Virtual Global Demo Day focuses on the future of Fintech marketing

Fintech B2B Marketing Virtual Global Demo Day is around the corner, and excitement is in the air. The community announced the return of its flagship event, which is set to take place virtually on 19 October 2022.

Global Demo Day has become a staple in the Fintech, Martech and B2B communities as it brings top-class marketers in front of some of the most innovative technology and solutions to drive future business growth. What’s more, marketers get a chance to network on one forum ”“ the ultimate opportunity to learn from and grow with like-minded individuals.

Payal Reina, founder of the Fintech B2B Marketing community hosting the event says:

“Marketing is ever-changing, and we need to keep up with the trends to ensure we take our businesses into the future. Without the passion to constantly learn and improve our marketing skills, we risk being left behind.”

What’s to expect

Leading marketing solution providers will be on call to introduce the greater community with the latest, best-in-class technology to help solve your everyday marketing challenges.

“The sad truth is that many people still don’t know the true value of marketing, with many companies admitting to cutting marketing budget in light of trying financial times. As such, it’s always beneficial to not only know what tools and resources are available to improve your job, but also understand how it can contribute to your greater marketing strategies. The more you know, the better your chances of encouraging leaders to understand the importance of your marketing efforts,” adds Reina.

Some of the highlights expected at the event include discussions around innovative ways to drive new customer acquisition and retention, great operational efficiency, accelerated marketing automation, and reducing marketing costs, among others.

“Our Demo Day is the perfect environment to showcase innovative marketing offerings to marketers who need to stay in the loop and on top of their game,” adds Reina. “What’s more, there is no need to attend an in-person event as the event will be fully virtual, allowing for a completely comfortable and safe experience wherever you are in the world.”

Brands will have the option of showcasing their offerings in whatever way they feel comfortable, whether in the form of pitches, case studies, thought leadership and more.

The who’s who of Fintech marketing

Some of the past speaking and attending companies include global banks, fintechs, tech organisations, so you know you will be in good company. Business members of Fintech B2B Marketing Community will automatically get the opportunity to demo a solution at this event, while prospective sponsors are invited to reach out via email at eventsponsorship@fintechb2bmarketing.com.

Please join the FinTech B2B Marketing Community at the Global Demo Day event on the 19 October at 9am BST / Register here.

New event connects global investors with Scottish scale-ups

A new business event aimed at helping scalable Scottish companies reach their full potential has been launched today. Invest2Scale, being staged on 2 November at Edinburgh’s Dovecot Studios, is aiming to address a gap in the market by supporting revenue-generating scalable Scottish companies by connecting them with VCs and other investors.

Invest2Scale will identify between 10-12 company founders who they will invite to participate in their new showcase event. The event programme will include networking sessions, industry discussions and other scale–up focused activities and involve an audience of senior figures from both the UK and global investment community.

Invest2Scale is being led by a group of leading business support organisations – law firm MBM Commercial, accountants Chiene + Tait, recruitment specialists Eden Scott, and Angel Capital Scotland (formerly Linc Scotland) – who are tapping into their networks to attract scale–up experts and other key figures from the investor community to the event.

Companies with a global focus and strong scale up potential are being invited to apply to be part of the Invest2Scale event. More details can be found at: www.invest2scale.com

Selected companies will be announced in October.

Stuart Hendry, Senior Partner at MBM Commercial said:

“Invest2Scale addresses a gap in the market by targeting revenue-generating companies with significant scalability. It does this in person as there is major value in bringing company founders and investors together in the same venue as opposed to attempting this interaction through online facility. This event is designed to enable strong businesses to progress to a higher level and to lay the foundations in creating the next Scottish unicorn.

“We are passionate about supporting scale–up businesses to help them make the most of global investment opportunities so they can reach their full potential.”

Alan Donald of Angel Capital Scotland said:

“Our partnership of highly regarded and well-connected corporate organisations, where we can access key figures within the global investment community through our networks, brings immense value to this event. Collectively we will also leverage our experience and close relationships within Scotland’s business community to help identify many of the companies that could maximise the impact of additional growth investment.

“In addition to the contribution of the founding partners, through Invest2Scale we will put ambitious high growth Scottish companies with scale–up funding aspirations in front of an invited audience of investors.”

