7Vulnerability Assessment and Penetration Testing

The little girl was wandering around the workspace when she stopped at the shared computer and said in surprise, “Nobody has updated this computer’s software for months!” The young man and Fawzooz looked at the screen, and she was right. “If you found this open door,” said Fawzooz, “someone else might find it too. It’s time we tested all our doors.” And so he began applying what security people call vulnerability assessment and penetration testing (VAPT).

Vulnerability assessment

“Find your weakness before someone else does.”

A methodical check. Fawzooz and his team checked the whole information system for any known weakness, rated how serious each one was, and suggested how to fix it or reduce it.

What we must protect. They identified the sensitive things that needed protecting: digital content, designs and client data.

Penetration testing

An attack with permission. Then Fawzooz went a step further: he had someone attack the system in a way that looks like the real thing, to learn how well it defends itself and what they would lose if an attack succeeded.

Experts with a contract. Fawzooz brought in security experts to carry out the test. Uncle Saleh was astonished. “Thieves, with your permission?” Fawzooz laughed and explained the contract they write: what they test, when, and where they stop, so they never step outside the law. The test took place on a quiet night, and the report arrived in the morning.

Why this matters to creative people

Protecting ideas. When the team finds the weaknesses in its tools before anyone exploits them, it protects its ideas and work from theft and tampering.

Work that stays sound and keeps going. Digital work stays intact and available, so creative work carries on without interruption.

How they did it

Planning. Fawzooz identified the systems, networks and data that needed testing, according to how sensitive they were and how close to danger.

Running it and reporting. Then he ran the checks and wrote the results in a report setting out the gaps they had found, the risk of each one, and what they had to do to close it.

What they learned

The check comes round again. Every new technology can bring a new gap, so Fawzooz decided they would run the check again every season, and with every new tool they bring into the workspace.

Security as part of creativity. Fawzooz made sure security was a smooth part of the creative work, protecting it without weighing it down.

Within ethics and the law. And he made sure every test ran with clear permission, within clear limits, and in a way both the law and conscience accept.

In this way Fawzooz not only kept the village’s work safe, but made sure its projects stayed inventive and secure, and the trust of creative people and clients in its ability both to protect and to innovate grew.