Security Requirements? What?

I fully appreciate that all IT security as it relates to Hypex Consulting is extremely important. My PC needs to run regular updates and anti-virus protection. I need to treat PII appropriately. My IT infrastructure needs to be secure and always backed up. When I set up Hypex, I took what I thought were the right precautions: turn on device encryption, set up a business Google workspace account and delete all PII when the project ends, among others.

And then, while opening a PO, the client’s organization sent me (very scary) mail with the subject line “ACTION REQUIRED - security assessment needed.” I clicked to open…and landed into a portal with a lengthy questionnaire related to my company’s security practices. Ironically, I was familiar with the concepts (pen testing, access controls, configuration management…) because of my B2B research work, but not at all familiar with how to apply practically because, well, I am not a hands-on IT expert.

So, I did what all researchers in my situation would do: I panicked*.

I slept on it for a night. And the next morning…while walking the dogs, a brief conversation a few months earlier with a former colleague popped into my head: “J. is helping former colleagues with their IT stuff”.

So, I did what all researchers in my situation would do: I reached out to J. “Help? Please? Pretty please?”

As background, J. and I worked together several years ago. She managed the IT org, and to put it simply, is an amazing leader. She set the bar for how IT could be effective, impactful and importantly, serve as a true business partner. She and her team just didn’t make sure our PCs worked and the Wi-Fi was always on, but she understood our work and actively put in place policies and procedures that helped us tremendously.

When I reached out, I hoped J. would help me, not only because I really was in way over my head, but I truly wanted the opportunity to partner with her again.

Luckily, J. was more than willing to help. And now, she’s set me up for security success. She did a bunch of back end configuration work on the Hypex Google Workspace to make sure I was secure and compliant, set me up with MDM, wrote numerous policies, enrolled me in an actually kind of fun set of security trainings (Wizer, if you’re interested), put reminders on my calendar to complete specific security tasks and walked me through the now not so very scary questionnaire.

So now, I apply data classification to all emails and files and follow a set of instructions she’s provided covering steps I should take when I onboard and offboard a project, file sharing internally and externally, contractor and employee hiring steps, and so many other important IT security things.

Cool, right?

Are you a researcher and need help in this area? Please DM me and I’ll connect you!

* If you are a researcher and you’ve received a similar request and you didn’t panic, you are amazing and can we please be friends?