Update from the Phoenix Innovation Forum

Article written by James Carroll, Digital Sustainability Manager for Phoenix Group

Last month, we announced the kick off of Phoenix Group’s first ever Innovation Forum was launched”“ created to deliver innovative solutions for the challenges faced by our customers, business and industry. This Forum is focusing on exploring solutions to two key pillars of our Customer Sustainability programme ”“ digital literacy and financial inclusion.

Since kick-off, Subject Matter Experts (SMEs) from across Phoenix Group have reviewed some fantastic submissions from FinTech innovators around the world. From a diverse range of solutions, the team narrowed the applications down to seven FinTechs who were invited to pitch their ideas.

Shortlist and pitch Session

On Wednesday 27 July, we welcomed the seven shortlisted innovators to pitch their ideas in the Innovation Lab at Standard Life House. The pitches gave a deeper insight into how these solutions could help our customers to secure a life of possibilities. Our SMEs scored each application against five key areas: target audience, the concept and our ambitions, timeline, resource need and scalability. They left the session with a real buzz after hearing how these solutions can benefit our customers and wider society – and with the difficult task of putting only three forward to the final.

Announcing the three finalists

We are delighted to announce that the finalists going forward to the last round of the inaugural Phoenix Group Innovation Forum are:

The solutions put forward by these finalists clearly align to the challenges we set with the teams providing a proof of concept that our panel of SMEs from across Phoenix Group believe have the potential to deliver the best outcomes for our customers.

The finalists have now been matched with two mentors from Leadership Teams within Phoenix whose role over the next five weeks is to support them in refining their concepts. The mentors will do a deep dive to establish the validity of the solution, which includes completing an assumption plotting exercise and evaluating the solutions scalability within the life stages of our customers. Mentors will also analyse feedback from the initial pitches and assess the commercial viability of the solutions.

We can’t wait for AirFunders, Behavioural Finance and Moroku to join us in the Innovation Lab again on the 22^nd of September for the final pitches. We’ll also be joined by a panel of senior Phoenix leaders who will be considering which is the best fit to build a formal partnership with Phoenix Group. The winner will be announced on Thursday 29 September and we’ll work with the winning team to bring their exciting concept to life.

Photo by RODNAE Productions: https://www.pexels.com/photo/woman-in-black-blazer-standing-beside-white-board-7414008/

How can fintechs access non-dilutive funding?

Entrepreneurs experience a myriad of challenges when it comes to raising capital to fuel their growth, especially at the early stages of their business.

Startups and other SMEs can now access a range of non-dilutive funding solutions at key stages of growth, including R&D Advance funding, Grant Advance funding, and Revenue Advance funding. These are alternatives to equity capital that can provide fast-growing innovative businesses with access to growth capital affordably and quickly.

These funding options help businesses by supporting investment into research and development, bringing forward project delivery timelines and helping to manage project cash flow. They also provide flexibility to support strategic investment outcomes, generally. For example, companies are now looking to R&D funding to help extend cash runway, through fundraising activities (e.g. Series A), to support increased valuations and maintain founder ownership levels.

In the UK, R&D advance funding continues to grow. With an estimated 85,900 R&D claims for the year ending March 2020 (an increase of 16% from the previous year) and expenditure on R&D performed by UK businesses also showing ~3.5% YOY growth, businesses are now recognising the valuable opportunity provided through this form of non-dilutive funding.

Globally there are c. USD 350bn of assets owned by companies that have previously been unrecognized by lenders which can now be used as collateral to lend securely. Advance funding is similar to accessing any type of loan ”“ it simply uses future tax credits, grant payments or revenue, as collateral.

Blog article written by Hamish Gregory, Director Strategy & Operations at Fundsquire

Fundsquire will be at the Scotland Fintech Festival. If you’d like to chat to the team at the event as well as get a chance to attend panel and networking sessions hosted by Fundsquire at the event, register your interest here.

Photo by RODNAE Productions: https://www.pexels.com/photo/marketing-exit-technology-business-7413915/

East Lothian entrepreneur announced as Great British Entrepreneur Awards 2022 finalist

East Lothian based serial entrepreneur Sheila Hogan, founder and CEO of death tech company, Biscuit Tin, has been recognised as one of the best in the business after being named as a finalist in the Great British Entrepreneur Awards.

