these
tools
could
be
used
on
that,
but
I'd
like
to
see
better
set
of
tools
related
to
the
blockchain
environments
that
you're
building
okay,
because
this
is
very
focused-
you
know
on
the
D5
crypto
side,
not
happy
there
now
I'm
a
smart
contract
audit.
So
my
firm
is,
you
know:
I'm
developing
a
smart
contract
audit
service
within
my
firm
shelman
and
right
now
in
the
marketplace.
A
If
you
want
a
smart
contract
audit,
you
get
very
detailed
interrogation
of
the
execution
of
smart
contract
audit,
and
these
three
are
tools
that
smart
contract,
audit
organizations
use
I
mean
I,
don't
know
all
of
it
but
I.
You
know:
I
am
working
with
my
vulnerability
assessments
organizations
because
they
get
down
into
the
code
and
smart
contracts
you're
going
to
have
to
get
down
in
the
code,
but
what
I?
A
So
my
final
slide
is
this:
just
a
couple
of
action:
steps
for
people
in
the
room
and
your
organizations?
So
if
you,
if
risk
assessment,
is
a
new
term
in
your
environment,
learn
about
it.
Take
the
slides
here.
Contact
me
do
a
risk
assessment
if
risk
assessment
drives
the
accountability
and
the
viability
of
the
of
the
services
that
you're
bringing
to
Market.
A
Okay,
sometimes
the
people
that
are
running
your
your
your
network
are
different
from
the
people
operating
it.
You
need
to
have
some
Synergy
around
your
operations
and
your
governance
to
make
sure
that
they're,
both
in
they're
both
consistent
with
the
objectives
of
each
other,
so
also
make
sure
that
all
of
your
all
of
the
participants
are
accountable
for
actions
that
you
expect
them
to
make.
What
are
the
measures
that
you're
placing
to
get
assurance
that
players
are
accountable
for
the
absolute?
A
And,
finally,
you
know
assess
your
network
practices
against
your
current
and
existing
Arctic
schemes.
Do
you
need
a
tighter
audit
scheme?
Do
you
need
third
party
Assurance,
because
that's
going
to
give
you
credibility
to
the
jurisdiction
that
you
want
to
participate
in?
Basically,
it's
a
demonstration
that
we
have
our
house
in
order
and
we
are
self-managing
any
issues
that
addressed
your
concern:
government,
the
risks
that
we're
taking
here,
we're
managing
it
for
you,
and
this
is
how
we're
doing
it,
and
that
is
a
key
demonstration
to
reduce
their
concerns.
A
Now,
if
you're
executing
smart
contracts
do
a
smart
contract
audit
full
scale,
not
just
the
technical
side,
but
look
at
you
know
why
you
know
what
are
you
trying
to
accomplish
in
in
the
smart
contract
audit?
How
are
you
making
sure
that
it's
legally
enforceable,
or
at
least
enforceable
from
a
from
the
standpoint
that
you're
trying
to
get
it
executed
in
and
make
sure
that
you
have
feedback
loops
to
to
make
to
ensure
quality
goes
back
in
and
you're
learning
from
the
activity?
That's
going
on
around
your
governance
process,
so
I
just
about?
B
A
Absolutely
I
mean
don't
recreate
the
wheel,
and
part
of
you
know
if
the
guidance
that
I
put
together
in
this
trust,
Assurance
framework
does
a
survey
of
existing
regulations
and
controls.
It
is
best
to
tap
into
them
as
as
best
as
possible.
Most
organizations
are
just
going
to
take
that
because
then
you
don't
have
to
recreate
the
isos
27001
that
that
automatically
includes
a
set
of
controls
that
may
meet
your
needs.
A
Are
they
open
to
it
positively
they're?
They?
They
react
the
same
way
as
I'm
saying,
because
they
know
that
those
processes
are
tried
and
true,
as
opposed
to
a
a
a
trust
Assurance
scheme
that
gets
built
up
that
they
don't
know
if
it's
even
viable.
An
organization
with
a
certificate,
education,
body
and
accreditation
body
and
and
certified
Auditors
already
built
in
for
ISO,
is
something
that
they
they
can
trust.
C
So
in
one
of
the
slides
you
know
you
had
mentioned
about
those
risks,
regulated
risk
and
you
know
and
compliance
risks
that
drive
the
technology.
You
know,
which
is
the
requirement
per
se,
so
I'm
taking
a
you,
know,
step
back
and
another
way
of
looking
at
the
same
problem,
which
is
over
enforcing
the
you
know,
criteria
by
any
of
The
Regulators
in
the
industry,
where
you
are
approaching
blockchain
as
a
potential
solution.
So
when
I
say
over
aggressive
or
you
know
over
demanding,
you
know,
that's
a
that's
one
of
the
credit.
C
I
typically
would
happen
with
the
financial
term.
You
know
you
know
Banks
or
anything
as
such.
You
know
so
now
the
blockchain
is
a
technology
which
is
evolving.
You
know
it
has
started
with
a
certain
certain
criteria,
certain
versions,
and
now
it
has
come
to
a
level
with
that
over
demand
and
if
the
technology
is
not
able
to
sustain
that
demand
in
that
in
that
case,
what
is
your
perspective
of
looking
at
the
problem?
You
know.
C
Yeah,
but
you
know
what
I'm
saying
is
that
blockchain
is
a
different
perspective
of
looking
at
a
problem
solution.
You
know
it's
not
a
conventional
system,
you
know
which,
which
other
way
would
prob
you
know
address
every
problem
with
you
know,
bespoke
approaches
and
all
that
blockchain
has
a
certain
construct,
so
I
see
a
gap
because
you
know,
if
you
put
over
demands,
doesn't
mean
that
you
know
you
would
end
up
something
into
blockchain
just
to
satisfy
that
demand,
and
then
you
know
potentially
destroy
the
technology
itself.
A
The
other
key
thing
that
you
know
we're
dealing
with
an
in
an
environment
where,
where
the
people
overseeing
the
technology
are
uncomfortable
with
the
technology
and
it's
important
to
have
transparency
and
education,
we
need
to
now
educate.
We've
done
the
proof
of
Concepts.
We
have
a
technology
that
we
think
can
scale
and
can
change
transform
how
we
act
digitally
now.
We
need
to
prove
that
in
a
transparent
way
to
jurisdictions
so
that
they
are
comfortable
and
that's
part
of
what
this
process
is.