Business Security

Protect the people

The most common security failures involve people, not cryptography. Use role-based access, phishing awareness, strong authentication, and a culture where staff can pause a suspicious request.

Never allow recovery phrases or private keys to be shared through chat, email, or support tickets.

Reduce single points of failure

Avoid designs where one person, one device, or one password can move all company funds. Separation of duties and multi-person approvals help contain human error and compromise.

Keep an up-to-date inventory of wallets, devices, accounts, and emergency contacts without exposing sensitive secrets in ordinary documentation.

Prepare for incidents

Document how to respond to a suspected compromise: who can pause activity, how to contact providers, how to preserve evidence, and who communicates internally.

Test the plan periodically. A recovery procedure that has never been tested is only an assumption.

Learning objectives

Understand organisational Bitcoin security principles, role-based access, separation of duties, custody considerations, approval workflows, incident preparation, and employee awareness.

Protect the people

Technology alone cannot protect an organisation. Phishing awareness, social-engineering resistance, fake-support and impersonation checks, least-privilege access, onboarding and offboarding procedures, and ongoing training are all part of a security culture.

For example, an employee who receives a fake support email requesting a recovery phrase should not reply or share anything. They should use the organisation's established reporting channel and independently verify the request.

Governance and responsibilities

Defined roles, approval responsibilities, treasury oversight, documented procedures, change management, and periodic review reduce operational risk by making decisions and escalation paths clearer before pressure arises.

Reduce single points of failure

Multi-person approval, separation of duties, hardware-wallet processes, custody documentation, device management, and explicit backup responsibilities can reduce reliance on one person, device, or account. These are concepts to evaluate, not product recommendations.

Prepare for incidents

Preparation can include detecting unusual activity, escalation procedures, preserving evidence, contacting relevant providers, internal communications, and post-incident review. It reduces confusion but cannot prevent every incident.

Practical scenario

An employee receives an urgent email claiming to be from the CEO requesting an immediate Bitcoin transfer. The employee verifies the request through an independent channel, follows the approval workflow, escalates the suspicious message, and no transfer is made outside documented controls.

Common misconceptions

One trusted employee is not enough, hardware wallets do not eliminate all risk, recovery phrases should not be shared with IT, security is not only an IT responsibility, and even small businesses benefit from documented procedures.