Cybersecurity – proactively addressing the risk

As a digital tech agency, we make security one of our key focuses. Our dedication is such that we are ISO-certified in information security – which is unusual for a small business.

We first gained our ISO 27001 certification in information security in 2023. Three years on, and this year it was time to become re-certified. This is no small undertaking. ISO 27001 is the best-known standard for information security and, understandably, it’s a full check of everything – a full re-certification to remain certified.

ISO 27001 is important to us. It’s a way of being tested on our standards and processes to ensure that we keep ourselves and our clients as safe as possible in the realm of cyber security. It ensures that we look at everything under the huge umbrella that is information security, including how we undertake secure development, the processes we follow in delivering both projects and support requests, and what the response procedure is to a security incident.

Information security needs to be taken seriously by all organisations.  A cyber attack can be devastating and pose one of the biggest and most serious risks to organisations of all sizes and stature. It’s not just large organisations that are targeted. In fact, 43% of cyber attacks are aimed at small organisations. With cyber attacks happening more frequently than ever, we wanted to pass on some of our processes and knowledge for you to consider in your own business.

The foundation of managing information security safely is being clear on the information that you need to protect and asking 5 questions:

1. What information do we have?
2. Why is it valuable?
3. Where is it stored?
4. Who has access to it?
5. How do we keep it secure?

Weak points can be in areas that are not always obvious. Under ISO 27001, we look at all areas of our business, including the physical and digital infrastructure, such as supply chain.  It’s easy to forget some areas - for example, cloud services. By their very nature, cloud services are ‘invisible’ and can feel far removed from business, but they are a key component in storing data of all types throughout an organisation and, if not managed properly, can be a risk factor in a cybersecurity breach.

Protecting information requires clear rules around software usage and data handling.

As an ISO 27001-certified business, we know all of the services and software every person in our organisation is using; we are clear on where all of your information and data is, how it’s managed, stored and who has access to it. We have clear guidelines around where data is shared and how it is transferred, and checks on whether it is properly deleted when it is no longer needed. Do you have clear rules set up around data handling?

Access control is a vital part of keeping your business safe from a cyber attack.  Are the correct people assigned to the correct access levels? Are there people who have access to information they no longer need, or has a person changed role within your business and now has different access needs?  Is there a robust process to delete access for individuals who are leaving your organisation?  These are all important areas which need a clear process.

With the rise in attacks, particularly through AI, which has the ability to find more holes in security, the speed and accuracy of your response are everything.

Business continuity and incident response are a vital part of the ISO 27001 standard. Can you keep your business running if you are in a state of risk? Do you have a plan which covers different scenarios of compromise? Has this plan been tested?

Unfortunately, we live in a world where you have to expect a cyber-attack; how you respond and how you handle an incident needs clarity.

Sharing ideas, experiences and solutions is important in this battle against cyber attacks. CyCOS – Cyber Security Community of Support was set up as a national programme starting with the research sector and has since developed into a community of localised groups.  We’ve recently committed to starting up the Oxfordshire Cyber Circle to support and encourage SMEs to share knowledge and challenges. We all need to play a part in the area of cybersecurity.

We are Olamalu, technical experts and website developers. We’re a friendly and down-to-earth team based in West Oxfordshire, who work together to achieve brilliant outcomes. We’ve been developing websites and designing tailor-made tech solutions for 16 years. 

We work with many of our clients as an ongoing technical partner, but we also offer a consultancy service to solve a specific strategic challenge.