Freelancer Access at a Design Agency
Loomis Creative is a 120-person design agency; about 40% of the people working in any month are freelancers on three- to six-month contracts. Client files arrive in a shared mailbox, studio@loomiscreative, whose password is known to the ten studio staff and was pasted into a team chat last month. HR runs an offboarding checklist for employees, but IT is only told about departures when someone notices. A freelancer's directory account was still active five weeks after his contract ended; he had been given the studio mailbox password on day one and used it to collect final artwork. Nobody can say which of the 60 client projects he opened. The creative director argues that background checks and formal rules would 'kill the culture', and that creative people need broad access to do good work. There have been no reported incidents in two years.
1. Which organisational and human security measures are failing, and what would you fix first? Explain the reasoning.
Read the worked answer
Failures:
- Accountability: a shared mailbox password and no unique accounts for freelancers mean actions cannot be attributed to a person.
- Least privilege: everyone in the studio can reach all 60 client projects; access is not tied to project assignment.
- Joining and leaving process: offboarding is an HR checklist with no IT trigger or deadline, so accounts outlive contracts.
- Policy and contracts: acceptable use is not enforced, contractor confidentiality terms are not applied in practice, and no access review takes place.
Fix first: the access lifecycle for non-employees. Give every freelancer a named account, grant access to named project folders only, and require the engagement owner to raise a termination ticket with a same-day disable service level. Convert studio@ into a shared mailbox with delegated access rather than a shared password. This comes first because it is cheap, it restores accountability, and it bounds the current problem: nobody can say what the departed freelancer accessed, and that cannot be answered retroactively.
Second: an access review before the next contract renewals, then policy and awareness work. Technical controls alone cannot fix a process that never tells IT someone has left.
2. The creative director says background checks and formal rules would 'kill the culture'. How do you respond, in business terms?
Read the worked answer
Reframe the goal. Controls are not there to constrain designers; they protect the client confidentiality clauses that win the work. A leak of an unreleased campaign can cost a client and the agency's reputation, which is a business argument, not a compliance one.
Separate the ask from the mechanism. The director is probably reacting to bureaucracy, not to accountability. Least privilege can be delivered as project-based folder access that is quick to grant; a one-page acceptable use summary and a contractor clause add minutes, not friction. Background screening should be proportionate to the role and checked for legality and consistency.
Use evidence, not culture claims. Offer a pilot: unique accounts and project-based access for one studio team for a quarter, then compare onboarding time, access requests and any near misses. If the burden is real, adjust the process rather than abandoning it.
Keep the non-negotiable. Shared credentials and unattributed access are not a culture choice; they are an audit finding waiting to happen, and they make it impossible to defend the agency if a client data leak is investigated.
3. How would you measure whether security awareness is working, given that no incidents have been reported in two years?
Read the worked answer
Treat 'no reports' as ambiguous. It can mean nothing happened, or that nobody recognises or bothers to report. Until there is a reporting channel and evidence that it is used, silence is not a control.
Measure behaviour, not completion:
- Reporting: number and quality of reports per month, and time from report to triage. A modest rise after awareness work is usually a good sign.
- Phishing simulation: click and credential-entry rates, plus the proportion who report the message. Run it with consent and without punishment.
- Access hygiene: percentage of staff with unique accounts and MFA, time from contract end to account disable, and access review completion.
- Process: how quickly the studio mailbox delegation is updated, and whether new joiners complete the one-page briefing before access is granted.
Act on the numbers. If click rates are high but reporting is low, the gap is psychological safety and a clear channel, not more slides. Review quarterly and publish a small dashboard to the directors.