Hackers will probe for whatever weak links they can find to breach an enterprise’s network. However, what if the weak link is you, the MSP?
The scenario of an MSP as system’s victim instead of the protector is increasingly playing itself out this year, with a spate of attacks from hackers seeking the “keys” to other kingdoms. In one case an MSP was brought to its knees by ransomware demanding hackers. The MSP, faced with the prospect of losing their business, paid the hackers $150,000.
There’s short-term financial damage from such an attack, but the long-term harm to a reputation from falling victim may be worse. After all, if you can’t protect yourself from these types of attacks, how can you keep your clients safe?
To be fair, most MSP attacks are through weaknesses in vendor software. However, perception is the reality, and most clients won’t differentiate.
For information about how to keep yourself safe, Smarter MSP reached out to Dr. Ameer Al-Nemrat, senior lecturer and programme leader at the University of East London (UEL), Information Security and Forensics.
MSPs are not immune from danger
“It is known that there is no perfectly secure system, and MSPs are not exempt from this fact. All systems have weakness or vulnerabilities,” states Al-Nemrat.
Only some of these vulnerabilities are known to the system management. The best course Is to take a risk assessment to decide whether to address or manage discovered weaknesses.
“The management may decide to accept them, with the hope that hackers won’t exploit them. The decision depends on their appetite to risk, where cost and culture are key factors that influence such decisions,” details Al-Nemrat.
MSPs need to look at their services from the client’s point of view
What is the MSP doing to protect their clients? MSPs then need to apply that answer to themselves. Here are some steps Al-Nemrat recommends that will keep yourself — and by extension, your clients — safe:
Know your data: Every business should know the value of their data and where the most sensitive data resides on their system. Categorizing data or system components will ease the process to manage and protect them. By doing so, the number of individuals/employees to access these data will be manageable.
A recent study by Bomgar shows that a business, on average, allows 181 different vendors access to a network. That is a lot of coming and going to manage and secure. To keep data secure, put the most sensitive data in a less trafficked area.
Ask questions: The connected ecosystem is always in flux; today’s status quo may be tomorrow’s antiquated way. MSPs and clients should question security procedures to see if these procedures meet their risk management criteria.
Pen testing: You’re used to doing it for your clients, do it for your MSP also.
Secure remote access: BYOD devices and remote access are constant issues. They need to be monitored for the MSP just like for a client.
Threats to MSPs are the same as any other organization faces. However, MSPs may be more vulnerable because hackers could perceive them as the weak links, especially in light of the recent attacks.
In recent MSP breaches, it was vendor software that was the culprit, but that doesn’t let the MSP off the hook.
“The question is what are MSPs doing to ensure that similar breaches won’t happen again? What type of assurance were they given by the providers that the tools are securely patched?” asks Al-Nemrat.
The appeal of MSPs as a launching pad for attacks doesn’t surprise Al-Nemrat, and that means everyone needs to continue to be on guard.
“MSPs are the best platform to carry an attack against one of their clients,” says Al-Nemrat.
Robust managing of privileged accounts by implementing cybersecurity policies and solutions is the way to go, but even that carries its burdens.
“This is always a challenge to balance between the between accessibility and security,” notes Al-Nemrat.
Restoring one’s reputation after a successful attack on an MSP is the most challenging of all, so always be on your guard and treat yourself as you’d treat your clients.
Photo: REDPIXEL.PL / Shutterstock.
