Cybersecurity factors unique to MSPs

Posted:

09/06/2023

| By:

Sajal Sahay

This blog is part five of the multi-part series summarizing “The Ultimate Operations Guide For MSP Cybersecurity.” In this fifth installment, we’ll detail the components of cybersecurity that are unique to MSPs and establish a common starting point for building out your cybersecurity offerings. If you’re interested in reading the previous installments of this series, you can access them below:

Cybersecurity for MSPs

Due to their responsibility for servicing and securing the systems and data for themselves and their clients, MSPs have a unique role to play in cybersecurity. This creates unique requirements to ensure it meets its mission and limits its liability. Throughout the rest of this blog, we’ll explore some of these unique factors MSPs should be considering as they establish their cybersecurity program.

Protection of client data

MSPs have been entrusted with sensitive, valuable information and must offer secure protection for their clients' data. MSPs are responsible for implementing robust cybersecurity measures to protect sensitive data from unauthorized access, theft, or destruction. MSPs must also comply with legal and other required regulations to avoid potential penalties and damage to the client’s reputation.

Trust and transparency

Building trust and transparency is crucial for MSPs trying to establish long-term client relationships. You can help build trust and transparency by:

Defining your services: Clearly define the offered services and how you’ll deliver them.
- This will help the client understand what they are paying for and what to expect
- It’s important to also clearly outline the cost and timeline associated with each service
Sharing success stories: Sharing success stories from previous clients can help establish credibility and trust with new clients.
- These stories can showcase the provider’s ability to deliver on their promises and provide excellent service
Maintaining open communication: Transparent communication with clients is essential.
- Be available to answer client questions and provide regular updates on the status of projects
- Be upfront about any issues that may arise and work with clients to resolve them in a timely manner
- Use a PSA solution to improve client communication and project management
Provide cybersecurity measures: Ensure you have robust cybersecurity measures in place to protect client data.
- Be transparent about these measures and share details with clients to reassure them that their data is safe
Encourage feedback: Encouraging client feedback can help MSPs understand their client’s needs and preferences.
- This can help them tailor their services to meet their client’s specific needs and build stronger relationships
Provide ongoing support: Providing ongoing support to clients after completing a project can help build long-term relationships.
- Be available to provide support and answer questions even after completing the project

Compliance

Adhering to compliance is critical for MSPs to protect client data, mitigate risk, build trust, and remain competitive in the industry. There are many reasons compliance is so important for MSPs, including:

Fulfilling legal obligations: MSPs must comply with various laws and regulations governing data and information handling. Failure to comply with these laws can result in legal penalties and fines, which can be costly for the provider and damage their reputation.
Protecting client data: Clients entrust their sensitive data to MSPs, and it’s their responsibility to protect that data. Compliance regulations, such as the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA), provide guidelines for handling sensitive data, including how it should be stored and who can access it.
Mitigating risk: Compliance regulations provide guidelines for mitigating risks associated with data breaches and cyberattacks. By adhering to compliance, MSPs can implement cybersecurity measures to protect their clients’ data and minimize the risk of breaches.
Building trust: By adhering to compliance regulations, MSPs can build trust with their clients and establish a reputation as a reliable and trustworthy service provider.
Providing a competitive advantage: Adhering to compliance can provide a competitive advantage for MSPs. Clients are increasingly aware of the importance of data privacy and cybersecurity and are more likely to choose a provider that demonstrates a commitment to compliance and cybersecurity.

Risk management

An effective risk management program for an MSP is comprehensive, proactive, and tailored to the specific risks faced by the organization. Some of the key components of an effective risk management program include:

Identifying and assessing risks: The first step in risk management is to identify and assess the risks that the MSP faces. Risks may include data breaches, cyberattacks, software vulnerabilities, service interruptions, and regulatory compliance issues.
Developing risk management strategies: Once risks have been identified and assessed, the next step is to develop risk management strategies. Design these strategies to reduce the likelihood and impact of risks.
Implementing risk management strategies: Implement your risk management strategies after developing them. This may involve implementing new technologies or policies and training employees on identifying and responding to potential risks.
Monitoring and reviewing risks: Risk management is an ongoing process, and risks must be continuously monitored and reviewed. This may involve regular vulnerability assessments and penetration testing, reviewing incident reports, and analyzing cybersecurity logs.
Improving the risk management program continuously: Continuously improve your risk management program based on the results of risk assessments, monitoring, and reviews. This may involve updating policies and procedures, implementing new technologies, and providing additional employee training.

Overall, an effective risk management program for MSPs takes a holistic approach that incorporates technical, administrative, and operational controls to identify, assess, mitigate, and monitor risks.

Tools of the trade

The technical tool footprint of any MSP often includes password vaulting solutions, remote monitoring and management (RMM), and other multi-tenant solutions. These tools make servicing clients more efficient through centralization, multi-tenancy, and automation—which reduces the need for manual assistance and the number of “clicks” to support a client. Attackers target MSPs hoping to compromise one or more of these solutions, especially knowing that the remote access capabilities within any compromised RMM would allow them access to all connected networks managed by the MSP.

