New IT threats, real-world cases and expert advice: discover this interview between Yannick Jost, Information Systems Security Manager at Scalingo, and Sébastien Heitzmann, Managing Director and CTO at KiwiBackup, to help you improve your company’s IT security.

What new cyber threats have you discovered recently?

Sébastien Heitzmann: There are two cyber threats that are becoming increasingly common today. The first has been around for a while, but to me it is one of the most sensitive threats: what is called an "external injection attack." Today, software is no longer developed from A to Z: many external libraries are used. A small web application or a CMS can easily have 4,000 or 5,000 dependencies. Fairly common attacks consist of injecting vulnerabilities into these libraries, which then end up spread across a very large number of applications. Managing this type of threat is a real problem, because you have to scan all the dependencies in the software.

The second is the QR code attack. We all know that QR codes have become very popular. Everyone has gotten into the habit of scanning any QR code. You have to remember that a QR code is a URL, and you can end up on disreputable sites with potential attacks. Clicking on a QR code is just as risky as clicking on a link in an email from someone you don’t know.

Yannick Jost: For my part, I would like to talk about the use of AI in attacks. At first glance, we might think that automated robots will attack our companies and try to find security flaws. In fact, it is more basic than that. What AI does much better is social engineering. In other words, writing messages, pretending to be someone from the company or a third-party service telling you that you need to renew your password. LLMs (such as ChatGPT, for example) make it possible to write much better messages that take your company’s context into account.

What key steps should a company follow to strengthen its IT security?

Yannick Jost: Security is a vast subject, and it is true that you can feel overwhelmed by the extent of everything that needs protecting in a company. The ANSSI has published a guide called the IT hygiene guide that lets any company carry out a self-assessment, which already gives you the basics.

Here are a few basic points: first, there is always an issue around password management. I therefore recommend using a centralized password manager that generates passwords and stores them securely.

Another approach we always recommend for knowing what to secure is to inventory your main assets, that is, to know what is valuable to the company in terms of information, and then decide from there how to protect it.

Sébastien Heitzmann: To me, two elements are essential. The first is backup, after carrying out the risk analysis and inventories Yannick mentioned. Backing up is important because it is your life insurance. In the event of an attack, an intrusion into your system or human error, offsite backup is the only thing that will save you. The second essential element is applying security updates. Today, most of the massive attacks on the internet exploit vulnerabilities that have already been patched. It is therefore essential to install these updates daily.

Why is compliance with security regulations crucial?

Yannick Jost: Standards are often seen as constraints. But they bring together the best practices in the field and make it possible to secure systems effectively.

Sébastien Heitzmann: External audits also help guide the implementation of improvements and bring an outside perspective. They are essential for continuous improvement, because it is very difficult to do this internally.

How do your solutions help manage sensitive data securely?

Sébastien Heitzmann: The first point is obviously backup. We give you peace of mind: if you lose your entire IT system, we can restore your data. The backup must be immutable, meaning it cannot be altered by an attacker. With KiwiBackup, even if the hacker has full access to your system, there is no way to modify the previous day’s backup. With 90 days of history, you can go back to any version.

Yannick Jost: At Scalingo, we ensure the resilience of applications and data, with continuous monitoring, automatic updates and secure database backups. All data is hosted in France, guaranteeing sovereignty and security.

Concrete success stories

Yannick Jost: Scalingo handles traffic peaks (e.g., Black Friday) through horizontal or vertical scalability. We also ensure confidentiality for sensitive applications, such as Malo, a preventive health app.

Sébastien Heitzmann: For KiwiBackup, backup monitoring is key. With our dashboard, monitoring is fast even for a large fleet. Example: Schmidt Group can check all of its servers in 5 minutes instead of 2 hours.

Advice for IT managers and entrepreneurs

Yannick Jost: Identify your critical points and delegate security to certified professionals so you can focus on your core business.

Sébastien Heitzmann: Use HDS certified solutions, test your restores, store your backups offsite and apply security updates. After the fire at OVH Strasbourg, our system was restored in less than 3 hours, when the target was 12 hours.