• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

My TechDecisions

  • COVID-19 Update
  • Best of Tech Decisions
  • Topics
    • Video
    • Audio
    • Mobility
    • Unified Communications
    • IT Infrastructure
    • Network Security
    • Physical Security
    • Facility
    • Compliance
  • RFP Resources
  • Downloads
  • Podcasts
  • Subscribe
  • Project of the Week
  • About Us
    SEARCH
Managed Service, Network Security

Selecting a Managed Service Provider in an Evolving Threat Landscape Requires Due Diligence

A rise in attacks against MSPs is leading to the creation of new verticals in the IT industry and a harder choice when selecting a provider.

February 19, 2020 Zachary Comeau Leave a Comment

Managed Service Provider Cybersecurity

You go to work in the morning, but your boss stops you before you can sit down and start up your computer at your work station. An attacker accessed your company’s networks and is holding your data hostage for a ransom of bitcoin, and nobody at the company can access the files they need to do their job.

The entire business is effectively shut down.

How is that possible? Your firm contracts with a managed service provider (MSP) that provides you with — on top of cloud services and tech support — security solutions that should have prevented this attack.

However, after due diligence, it’s discovered that the MSP itself is to blame. Somehow, the attackers first accessed the MSP’s network, which gave the criminals the keys to hundreds of other networks and a treasure trove of data.

So, how do you know which MSP will keep you safe — not only from attackers — but from themselves?

According to experts from IT trade association CompTIA, cybersecurity practices should be the leading concern when businesses of all sizes outsource their IT and security operations.

IT industry responds with new verticals

The rate of attacks against MSPs and other technology keyholders has increased so much that the industry has responded in kind and given rise to Managed Security Services Providers (MSSP), which are essentially MSPs with a focus on cybersecurity.

According to Carolyn April, a senior director of analysis at CompTIA, MSSPs are more of a pure play organization that hire a broad range of cybersecurity specialists and typically operate their own security operations center (SOC).

“They take cybersecurity a little more seriously than general MSPs,” April says.

Many IT providers are doubling down on their security options and becoming MSSPs. In addition to a good branding move for the company, it brings more security tools beyond a firewall and antivirus software.

That includes hiring chief security officers, security analysts, engineers, architects and high-level penetration testing experts. In contrast, regular MSPs may have just one or two security experts on staff.

“If they’re taking it seriously, they’re putting security as their foot first with customers,” April said.

Educate yourself

End users should come to these meetings with prospective MSPs with knowledge and questions, says Seth Robinson, a senior director of technology analysis at CompTIA.

If they don’t, they run the risk of drowning in IT jargon.

“It might sound good, but it might not fully answer the question,” Robinson says.

The threat landscape is evolving, and despite their expertise in network security, MSPs and even MSSPs aren’t immune. All it takes is a millisecond of a lapse in security or a deviation from normal security practices for dozens of clients to be compromised.

Read Next: The IT Industry Needs Everyone’s Help to Close the Cybersecurity Workforce Gap

There are now a number of ways and methods hackers will use to infiltrate an MSP’s client base, like phishing attacks, ransomware and compromising remote desktop applications.

The end user needs to be aware of those threats and come armed with questions about how their prospective provider fights those attacks.

“If end users want to ask their MSP or MSSP about their practices, the end user is going to have to be educated themselves to some degree,” says Robinson.

Quiz your potential security provider

Once the end user is educated, Robinson suggests they ask two key questions of their potential services provider:

  • What do they do around data security?

“If they’re a cloud provider and operations are spread across multiple locations, questions have to be around data security and not just network security,” says Robinson.

  • What is the MSP doing with their own staff?

“One of the primary types of attacks is phishing,” says Robinson. The end user should try to get some sense of what the MSP is doing to educate their own staff around modern security threats so they won’t fall victim to those sorts of things.”

According to April, end users shouldn’t take the providers’ alleged expertise for granted. Questions should dig deep into the MSP’s business, offerings and breach history:

Have they gone through the rigor of becoming an MSSP?

What percentage of their total revenue comes from security services or compliance services as opposed to something else?

“Ideally, they’re all about security,” April says.

Tagged With: Cybersecurity, Managed Security Service Provider, Managed Services

Related Content:

  • ROI of Cybersecurity The ROI of Cybersecurity
  • Supply Chain Compromises How IT Leaders Can Protect Against Supply Chain…
  • SolarWinds CEO SolarWinds CEO: Company Might Not Be the Only…
  • SolarWinds Hack affected Microsoft Source Code, The FBI warns that hackers are carrying out “swatting attacks” via compromised smart devices to make hoax calls to emergency services. ‘Swatting’ Hacks Occurring Through Smart Cameras

Free downloadable guide you may like:

  • Top 9 Reasons Enterprise IT Leaders Are Moving Their Video Surveillance to the Eagle Eye Cloud

    Working in IT has enough challenges without adding in the complications of surveillance video. Things like total cost of maintenance, how the VMA manages bandwidth, what cameras are supported, what level of cybersecurity is provided, and what integrations are available to use are important factors IT managers have to think about when assessing a video […]

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Get the FREE Tech Decisions eNewsletter

Sign up Today!

Latest Downloads

Top 9 Reasons Enterprise IT Leaders Are Moving Their Video Surveillance to the Eagle Eye Cloud

Working in IT has enough challenges without adding in the complications of surveillance video. Things like total cost of maintenance, how the VMA m...

Using Live Chats and Chatbots to Increase Customer Engagement

There's a lot to consider when building out a chatbot experience to ensure that it delivers a seamless experience and meet your business goals.

Finding a New Balance

The shift to a hybrid work environment is a trend that has increased in popularity over many years. The COVID-19 pandemic has spurred this trend, f...

View All Downloads

Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today!
Sharp Microsoft Collaboration HQ Logo

Learn More About the
Windows Collaboration Display

More from Our Sister Publications

Get the latest news about AV integrators and Security installers from our sister publications:

Commercial IntegratorSecurity Sales

Footer

TechDecisions

  • Home
  • Welcome to TechDecisions
  • Subscribe to the Newsletter
  • Contact Us
  • Media Solutions & Advertising
  • Comment Guidelines
  • RSS Feeds
  • Terms of Use
  • Privacy Policy
  • Twitter
  • Facebook
  • Linkedin

Free Technology Guides

FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets

View all Guides
TD Project of the Week

Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.

Enter Today!

© 2021 Emerald X, LLC. All rights reserved.