Business continuity and disaster recovery

It’s recommended that MSPs have a disaster recovery plan in place to ensure that their operations can continue in the event of a cybersecurity breach or natural disaster. MSPs should have a backup strategy and redundant infrastructure to ensure the client’s data is always available. In today’s evolving threat landscape, it’s critical to protect your clients’ data upfront with cybersecurity solutions. However, cyberthreats aren’t always avoidable, so it’s important to have a business continuity and recovery solution in addition.

Training and cybersecurity awareness

MSPs are a prime target for attackers, so it’s important your employees are well-trained on the equipment and solutions they service, knowledgeable about the verticals they service, and familiar with common threats facing the regions, verticals, and MSPs.

Creating a scope of work

It’s important for MSPs to have a clear scope of work (SOW) with their clients that concisely explains what is and is not covered under the agreement. Sometimes, clients will request work outside the agreement SOW. In these cases, set clear expectations if you’re willing to do the work—and if you can’t, tell the client as soon as possible.

It’s important to remember that when it comes to matters related to cybersecurity, MSPs shouldn’t speak if they don’t know, and once they do know, they must set expectations quickly and correctly.

Responding to alerts

MSP security teams need to know the sources capable of generating alerts and the variety of alerts that could be generated. A member of the team will need to be responsible for monitoring the number of alerts, as well as the priority and age of the alerts, to ensure that internal SLAs are being met. Even without SLAs, MSP clients expect responses to alerts, so it’s important to have an established method for your security team to follow when doing so. Some popular methodologies for triaging alerts include:

Priority-based triage: In this methodology, incoming tickets are categorized by their level of urgency and importance. The most critical issues are prioritized and addressed first, followed by less urgent issues.
Skill-based triage: This methodology involves assigning tickets to the MSP team based on their specific areas of expertise. For example, tickets related to software bugs might be assigned to a developer, while tickets related to billing issues might be assigned to a customer support representative.
First-in, first-out (FIFO) triage: In this methodology, tickets are assigned in the order they were received, with the oldest tickets being addressed first. This approach can help ensure that all tickets are addressed in a timely manner but may not be suitable for urgent or high-priority issues.
Round-robin triage: In this methodology, tickets are assigned within the team in a rotating fashion, with each member taking turns addressing incoming issues. This approach can help distribute the workload evenly across team members and prevent any one person from becoming overwhelmed.
Automated triage: MSPs use automated systems to categorize and assign incoming tickets based on predefined rules and criteria. This approach can help streamline the triage process and ensure tickets are promptly assigned to the appropriate individual.

Insurance

Cyber insurance is a type of insurance that can help protect MSPs from financial losses and liability due to cyberattacks or data breaches. When evaluating cyber insurance needs, there are several factors to consider, including:

Type of services offered: The technology services MSPs offer may impact their cyber insurance needs. For example, if the MSP stores sensitive client data or processes financial transactions, they may be at a higher risk for cyberattacks and data breaches.
Data sensitivity: The sensitivity of the data an MSP handles can also impact their cyber insurance needs. If the MSP handles highly sensitive data such as financial or medical information, their cyber insurance policy may need to provide more comprehensive coverage.
Size of the company: The size of the MSP may also impact cyber insurance needs. Small businesses may be more vulnerable to cyberattacks due to limited resources, while larger companies may be targeted due to the large amount of data they handle.
Compliance requirements: If the MSP is subject to regulatory requirements such as HIPAA, PCI-DSS, or GDPR, they may need to ensure that the cyber insurance policy meets these requirements.
Risk assessment: Conducting a risk assessment can help an MSP identify potential cyber risks and vulnerabilities, which can help determine the appropriate level of cyber insurance coverage needed.
Changing requirements of insurance: Cybersecurity insurance is a hot topic with insurance providers, which means they’re often changing requirements around cybersecurity technical controls and considering additional exceptions to the policy.

After an MSP identifies their cyber insurance needs, they will need to determine the best insurance solution relevant to their specific situation. Examples of standard cyber insurance policies include:

General liability insurance: This policy covers the MSP from fundamental risks of running an organization, such as “slip-and-fall” claims, damage to a third party’s property, product liability claims, damage to rented space, and personal or advertising injury claims.
Cyber liability insurance: This coverage protects the MSP from lawsuits, fines, and penalties from hacking attacks or data breaches. It can also reimburse the MSP for its direct expenses, such as breach notification costs, credit monitoring, data restoration, and forensic analysis.
Professional liability insurance: Also known as “errors and omissions” or “malpractice” insurance, this covers the organization if an act, error, or omission committed during the company’s performance of professional services is alleged to have caused a monetary loss for a third-party.

