Nia Labs

Module 4 of 4Threat and Cybersecurity

The cryptography every transaction rests on, four exploits that cost real money, and the controls that would have caught them. Then a vendor review your team has to sign.

Download the brochure All four modules
  • 3 sessions
  • About 5.5 hours
  • Intermediate
  • Online or in person

Outcomes

By the end of the module, you can

  1. Explain how hashing, public-key cryptography and signatures protect integrity, identity and trust.
  2. Connect those mechanisms to cyber resilience in a bank.
  3. Recognise the smart contract risk patterns behind The DAO, Euler Finance, Beanstalk and Ronin Network.
  4. Say what an audit, ISO 27001 or a SOC 2 report can and cannot tell you about a platform.
  5. Apply critical controls to private keys, seeds, signers and offboarding.
  6. Score a vendor across five dimensions and defend Approve, Approve with conditions or Reject.

Sessions

Two sessions to build it. One lab to use it.

Session 1120 minutes, virtual-live

Cryptography and security foundations

Hashing, keys and signatures, and what fails for a bank when any of them do.

  1. Hashing: the foundation of data integrity
  2. Public-key cryptography and digital signatures
  3. Cryptographic protocols in blockchain networks
  4. Cyber resilience: connecting the dots
  5. Applied check: what could go wrong?
  6. Commitments and preview
Session 2120 minutes, virtual-live

Smart contract risk and key security

Four real loss events, each introducing a distinct risk category.

  1. The DAO: when code becomes law
  2. Euler Finance: USD 197 million despite audits
  3. Beanstalk: when the rules are the weapon
  4. Ronin Network: USD 625 million, undetected for six days
  5. Monitoring, response and the three lines of defence
  6. Risk assessment practice
Session 390 minutes, virtual lab

Application lab: TradeChain Security Review Canvas

The vendor says it is secure. Teams test every claim and sign a recommendation.

  1. Briefing and team set-up
  2. Phase 1: architecture review
  3. Phase 2: smart contract assessment
  4. Phase 3: key management review
  5. Phase 4: recommendation and canvas
  6. Debrief and close

Lab spotlight

TradeChain Security Review Canvas

The bank's trade finance business wants to settle on TradeChain v2.4, a smart contract platform from the fictional Nexus Settlement Technologies. The vendor holds ISO 27001 and SOC 2 Type II, and its contracts were audited. Your team tests every claim against the vendor's own documents.

  • Approve
  • Approve with conditions
  • Reject

What teams do

  • Review five vendor documents: application brief, architecture, audit summary, key management policy, and an incident disclosure released mid-lab.
  • Track five vendor claims from unproven to supported or contradicted.
  • Score five canvas dimensions High, Medium or Low, with a control and an owner for each.
  • Cross-reference documents to find the risks no single page shows.
  • Present a recommendation and the top two reasons, then take the challenge.
Illustration of the canvas teams complete in Phase 4. Example findings are drawn from the simulated vendor file.

Four roles per team

  • Risk LeadOwns the scoring and the overall rating.
  • Compliance LeadBrings the regulatory and framework lens.
  • Audit ObserverChallenges evidence and flags gaps.
  • Decision OwnerPresents the recommendation.

What the debrief draws out

  • An audit covers the code it saw, on the day it saw it.
  • Certificates assess the company, not the contract.
  • Key management fails at the edges: offboarding, rotation, decommissioned nodes.
  • Independent monitoring is an institution-level control, not a delegated one.

Who it is for

A cross-functional room, on purpose.

No coding background needed. The module works best with Risk, Compliance, Audit and Technology in the same breakout.

Technology risk and the CISO office

Teams assessing blockchain platforms and digital asset custody.

Third-party and vendor risk

Owners of due diligence for fintech and settlement providers.

IT audit and engineering

Colleagues who must evidence, or build, the controls a reviewer asks for.

Run this module alone, or as part of the programme.

The brochure covers all four modules, the labs, the three formats and the facilitator.

Download the brochure Enquire about this module