Chapter 8 — Security essentials
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Paper records"]
N2["8.2 Devices"]
N3["8.3 Accounts and access"]
N4["8.4 Phishing and suppliers"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Paper records"]
N2["8.2 Devices"]
N3["8.3 Accounts and access"]
N4["8.4 Phishing and suppliers"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Paper records]
|
v
[8.2 Devices]
|
v
[8.3 Accounts and access]
|
v
[8.4 Phishing and suppliers]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) apply basic security controls in a small charity; (2) secure paper and devices; (3) control access to shared systems.
8.1 Paper records
Referral forms arrive on paper at food banks. Grace introduces lockable cabinets at each site, with keys held by leads. Forms are scanned into a secure case system within a week and the paper shredded. She checks each food bank a month later and finds two still storing forms in an open box. She discusses the reasons with the leads, who say the cabinet is in a different room, and arranges for a cabinet in the distribution room. The new cabinet arrives within a fortnight.
8.2 Devices
Volunteers had used personal phones for client contacts. Grace replaces this with charity phones that have screen locks, encryption and remote wipe enabled. Laptops used for referrals are encrypted and require passwords. She writes a short rule that client data must not be stored on personal devices, explained in the volunteer guide. Mr. Nowak notes that small organisations can achieve strong protection with basic settings that cost little. Grace sets up the phones herself with a short checklist, so that each one has the same protections and the settings can be confirmed during later checks.
8.3 Accounts and access
The shared inbox open to all staff is replaced with a referral mailbox accessible only to leads and Grace. Each person has their own login with multi-factor authentication. Grace reviews access every quarter and removes volunteers who have left. She finds three former volunteers still able to read the donor database and removes them. She explains that removing access promptly is one of the simplest and most effective security controls. She records each review with the date and the changes made, which the trustee overseeing data checks at the next board meeting.
8.4 Phishing and suppliers
Grace arranges a short phishing awareness session after a volunteer nearly entered a password into a fake login page. She also checks that the donor database supplier offers encryption, backups and access logs, and that its contract includes data protection terms. Mr. Nowak notes that charities are frequent targets of scams, and that combining staff awareness with checks on suppliers covers the most common threats. Grace writes a short note for volunteers on how to recognise fake login pages and who to tell, which is pinned beside each food bank's computer and repeated at induction.
Worked example
Grace introduces locked cabinets, scanning and shredding, encrypted charity phones and laptops, a restricted referral mailbox with MFA, quarterly access reviews that remove three former volunteers and phishing awareness.
Synthetic case. Controls are synthetic.
Errors and limits
Leaving former volunteers' access in place exposes data long after they leave.
Exercises
- EX036 — Scan deadline. How soon are referral forms scanned? Rubric: 3 = within a week;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX037 — Open box reason. Why did two food banks still use open boxes? Rubric: 3 = the cabinet was in a different room;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX038 — Phone settings. Which settings do charity phones have? Rubric: 3 = screen lock, encryption and remote wipe;; 2 = all;; 1 = some;; 0 = none.
- EX039 — Former access. How many former volunteers could still read the donor database? Rubric: 3 = three;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX040 — Supplier checks. What did Grace check with the database supplier? Rubric: 3 = encryption, backups, logs and contract terms;; 2 = most;; 1 = few;; 0 = none.
Continue studying — lesson 08 (chapter 08 of 12)
← Chapter 07 · Course chapter index · Chapter 09 →
Continue to the next authored lesson.