Cyber Resilience for SMEs: A Chat with DeltaXML’s Systems Administrator

In the age of digitalisation, ensuring digital security is a concern shared by businesses of all sizes, ranging from start-ups to established enterprises. As we navigate the digital landscape to establish and promote our presence, we unintentionally generate a significant amount of personal data. Mishandling this data could have serious consequences. In a recent discussion, we sat down with Peter Anderson, DeltaXML’s IT System Administrator, to assess potential risks to the company and discuss practical measures for securing our critical information.

Q. What are the key threats to national security currently faced by businesses such as ourselves?

A. As part of our responsibilities as an ISO 27000 certified company, we are obliged to be aware of several key threats that could apply to national security.

Firstly, we have your common old garden Cyber Security Risks. The ever-evolving nature of cyber threats poses a continuous challenge. Cybercriminals may employ sophisticated techniques such as ransomware attacks, phishing, or exploiting vulnerabilities in the supply chain’s digital infrastructure. Maintaining robust cybersecurity measures is crucial to counter these threats.

For a company like ourselves, the Supply Chain can be a source of vulnerability. Ensuring the security of components, monitoring for vulnerabilities, and promptly addressing any issues is crucial to prevent security breaches that could have cascading effects on our software and, by extension, national security.

Finally, (or at least for this answer, in the real world this response could go on and on) insecure coding practices or inadequate security testing can introduce vulnerabilities into our software. This not only puts our products at risk but also jeopardises the trust of our clients. By using secure coding standards, conducting regular security audits, and promoting a culture of security awareness among the DeltaXML team are critical measures.

Q. What measures are in place to secure critical information and why?

A. In our commitment to ensuring robust cybersecurity, several measures are in place to secure critical information, each serving a specific purpose in fortifying our defences.

One of the most important things that we can do to secure our data, is to recognise that human error can be a significant factor in cybersecurity incidents, we conduct regular awareness training for all staff members. This training covers best practices, security policies, and the latest threats and tactics employed by cyber adversaries. By educating our team, we enhance their ability to identify and mitigate potential security risks, contributing to a more resilient security posture.

Following on from this, where possible, throughout the business we adopt the Principle of Least Privilege (PoLP) This principle ensures that individuals are granted the minimum level of access required to perform their specific job functions. By restricting access rights to the essential minimum, we reduce the risk of unauthorised access and limit the potential impact of security incidents, enhancing overall system security. This in turn leads to periodic access reviews and audits to assess and validate user access privileges. This proactive approach allows us to identify and rectify any discrepancies or unauthorised access promptly.

It would be remiss of me to close this answer off without mentioning that we enforce the use of strong, complex passwords to protect access to our systems. Additionally, where available Multi-Factor Authentication (MFA) is implemented and used. MFA adds an extra layer of security by requiring users to authenticate their identity through multiple means, such as a password and a temporary code sent to a mobile device. This significantly reduces the risk of unauthorised access, even if passwords are compromised.

Q. What steps can citizens take to contribute to national security?

A. My answer to this doesn’t stretch much further than stay informed, practice good cyber security and embrace education and awareness and report any suspicious activity.

For my part, I encourage DeltaXML staff to practice the same steps in their personal lives. I’m sure they will all tell you about me banging on about secure passwords, MFA and not clicking on links!

To close out, I would encourage everyone to spread awareness and learnings. If you have a or friend relative that is less tech savvy then help them navigate the murky waters that can befall them.