Biscuit Tin is the UK’s first digital legacy vault’, securely holding valuable information such as account details, important documents, post-life wishes and memories all in one place. These are then released to nominated family members in the event of death. Biscuit Tin aims to help people prepare for their deaths, with the aim of leaving family members left behind with peace of mind and minimal stress, following their bereavement.

Sheila Hogan, founder & CEO of Biscuit Tin is one of the shortlisted business leaders from across the UK to have been selected out of over 5,300 entrants – the most the awards has ever had.

The Great British Entrepreneur Awards, in partnership with Starling Bank, acknowledges and champions the hard work and uplifting stories of business owners across the UK, with an emphasis on their journey and resilience over financial achievements.

Twelve awards will be given out per region for categories including Disruptor of the Year, Entrepreneur for Good Award, and the Great British Entrepreneur of the Year. Notable winners from previous years include Social Chain founder Steven Bartlett, who went on to become the youngest ever investor on BBC’s Dragon’s Den.

Sheila Hogan said:

“I’m absolutely delighted to shortlisted for this prestigious award, and to be recognised on a UK-wide level is just fantastic. This has given the team and I a real boost and we are very much looking forward to the finals in November.”

This year’s awards will also feature a brand-new award highlighting the organisations investing in the training and development of young people. The John Caudwell Blaze Your Own Trail Award looks to recognise outstanding examples of businesses offering apprenticeships, vocational training, and diversity and inclusion initiatives, all in the name of improving young people’s access to work.

The winners will be announced at a Grand Final, held at the Grosvenor Hotel in London on 21st November.

This year is the 10th anniversary of the Great British Entrepreneur Awards. The alumni has collectively generated over £30 billion in revenue and employed more than 450,000 people.

To mark the milestone year for the programme, entrants will have the chance to win over £30,000 worth of marketing support and a tree will be planted for every application submitted with the support of Ecologi.

Founder of the Great British Entrepreneur Awards, Francesca James, said the quality of this year’s entrants exemplified the strength of entrepreneurship across the UK: “The quality of applications is consistently excellent year on year, but we have been especially blown away by the innovation, drive and determination demonstrated this year. Shortlisting from so many inspiring contenders has been more challenging than ever, with many deserving cases put forward and an ever-growing business community thriving across the country.

“From the pandemic to the ongoing cost of living crisis, business owners haven’t had it easy over the past few years, but it’s a testament to the tenacity and perseverance of these entrepreneurs that they have continued on their path and refused to give in.

“This year’s finalists should be so proud of what they’ve already achieved both in business and in being shortlisted for an award – we’re looking forward to seeing everyone at the Finals and unveiling the winners!”

Anne Boden MBE, Founder of Starling Bank, headline partner of the Awards, said: “Congratulations to all those businesses who have made the shortlist. It’s great to see the passion, resilience and amazing ingenuity from entrepreneurs across so many categories.”

To book your place at the Grand Final in London on 21st November, you can go to greatbritishentrepreneurawards.com

For the full list of finalists, visit greatbritishentrepreneurawards.com

New initiative launched to support fintech in Scotland

FinTech-Tables is an initiative that will bring together the FinTech ecosystem in Scotland to drive growth, innovation, collaboration and connectivity.

Launched by BDM Marketing & Communications and supported by FinTech Scotland, the initiative will deliver a series of events throughout 2022, bringing together the FinTech community in Scotland to discuss and tackle industry-wide challenges in key areas impacting growth including policy and regulation, skills and talent, investment and internationalisation.

Supporting industry priorities, FinTech-Tables will align to the FinTech Scotland Research & Innovation Roadmap 2022-23 which aims to deliver a threefold increase in economic growth and job creation over the next 10 years.

The ambition for the roadmap is to deliver an increase in economic gross value add (GVA) through the FinTech industry in Scotland from £0.5bn today to £21bn GVA by 2031 as well as delivering in excess of 20,000 new FinTech jobs.

FinTech-Tables, which already has support from a number of other organisations including Glasgow based data recruitment specialists MBN Solutions and global payments platform Mambu, will create an environment for the cluster to come together to discuss key findings from the report and create actions to deliver against its objectives, focusing on four priority themes which are considered the building blocks of the roadmap; open finance data, payments & transactions, financial regulation and climate finance.

The forum will launch in May 2022 with its opening event Growing FinTech in Scotland’ and will deliver a series of events and discussions in support of the FinTech industry in Scotland over the next 12 months.

