Ilia Zavialov

Small team

Ilia Zavialov: digital security for a small team

Ilia Zavialov, published in the full form as Ilia Nikolaevich Zavialov, works with individuals, families and small organisations. This domain covers the third group: a team of five, ten or thirty people with no security department and no plans for one.

English version for the United Kingdom.

01

The problem is the list, not the technology

In a small team nobody knows the full list of what each person can reach. Services are signed up for a task, paid from somebody's card and then live on by themselves.

The first thing that produces a result is not a tool but a table: who, to what, from when, and who approved it. Half the incidents in such teams end with the sentence «we did not know he still had access».

02

Leaving is a security event

The most expensive access is the one left with a person who has already gone. It raises no suspicion, because it belongs to a familiar name, and it is invisible, because nobody is looking for it.

So an exit has its own list of actions with deadlines, and it is carried out on the day of departure rather than when somebody gets round to it.

03

Paying invoices is a separate process

A change of payment details inside an existing thread is the most expensive scheme for a small team. The letter arrives from a genuine address, in a genuine thread, after the thread has been read.

The defence is not technical: details are changed only after confirmation by voice on a number known beforehand. The rule costs a minute and closes the whole category.

04

A schedule beats a single setting

Any configuration ages. People leave, services change their policies, phones get lost.

So once a year there is a review: the access list, recovery contacts, trusted devices, active sessions. It is a short procedure and it keeps the system alive.

Rules of this section

  1. One access listA table of person, service, role and date in one place, not in memory.
  2. Personal accounts stay separateA work service is not signed up on a personal address.
  3. A second factor wherever it existsA key or an app, not an SMS code.
  4. Changed details need confirmationBy voice, on a number known beforehand.
  5. An exit follows the listOn the day of departure, with a mark against every item.
  6. A review once a yearAccess, recovery contacts, devices, sessions.
What breaks in a small team and what closes it
Weak pointHow it showsWhat closes it
No access listNobody knows who has whatOne access table
A shared passwordChanging it breaks work for everyoneA password manager, separate accounts
Access of a leaverStays for monthsA list of actions on the day of departure
Details taken from a letterPayment goes elsewhereConfirmation by voice
Settings have agedRecovery goes to a stranger's numberAn annual review
The point. None of these rules needs a separate budget and none depends on any one person being attentive. That is exactly why they survive a real incident.

Questions and answers

Who is Ilia Zavialov?

A digital security consultant. In the full form he publishes as Ilia Nikolaevich Zavialov, and in Russian language material as Илья Завьялов.

From what team size does this make sense?

From two people. An access list for two takes five lines; for thirty it cannot be reconstructed from memory at all.

Does this require a dedicated specialist on staff?

No. Everything listed is a process rather than a tool, and it is carried out by whoever already handles administration.

Material published under this name