BTA CBSP study plan

Define the CIA triad plus non-repudiation and availability constraints as they apply to distributed ledgers, writing your own one-paragraph definition of each.

Diagram the anatomy of a block (header fields, Merkle root, parent hash, nonce) and label what an attacker could tamper with at each layer.

Compare hash functions, digital signatures, and Merkle proofs by stating one security property each provides and one failure mode each permits.

Explain how consensus finality assumptions (probabilistic vs. deterministic) change the security model of a chain.

Differentiate symmetric, asymmetric, and hash-based primitives and match each to a concrete blockchain use case (wallet signing, address derivation, integrity checks).

Trace a transaction end to end from key signing through mempool admission, block inclusion, and confirmation, noting where trust boundaries sit.

Identify at least four key-management failure modes (weak entropy, key reuse, exposed keystore, hot-wallet sprawl) and the compensating control for each.

Distinguish on-chain, off-chain, and cross-chain data flows and describe the trust assumption introduced at each boundary.

Categorize at least ten attack vectors (reentrancy, oracle manipulation, flash-loan-assisted exploits, front-running, phishing, key theft, consensus attacks, bridge exploits) by target layer and attacker capability.

Explain the mechanics of reentrancy and integer issues well enough to describe the vulnerable pattern and the defensive pattern without notes.

Map each attack category to at least one real-world incident class and state which control failed.

Build a threat model for a simple token contract using an asset/actor/entry-point structure.

Apply secure development practices (checks-effects-interactions ordering, reentrancy guards, access-control modifiers, pull-over-push payments) to a code-review checklist.

Describe the role of static analysis, fuzzing, and formal verification in a smart contract assurance program and state the limits of each.

Explain how oracle design and price-feed selection reduce manipulation risk.

Draft input-validation and authorization requirements for an on-chain function that moves value.

Design a key-management architecture separating hot, warm, and cold custody with defined approval thresholds.

Specify monitoring and detection requirements for anomalous on-chain activity, including what events to alert on and who receives them.

Compare multisignature, MPC, and hardware-module custody options on threat coverage and operational cost.

Define secure deployment and upgrade controls, including timelocks and role separation.

Build a risk register with at least eight entries scored on likelihood and impact, each with an owner and treatment decision.

Map applicable obligations (AML/KYC, data protection, disclosure duties) to internal controls without asserting jurisdiction-specific legal conclusions you cannot verify.

Draft an incident response runbook with detection, triage, containment, eradication, recovery, and post-incident review stages.

Define evidence and logging retention requirements that support audit and forensic reconstruction.

Walk through a simulated key-compromise incident and produce a timeline of containment actions and communications.

Explain chain-of-custody and forensic preservation requirements for on-chain and off-chain evidence.

Describe third-party and vendor risk assessment steps for bridges, oracles, and custodians.

Practice writing a regulator- or customer-facing incident notification that states facts without speculation.

Consolidate all five domains into a single concept map linking primitives, threats, controls, and governance obligations.

Re-teach the three weakest concepts from prior weeks in your own words without reference material.

Complete timed practice sets weighted to the domain percentages and log every missed item by domain.

Close remaining knowledge gaps by writing a short corrective note for each missed item.