“We’re delighted to support the launch of Fintech Tables. Having recently published the UK Fintech Research and Innovation Roadmap, we believe those events will enable the fintech cluster to meet and discuss many of the findings and actions detailed in the document. We’re looking forward to many interesting conversations with those individuals and companies that make Scotland one of the leading fintech nations”

(Mickael Paris, Marketing Director, FinTech Scotland)

“We are excited to partner with FinTech-Tables and to assist in the work being done by the team to support the growth of the Fintech sector.

Data driven innovation will form a key component when delivering against the key pillars outlined in the Fintech Scotland Research & Innovation Roadmap and the report highlights the importance of data in delivering positive economic, societal, and environmental outcomes in Scotland.

If we are to achieve the desired goal of 32,000 new jobs for the sector in by 2033, it is important that we come together as a community and consider how we can attract a skilled diverse and inclusive talent pool to Scotland from across the entire globe”

(Michael Young, CEO, MBN Solution)

“FinTech in Scotland is already having a huge impact on the way that individuals and businesses interact with money and financial services. It has the power to change lives and have a positive impact on both people and the planet.

Fintech-Tables is committed to supporting the growth of FinTech Scotland. We will do this by creating a community where people can come together to tackle industry issues in an environment that encourages new innovations and partnerships to emerge”

(Ian Davey, Director, BDM Marketing & Communications and Founder of FinTech-Tables)

Protecting your tech startup against Conti type ransomware

Blog written by Alex Jessop, Managing Security Consultant (CIRT) at NCC Group

Background

March saw a 53% increase in ransomware attacks on February, continuing the upward trend for 2022. Conti were the second most prolific group, responsible for 27.52% of the ransomware attacks occurring worldwide^[1]. FS-ISAC, in their “Navigating Cyber 2022” report, stated that with the observed trends over recent years, ransomware will remain a top cyber threat to financial institutions^[2].

Conti are just another in a long line of Advanced Persistent Threat (APT) actor groups that are targeting organisations for monetary gain. While their arsenal may have some custom tooling, the majority of the Tactics, Techniques and Procedures (TTPs) are well known and used by multiple APT groups. A large proportion of incidents observed by NCC Group would have easily been prevented if policies had been followed or proactive measures taken to understand weaknesses in the environment.

Taking the following three steps will drastically reduce the likelihood of a successful compromise:

Robust patch management policy
- The majority of initial access vectors observed in Conti attacks would be mitigated
Enforcing principle of least privilege^[3]
- Restricting user permissions would reduce the likelihood of post-exploitation if initial access is gained
Restricting internet access on servers
- Connectivity is key to threat actors and would make a compromise substantially more difficult if the server estate could not communicate openly with the internet

Executive Summary

In February 2022, a Twitter account which uses the handle ContiLeaks’, started to publicly release information for the operations of the cybercrime group behind Conti ransomware. The leaked data included private conversations between members along with source code methods of delivery. Furthermore, even though the leaks appeared to have a focus on the people behind the Conti operations, the leaked data confirmed (at least to the public domain) that the Conti operators are part of the group, which operates under the TheTrick’ ecosystem. For the past few months, there was a common misconception that Conti was a different entity.

Despite the public disclosure of their arsenal, it appears that Conti operators continue their business as usual by proceeding to compromise networks, exfiltrating data and finally deploying their ransomware. The aim of this article is to describe the methods and techniques we observed during recent incidents that took place after the leaked data.

Our findings can be summarised as below:

Multiple different initial access vectors have been observed.
The operator(s) use service accounts of the victim’s Antivirus product in order to laterally move through the estate and deploy the ransomware.
After getting access, the operator(s) attempted to remove the installed Antivirus product.
To achieve persistence in the compromised hosts (maintain access), multiple techniques were observed;
- Service created for the execution of Cobalt Strike.
- Multiple legitimate remote access software tools found. These include AnyDesk’, Splashtop’ and Atera’.
  - Local admin account Crackenn’ created. (Note: This has been previously reported by Truesec as a Conti behaviour^[4])
- Before starting the ransomware activity, the operators are known to have exfiltrated data from the network with the legitimate software Rclone’^[5].

It should be noted that the threat actor(s) might use different tools or techniques in some stages of the compromise.

