Security and surveillance: the order matters more than the product

The four pages below this one — cameras, access control, firewalls and IT security — are bought under particular conditions, and that particularity decides almost everything.

They are bought after an event. A theft, a break-in, a lost file, a fraudulent email, or simply a theft next door. So the decision gets taken in the week that follows, under the impression of something concrete, and it concerns whatever reassures.

What reassures is what can be seen. A camera can be seen, a badge can be seen, a box in a cabinet can be seen. A tested restore cannot be seen, and an account closed on the day somebody left cannot be seen either.

This article sells none of those four products. It gives the one-hour question that puts the family back in order, the order itself, and the four things we refuse to bill even when they are ordered and payable immediately.

There is a question that ranks the four pages below this one correctly, it takes an hour, it is free, and it produces a written list: what, gone or copied tomorrow, would cost you most, and who would it be useful to?

The wording matters. It does not ask what has value — everything does — but what costs when it disappears. A laptop costs its price; the customer file it contained costs far more, and it appears on no accounting inventory.

The second half of the question is the one nobody asks and it is the most useful: who would it be useful to? It instantly separates the risk of an object being stolen — resaleable, opportunistic — from the risk of losing the ability to operate, which sells to nobody but stops you.

Write the list on a sheet, unranked, then add three columns: what it costs, how long before you would notice, and what you would do that same day. The third column is what empties half the quotations.

That list is the one document in this family a supplier cannot produce, including us. We know what happens in general; you alone know what, at your premises, cannot disappear.

Here is the sequence we apply, in this order, whatever product was asked for at the outset. It is short and the first three steps cost nothing.

First: a restore tested, on real data, in front of you. Until that has been done, no spending in this family is justified, because an untested backup is what turns an incident into a permanent stop.

Second: closing the access of people who have left, and the access list from the audit article. It is free, it takes an afternoon, and it addresses section 2’s commonest event.

Third: a distinct password per critical service, a second verification on the mail, and the call-back rule on any change of bank details — a call to a number you already had, never to the one in the message. Three habits, no purchase.

Fourth, and only then: the products. Laptop encryption, firewall, access control, cameras — in the order your section 3 list imposes. A supplier who starts at the fourth point is selling you their catalogue, and selling it all the more easily because you have just suffered something.

A useful distinction for arbitrating a budget: some measures work once installed, others require somebody to do something every month. The second kind almost always fails, and that has to be taken into account before buying them.

Work on their own: disk encryption, a second verification on an account, automatic locking of an idle session, the network separations from the network family article, and automatic updates on a system still receiving them.

Require a habit: reviewing access, checking that a backup is running, checking camera recordings, updating equipment that does not update itself, and reviewing who holds which badge.

The budget consequence is sharp and it contradicts intuition: systematically prefer a measure that works on its own to a better one that requires a routine, unless you have named the person who will keep the routine and the moment they will keep it.

And for those that require a habit, only one format survives: a recurring hour, with a list of five checks, kept by a named person. Without an appointment, the routine lasts three months — we have observed that often enough to write it here rather than discover it with you.

What we will refuse: installing cameras, a firewall or access control at a business whose backup has never been restored in front of it. It is the refusal the pillar article announces, and this page is what makes it applicable rather than declarative.

We will refuse to bill anything in this family before the three free steps in section 5 have been done. They earn us nothing, they take an afternoon, and they address most of what actually happens.

We will refuse to install any recording — of images, passages or connections — without a written retention period and without the question of informing people having been handled with somebody whose trade that is.

What we do: section 3’s one-hour list, written by you and not by us; section 5’s sequence in that order, even when another product has already been chosen; laptop encryption treated as the answer to theft rather than as an option; the list of accesses to remove prepared before the first departure; and a named recurring appointment for the measures that need a habit.

And what you can do this week without us: write the list of what, gone or copied tomorrow, would cost you most — and against each line, who it would be useful to. Then count how many people who have left still have access. Those two documents decide this family better than any quotation.