5Continuous Improvement in Information Security

After months of work the team sat in the workspace drinking tea, thinking the job was done. The young man stretched out in his chair. “Let’s rest now,” he said. Fawzooz smiled, went to the board and drew a circle, writing four steps around it. “Security turns like this,” he said, “like the waterwheel in the fields, which never stops as long as the water flows.” The little girl and Uncle Saleh came closer to listen.

Plan. We set clear goals and map out the way to reach them, in line with the village’s information security policy.

“Security is not a station we arrive at, but a road we walk every day.”

Do. We carry out what we planned, and make sure the security controls have become part of our everyday work.

Check. We review what we have done, measure it against the policy and the goals, and see where we need to improve.

Act. We fix what we found and strengthen the system, so it stays ready for whatever comes next. Then the waterwheel turns back to the start of the circle.

How we stay safe

A review from inside and from outside. Fawzooz agreed with the team that they would review their own work at the end of every month, and then an expert from outside the village would come and review it with them, to be sure they were keeping to ISO 27001 and to find what could be improved. The young man was puzzled. “Why a stranger? Aren’t we enough?” Fawzooz turned to Uncle Saleh and asked him, “Don’t you weigh your goods at your neighbour’s once in a while?” And Uncle Saleh replied, “A scale that nobody checks starts to tip, and its owner never knows.”

Training and awareness. Fawzooz kept training the team on security policies, new threats and safe habits.

Keeping up with new threats

An eye on what’s happening. Fawzooz kept track of the new threats appearing that target creative content and ideas.

Flexible policies. And he wrote security policies that change with the nature of creative work and with changing technology.

In this way Fawzooz didn’t only protect the village’s work; he planted in it a habit of security that protects creativity and renews itself along with it. At the end of the evening the young man raised his cup and laughed. “We haven’t finished; we’ve started the second round.”