Initial Access

Multiple initial access vectors have been observed recently; phishing emails and the exploitation of Microsoft Exchange servers. The phishing email which was delivered to an employer proceeded to download and install malware which gave the threat actor direct access to the host.

The targeting of Microsoft Exchange saw ProxyShell and ProxyLogon vulnerabilities exploited. This gave threat actors direct access to the Exchange servers. When this vector was observed, the compromise of the Exchange servers often took place two to three months prior to the post exploitation phase.

Other initial access vectors utilised by the Conti operator(s) are:

Credential brute-force
Use of publicly available exploits. We have observed the following exploits being used:
- FortiGate VPN
- Log4Shell
Phishing e-mail sent by a legitimate compromised account, including email accounts of trusted partners

Discovery and Lateral Movement

Once a threat actor has gained access to a host on the network, the threat actor deploys tooling or executes Windows commands to identify hosts on the estate and potential pathways to their objectives.

Typically they begin with network scanning tools to build a picture of the estate and identify what is accessible from the host they currently have access to. Next they will use Windows domain discovery tools to identify users on the domain, as well as user groups which will assist in escalating their privileges .

Lateral movement is usually performed by either:

Use of Remote Desktop Protocol (RDP) to log onto hosts remotely
Access across open network shares to copy and execute malware

This phase often occurs within hours or days of initial access being gained.

Persistence

The threat actor leveraged Windows Services to add persistence for the Cobalt Strike beacon. Cobalt Strike is a popular tool for adversary simulation and was the main command and control framework utilised by this group.

In addition, services were also installed to provide persistence for the Remote Access Tools deployed by the threat actor:

AnyDesk
Splashtop
Atera

Local accounts have also been created by the threat actor on patient zero to maintain access.

Privilege Escalation

Conti operator(s) managed to escalate their privileges by compromising and using different accounts that were found in the compromised host. The compromised credentials in engagements undertaken by NCC were found to be compromised through the use of tools such as Mimikatz, which is a well-known tool to extract credentials from running processes.

One operator was also observed exploiting ZeroLogon to obtain credentials and move laterally.

Exfiltration and Encryption

Similar to many other threat actors, Conti operator(s) exfiltrate a large amount of data from the compromised network using the legitimate software Rclone’. Rclone’ is a legitimate file transfer tool which is used to manage files on cloud storage or a private file server. When cloud storage is used, Mega is the option chosen by this group.

Soon after the data exfiltration, the threat actor(s) started the data encryption. In addition, we estimate that the average time between the lateral movement and encryption is five days.

As discussed previously, the average dwell time of a Conti compromise is heavily dependant on the initial access method. Those incidents that have involved ProxyShell and ProxyLogon, the time between initial access and lateral movement has been three to six months. However once lateral movement is conducted, time to completing their objective is a matter of days.

Recommendations

Monitor firewalls for traffic categorised as filesharing
Monitor firewalls for anomalous spikes in data leaving the network
Patch externally facing services immediately
Monitor installed software for remote access tools
Restrict RDP and SMB access between hosts
Implement a Robust Password Policy^[6]
Provide regular security awareness training

References

Photo by Tima Miroshnichenko: https://www.pexels.com/photo/people-typing-on-keyboards-5380596/

AG Elevate launches accelerator programme

Addleshaw Goddard just launched its 5th AG Elevate programme ”“ an accelerator for those looking to become the next tech-unicorn.

This fast-track 10-month programme is designed to accelerate the growth of tech businesses in all sectors of the economy helping them with legal challenges that can arise as they grow.

Previous AG Elevate cohorts have included Scottish fintechs Amiqus, Trace and OBR.

The programme is designed, developed and delivered by AG‘s expert lawyers, who will provide access to legal advice, legal and business mentors and networks across the globe.

Elvan Hussein, Partner and co-programme lead at Addleshaw Goddard, said:

“We have emerged from the pandemic into a different environment, with tech integrated in all aspects of our lives and this continues to both offer opportunities for high growth and the chance for tech businesses to play a huge part in rebuilding and growing our economies wherever they are based.”

“AG Elevate is tried and tested and we understand what matters most to these businesses, and what challenges they will inevitably face. Our mentors have the specialist sector knowledge to bring tangible added value to the relationships with their Elevate members, beyond their undoubted legal expertise and we can’t wait to meet our new cohort.”

