Security Uplift for Defence Supply Chain Readiness

Project Overview

VDM Consulting is an engineering firm working within the Australian defence supply chain. Following a security review conducted as part of their work with Austal Defence, a number of external vulnerabilities were identified across VDM’s systems. VDM engaged Downtime Assassin to assess and remediate these issues in line with defence supplier expectations.

The Challenge

VDM’s external security posture did not meet the standards expected by their defence partners. At the time of review, their UpGuard security rating was in the D range with a score of 396.

Issues identified included:

• External security rating below the threshold expected by defence supply chain partners
• Legacy DNS and hosting configurations exposing unused mail systems, webmail and FTP endpoints
• SPF and DMARC records not correctly configured, leaving email security gaps
• Outdated hosting platforms presenting a potential entry point into corporate systems

Unresolved, these issues carried the risk of impacting VDM’s standing with Austal Defence and their broader participation in defence-related work.

The Solution

Downtime Assassin worked with VDM and relevant external stakeholders to implement a structured security uplift. Work was prioritised around removing legacy exposure, strengthening email security controls, and aligning the environment with recognised frameworks.

Actions taken:

• Reviewed and cleaned up legacy DNS records, removing unused and exposed services
• Simplified and corrected SPF configuration to reflect the current sending environment
• Implemented DMARC at reject enforcement to address email spoofing risk
• Migrated DNS to a platform supporting advanced record types, including CAA records
• Decommissioned exposure from deprecated hosting platforms
• Provided recommendations aligned to Microsoft 365 security best practices and the

Essential Eight framework

The Outcome

Following the engagement, VDM’s UpGuard score improved from 396 to 726, moving their rating from D to B. No high or critical risks remained across their external systems.

Key outcomes:

• External attack surface reduced and aligned with current best practice
• Email security posture strengthened, with SPF and DMARC now correctly enforced
• Systems aligned to defence supplier expectations and Essential Eight direction
• Confidence restored with Austal Defence, supporting VDM’s continued supplier relationship
• Security foundation in place to support ongoing compliance and future defence work

Testimonial

“We engaged Downtime Assassin to assist with a security uplift following external feedback received as part of our work within the defence supply chain. They worked closely with us to identify and remediate the issues, cleaning up legacy infrastructure, strengthening our email security, and helping us align with current best practices. The outcome was a significant improvement in our external security rating and the removal of key risks that had been flagged. More importantly, this work gave both our team and our partners greater confidence in the security of our systems. We found the team to be practical, knowledgeable, and easy to work with throughout the process.”

VDM Consulting

Ready to Kill Downtime?