1Laying the Foundations of Information Security

One ordinary morning the young man burst into the shared workspace in a panic, out of breath. “Fawzooz, three disasters in a single week!” He counted them off on his fingers: a campaign design they had made for a client had reached a stranger’s hands; he had opened a story file and found its lines changed, with no idea who had changed them; and a drawing tablet had suddenly broken down, taking a whole week’s work with it.

Uncle Saleh heard him from the door of his shop and came in. “And how does a stranger get at what’s in here?” he asked. “Because the door is open to everyone, and anyone can walk in wherever they like,” said Fawzooz. “From today, everyone will have a key of their own, and it will open only what belongs to them.” Uncle Saleh nodded. “A key for each person… that’s how I’ve run my shop for years.”

“Creativity flourishes when it finds a safe place.”

Then Fawzooz went to the board and drew a triangle, writing one of the three pillars of information security along each side. “If one side breaks,” he said, “the whole triangle falls.”

Confidentiality. This side answers the leaked campaign. Fawzooz made sure that new designs, scripts, project details and client data could be seen only by the people entitled to see them, and he built a system that decides who goes in and where, so sensitive information never reaches anyone who has no business with it.

Integrity. This side answers the story file whose lines had changed. Fawzooz used encryption and digital signatures, so original ideas, artworks and messages stay exactly as their owners wrote them, and only someone who has been given permission can change them.

Availability. And this side answers the broken tablet. Fawzooz began keeping a backup of the work every night, so when a device fails the team brings the work back in minutes, and designers, artists and developers find their tools and data whenever they need them, without interruption.

Challenges and solutions

Teams that keep changing. Teams in the village change often, and every project has its own needs, so Fawzooz built a flexible system of keys that changes quickly with each project.

Partners from outside. To stop data leaking, Fawzooz set clear rules for working with contractors and partners, and used tools that protect the files they share.

A great deal of data. As the data grew, Fawzooz chose ways of storing and protecting it that keep all of it safe without slowing the work or weakening security.

A few days later the client behind the campaign came back to the workspace, saw what they had done, and felt reassured, and went back to working with them with confidence. Uncle Saleh stood looking at the triangle on the board, then laughed. “Your security is just like my shop: a lock on the door, a ledger no one writes in but me, and a copy kept with my neighbour.”