To qualify for consideration for a place on the programme, businesses need to have existing plans for high–growth and have received external funding.

Interested parties can apply at www.addleshawgoddard.com/en/ag–elevate/ until the end of May 2022.

The Startup Race announces 9 events in Scotland

The Startup Race, just announced that it will host nine events in Scotland All those events will be headlined by bestselling entrepreneurship author Ash
Maurya, well-known for his book Running Lean, which has become a real entrepreneurship movement.

The events will take place in Edinburgh, Glasgow and Dundee, and will aim to connect angels, investors and startup founders. They will offer the opportunity to discuss how to identify risk in business model. The events are supported by both The Startup Race through a partnership grant with the Scottish Government’s Technology Ecosystem Initiative.

Ash Maurya said:

“As I always say, Building a scalable and successful business starts with knowing what to measure and how. Being able to bring this mission to Scotland with the support of both The Startup Race and the Scottish Government’s Technology Ecosystem Initiative, in order to meet with like minded individuals ”“ this is a true honour.”

Here is a breakdown of the programme of events:

Dundee 3rd May
Angel Investor Lunch with Ash Maurya 12:00-14:00
Scaling Lean Workshop for Scaleups & Investors with Ash Maurya
14:00-18:00
Fireside Chat for Scaleups, Startups & Investors with Ash Maurya
19:00-21:00

Glasgow 4th May
Angel Investor Lunch with Ash Maurya 12:00-14:00
Scaling Lean Workshop for Scaleups & Investors with Ash Maurya
14:00-18:00
Fireside Chat for Scaleups, Startups & Investors with Ash Maurya
19:00-21:00

Edinburgh 5th May
Angel Investor Lunch with Ash Maurya 12:00-14:00
Scaling Lean Workshop for Scaleups & Investors with Ash Maurya
14:00-18:00
Fireside Chat for Scaleups Startups & Investors with Ash Maurya
19:00-21:00

Mr. Maurya’s objective is to meet Scottish Angel investors and Scaleup Entrepreneurs to discuss how funded Scaleups need to exploit the “Lean Startup principles” to achieve revenue and profit growth.

Michael Clouser, co-founder of The Startup Race said

“Introducing Ash Maurya to the Scottish startup community has been a goal for quite some time, and we are thrilled to be able to launch this partnership. We hope Scottish based startup founders, angels and investors find value in these events for future growth in all of their entrepreneurship endeavours.”

For more information on The £10,000 Startup Race, please visit:
https://thestartuprace.com/the-10000-startup-race/

Why should tech companies care about double fetch vulnerabilities?

Fintech companies are facing an increasing need to focus on cybersecurity. Whilst cyber-attacks are on the rise and necessitate the constant evolution of cyber-security solutions, very often the issues arise from known vulnerabilities within existing systems.

In this blog we’re exploring double fetch vulnerabilities.

The phrase ‘double fetch bug’ was first used by Fermin J. Serna in a post on the Microsoft Security and Defense Blog in October 2008, although the bug type had been known about for some time before this.

Double fetch vulnerabilities in C and C++ have been known about for a number of years. However, they can appear in multiple forms and can have varying outcomes.

As much of this information is spread across various sources, the whitepaper, draws the knowledge together into a single place, in order to better describe the different types of the vulnerability, how each type occurs, and the appropriate fixes.

There are two broad general types of double fetch vulnerability: those resulting from coding practices and those introduced by compiler optimization, referred to as a ‘compiler introduced double fetch’ below and in the whitepaper.

The two types of double fetch bug both have the same result, whereby an invariant exists involving two or more variables and one or more of these variables is modified without the invariant being enforced.

Since double fetch bugs can have varying causes, we must consider different solutions for the two different subtypes of double fetch.

Double fetch bugs caused from accessing shared memory may be fixed by adding a check against the second fetch, eliminating the second fetch (where practical), or performing the check in a different manner.
For compiler-introduced double fetches, the use of volatile variables is one possible solution to the double fetch problem.

In conclusion, double fetch bugs can result in privilege escalation vulnerabilities that can allow an attacker with a low privilege account to execute code with elevated privileges, although the exploitable vulnerabilities are a relatively small subset of these bugs.

To understand how to best protect yourself against these vulnerabilities, click here to access the full whitepaper from NCC.