4Putting Security Controls in Place

Once Fawzooz knew the village’s risks one by one, the next step came: to give each risk a control that protects against it. So he gathered the young man, the mother, the little girl and Uncle Saleh in the workspace, and began to share out the tasks.

“You, my friend, are in charge of the network,” Fawzooz told the young man. Then he turned to the mother. “And you, Auntie, are in charge of the client data.” And of himself he said, “And I’ll keep an eye on all of you.” So everyone knew what they answered for, and security was no longer a job with no owner.

“A good control protects without getting in the way of creativity.”

A course for everyone who works here. Fawzooz ran a simple course, and everyone learned to lock their screen when they get up from their seat, to leave strange links alone and never open them, and to report straight away anything that looks suspicious. They agreed that a new worker learns all of this on their first day, and that the account of anyone who leaves is closed that very same day.

Asset management. Fawzooz identified the information the village owns and sorted it: digital content, client data, and the tools they had built.

Access control. He made sure only those entitled to it could reach information and systems, which matters for a village that works so often with people from outside.

Encryption. He used encryption to keep sensitive data secret and intact, especially when it travels over insecure networks or is kept on portable devices.

The equipment room. He put a lock on the equipment room, and no one goes in without a card and a PIN, and beside its door a ledger records who went in and when. So the devices, and the places where the work is made, were safe from tampering and damage.

Communications security. He protected the information travelling over their networks, because the village’s teams so often work together from afar.

Security from day one. He made sure security was part of every system they buy, build or repair, from its first day to its last.

Suppliers. He reviewed his dealings with suppliers and service providers, so that whatever they could reach stayed protected.

Incidents. He agreed with the team on one clear way of handling any security incident, and of reporting any weakness they found.

Keeping the work going. He built information security into the village’s plan for carrying on with the work if the unexpected happens.

Compliance. And he made sure the village kept to every law, regulation and contract that applied to it.

Then one day a message reached the young man asking for his password. He remembered the course, didn’t open it, and hurried to tell Fawzooz, and the team got together and closed the gap before anyone could get in through it. Fawzooz looked around and saw that the artists were still drawing and laughing: the controls had protected their work without getting in its way.