All articles

Building a managed security workspace for The Southlander

5 min read

The organization

The Southlander is a small local news team doing public-interest reporting. Like many independent newsrooms, the team has to protect drafts, assignments, internal planning, account access, and source-adjacent materials without the budget or staffing of a large media organization.

This case study is based on work done for a real newsroom environment. Sensitive implementation details have been deliberately removed: no internal hostnames, network ranges, recovery paths, credentials, or private screenshots are included. The goal is to show the operating model, not expose the system.

The problems

Small news teams often inherit the same security problems as larger organizations, but without the same support structure.

• Collaboration grows faster than access control. A team may start with shared documents, chat threads, personal accounts, and ad hoc project tools. That works until someone joins, leaves, loses a device, or starts handling more sensitive material.
• Public apps create unnecessary exposure. Making every tool public on the internet is convenient, but it increases the number of things that need to be patched, monitored, and defended.
• Security has to be usable. Reporters and editors need to get work done. A security model that only works for technical operators will fail once the rest of the team has to use it.
• Passkeys and hardware keys need real onboarding time. Strong authentication is worth doing, but a small team may need an in-person session to enroll devices, explain recovery, and avoid locking people out.
• There is rarely a clear security owner. Independent teams need someone responsible for access, recovery, monitoring, and incident guidance, even when they are not ready to hire a full-time security lead.

What we built

The first goal was to create a private workspace that the team could actually use. The second was to make it the foundation for ongoing managed security.

The workspace uses identity-based access instead of relying on public application exposure. Team members authenticate through a public identity endpoint, join a private network, and then reach internal tools through normal team-friendly hostnames. The apps themselves stay private.

That distinction matters. The login path has to be reachable from a fresh device, but the collaboration apps do not need to be open to the world.

The current workspace model includes:

• Private network access for team devices.
• Central identity and group-based authorization.
• Project and assignment coordination through a private workspace app.
• A path for team chat, files, document collaboration, and future workflow tools.
• Operator runbooks for onboarding, recovery, and access changes.
• A staged path from password bootstrap to passkeys and hardware security keys.

For the first rollout, users can log in with password-based identity while accounts are being created and devices are being joined. Passkeys and YubiKeys remain part of the plan, but they will be introduced during an in-person enrollment session so users understand what they are setting up and how recovery works.

The managed security layer

The workspace is only one part of the work. The more important service is the managed security layer around it.

For The Southlander, that means treating security as an ongoing operating function:

• Create and maintain user accounts.
• Add and remove access when people join, change roles, or leave.
• Review which tools are public and which should stay private.
• Help the team move toward passkeys and hardware-backed authentication.
• Keep recovery paths documented.
• Monitor for access, device, and configuration issues.
• Provide practical incident guidance for lost devices, suspicious logins, exposed files, or account compromise.
• Produce plain-language security summaries the team can understand.

This is the part most small teams need but do not have. A private workspace is useful. A private workspace with someone responsible for operating the access model, recovery process, and security review cadence is much more useful.

How the user journey works

A new team member should not need to understand the infrastructure.

They receive an account, sign in through the identity provider, join the private network, and open the workspace tools they need for their role. Later, during an in-person security session, they enroll a passkey or hardware key and learn what to do if a device is lost or replaced.

For the user, the experience should feel like:

1. Sign in.
2. Join the private workspace.
3. Open the tools.
4. Ask for help when access or device security changes.

For the operator, the important pieces are different:

1. Confirm the user is active and entitled.
2. Keep apps private by default.
3. Make onboarding repeatable.
4. Preserve recovery access.
5. Add stronger authentication without creating avoidable lockout risk.

Why this matters for other news teams

The same pattern applies to many independent newsrooms and journalism nonprofits.

They may not need a large enterprise security program. They usually do need:

• A clean account lifecycle.
• Protected staff devices.
• Private access to sensitive collaboration tools.
• A safer place for drafts, notes, assignments, and source-adjacent files.
• A plan for onboarding and offboarding.
• Someone to call when a login, device, or file exposure looks wrong.

This is where managed security and managed workspaces overlap. The goal is not to sell a pile of tools. The goal is to give a small team a security operating model it can live with.

The outcome

The Southlander now has the foundation for a private newsroom workspace and a managed security program that can grow with the team.

The most important outcomes are:

• A smaller public attack surface because workspace apps stay private.
• Centralized identity and group-based access control.
• A clear path for onboarding team members.
• A practical temporary login model while passkey enrollment waits for in-person setup.
• A reusable service model for other small news teams.

The work is still evolving. That is part of the point. Security for small organizations should not be treated as a one-time project that produces a binder and disappears. It should become a manageable rhythm: onboard, review, improve, test, document, and repeat.

Services used

Security services

• Cybersecurity for newsrooms and press freedom teams — security support tailored to reporting workflows.
• Protect Devices — device visibility, posture, monitoring, triage, and monthly reporting.
• Protect People — identity, email, phishing, access hygiene, and staff behavior support.
• Protect The Organization — private access, SaaS posture, incident readiness, risk tracking, and reporting.

Workspaces

• Managed journalist workspaces — private collaboration environments for sensitive reporting work.
• Dedicated Workspaces — scoped team environments with defined access, support, and export boundaries.