Roughly thirty programs run a small business, and almost everybody guesses at three hundred. Writing the real list down and refusing everything else is the strongest cheap control available. It is also the one that annoys people when it is done carelessly, which is why there is a queue with a person sitting at the end of it.
Every other chair on this board reacts to something. This one rules beforehand. Anything the list has never named simply will not open, which is why a downloaded installer, a document that fetched something on being opened, and ransomware arriving through a supplier all fail at the same instant for one reason.
The list is not copied out of a catalogue. It gets built off your own machines across a learning stretch, so the odd piece of trade software running your workshop, your dispensary or your kitchen is on it before anything gets refused. Supplier updates are followed too, because a control that shuts the counter down on release day gets turned off within the week, and after that you own nothing at all.
The agent watches and writes. Nothing is refused. At the end of it you are handed the list, and usually a mild surprise about how short it is and how many copies of the same small utility have piled up over the years.
Then refusal starts, and for a fortnight the queue does genuine work. Somebody installs something new, the request lands here, and an engineer either allows it, fences it so it can only reach what it needs, or comes back and asks what it is for. After that stretch it goes quiet, and quiet was the point.
Billing supplies each figure below as the page draws. Add a line and it sits on the board while you read further down.
Write down the software your firm actually opens, and refuse everything else. Most small businesses run about thirty programs and would guess at three hundred. Turning that guess into a written list is what turns it into a control.
| Position | Execution console, with a queue you can actually reach |
|---|---|
| Watches for | Anything attempting to open on a covered machine that the list does not name |
| Log kept | Each refusal and each approval, with the requester, the hour and the ruling |
| Escalation path | Requests queue at the console; anything marked urgent goes to an engineer directly |
| Sign-off | An engineer rules on it, and the reason sits on the request afterwards |
Execution control is strong and narrow. Staying honest about the narrow half is the only way the strong half survives its second week.
Heads up: card statements show FORTIFY 24X7 - SecureOps Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.