3Managing Risk

One stormy night the lights went out across the village, and the young man, the little girl and Uncle Saleh gathered with Fawzooz in the workspace. Then came news that worried them all: “A digital thief has attacked a workshop in a neighbouring village.”

The young man leapt to his feet. “Let’s shut everything down and stop work until the danger has passed!” Fawzooz calmly held him back. “If we shut down every time we heard some news, we’d never work a single day. We don’t stop working; we find out what we’re afraid for, and we protect it.” The little girl asked, “And what are we afraid for, Fawzooz?” “That’s what we’re going to write down tonight,” he said.

“You cannot protect what you don’t know is at risk.”

Identifying risks

What we own. Fawzooz made a list of everything that matters to the village’s work: digital files, the client database, and the software they had built with their own hands.

What threatens it. Then the team wrote down what could happen to these things: a digital attack, a stolen device, or a file lost by mistake.

Where we are weak. They looked for the weak spots a thief could get in through, and put easy passwords at the top of the list, along with old software that nobody had updated.

Analysing risks

How likely? How harmful?. For each risk, Fawzooz and his team asked: how likely is it to happen, and what would it do to us if it did? That told them which risk to start with.

If it happened tomorrow. Then they imagined what might happen, asking themselves, for example: what would we do if the client database were lost tomorrow morning? This question is especially useful for creative people, because every new project and every new tool can bring a risk they have never met before.

Reducing risks

The controls. From ISO 27001, Fawzooz and his team chose controls that suited what they had found: encryption, a system that decides who goes in and where, and meetings on fixed dates where they change their passwords and update their software.

A plan for every risk. They wrote a plan saying what they would do with each risk: reduce it, pass it to someone else, such as an insurance company that carries it for them, avoid it, or accept it knowing full well what it is.

Review that never stops. And because the world of technology changes so fast, Fawzooz gave their risks a regular review, so they could spot new dangers and deal with them in good time.

When the lights came back on, Uncle Saleh looked at the sheet of paper and said, “You’re like the wise farmer who digs a well before he gets thirsty.” “And our well,” said Fawzooz, “is a backup every night.” In this way Fawzooz didn’t only protect the village’s work; the team began making its decisions with clearer eyes and meeting changes in the market with more flexibility.