Agreement considerations

A well-drafted MSP contract provides clarity and transparency around the services being provided, the performance standards needing to be met, and the responsibilities and liabilities of both parties. MSPs should work with a lawyer who specializes in technology contracts to ensure that the contract is legally sound and protects the MSP’s interests. Key points to consider:

Scope of services: One of the most important aspects of any MSP contract is clearly defining the scope of services provided. This includes a detailed description of the services provided, any limitations or exclusions, and any deliverables the MSP is responsible for.
Service level agreements (SLAs): SLAs are critical to any MSP contract. They outline the performance standards the MSP is expected to meet, such as uptime guarantees, response times, and resolution times. It’s crucial to ensure that SLAs are realistic and achievable and that the MSP has the necessary resources and processes in place to meet them.
Data security and privacy: MSPs will likely handle sensitive client data. It’s important to include provisions in the contract outlining any data security and privacy practices and to ensure that the MSP complies with applicable laws and regulations.
Intellectual property: Depending on the nature of the MSPs services, they may need to address intellectual property issues in the contract. For example, if the MSP is developing custom software for a client, they’ll need to clearly define who owns the resulting intellectual property.
Termination and renewal: An MSPs contract should include provisions for both termination and renewal. This outlines the circumstances under which either party can terminate the contract, any notice requirements, and provisions for renewing the contract, including any changes to the scope of services or pricing.
Liability and indemnification: Liability and indemnification issues outline the extent of the MSPs liability for any damages or losses that the client may incur, as well as any indemnification obligations in the event of a breach or other legal dispute.

Secure onboarding

Onboarding clients securely is a crucial aspect of running a successful MSP business. By prioritizing cybersecurity from the outset, MSPs can build trust with their clients, ensure compliance with regulatory requirements, and reduce the risk of data breaches and other cybersecurity incidents. Considerations for MSP onboarding include:

Protecting sensitive information: During onboarding, MSPs often gather credentials and handle or gain access to sensitive information on behalf of their clients, such as financial data, personal information, and trade secrets. MSPs must protect this information from unauthorized access or disclosure.
Building trust: Clients are more likely to trust an MSP that takes cybersecurity seriously. By demonstrating a commitment to cybersecurity during the onboarding process, MSPs can build trust with their clients and establish a solid foundation for a long-term working relationship.
Prioritizing compliance: Depending on the industry and type of data involved, MSPs may be subject to various compliance requirements, such as HIPAA, GDPR, or PCI DSS. Securely onboarding clients can help ensure that the MSP follows these regulations from the outset, reducing the risk of costly fines or legal action down the line.
Managing risk: MSPs are often responsible for managing and mitigating various risks, such as cybersecurity threats or data breaches. Securely onboarding clients can help reduce these risks by establishing best practices and protocols for secure data handling and transfer.
Identifying active compromises: MSPs should train the onboarding team to identify active compromises, initiate an appropriate incident response process, and take this opportunity to build a better relationship with the new client.
Maintaining your reputation: In today’s highly connected world, a data breach or cybersecurity incident can quickly damage your reputation. By prioritizing cybersecurity during the onboarding process, MSPs can demonstrate a commitment to protecting their client’s data and maintaining the highest levels of security.

Secure offboarding

Securely offboarding clients is essential to maintaining an MSPs reputation as trustworthy and reliable. It involves managing the process of ending the relationship with a client to ensure the safety and confidentiality of the client’s information and data. Considerations for secure offboarding include:

Protecting client data: Client data is one of the most valuable assets for any MSP. During offboarding, the MSP must ensure that all the client data is securely deleted or transferred to the client as per the agreed-upon terms. Mishandling the client’s data can lead to serious legal and reputational consequences.
Maintaining client trust: Reputation is built on trust, and any mishandling of client data or information can easily damage it. MSPs can maintain their client’s trust and reputation by ensuring a secure offboarding process.
Complying with regulations: In many cases, MSPs must comply with various data protection and privacy regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA). A secure offboarding process helps the MSP to comply with these regulations and avoid legal penalties.
Transitioning smoothly: A secure offboarding process ensures a smooth transition for both the MSP and the client. It allows the client to transition to another service provider seamlessly while the MSP can manage its resources and staff effectively.

User verification

When clients call in or email for support, the MSP must verify their identity before performing sensitive operations like password resets or access grants. Verification by voice alone isn’t sufficient—technicians don’t know the voice of every user at every client, and even in very small or new companies, the availability of “deep fakes” makes voice recognition unreliable. MSPs may use keywords or support PINs to verify identities, but they require frequent maintenance and upkeep. Cybersecurity products also offer identity validation as a feature of an app, either standalone or as an additional function of an authentication app. As an MSP, it's essential to ensure that a verification procedure exists for a client’s primary contact. The need for verification isn’t limited to authentication—it’s also critical to have rules in place to validate access changes, account creations, email forwarding rules, etc.

Responding to client disasters

When a client faces a disaster, it’s critical to respond promptly and effectively to help minimize the impact of the disaster on the client’s business. There are several essential steps MSPs should take, including:

Identifying the response team before the disaster: Identify the employees that will assist clients and ensure they have the training necessary to assist with disaster recovery services.
Identifying the scope and severity of the disaster: Determine the extent of the disaster and its impact on the client’s IT infrastructure and business operations.
Activating the disaster recovery plan: If the client has a disaster recovery plan in place, activate it immediately. They should clearly understand the plan to ensure a quick and effective response.
Communicating with the client: Communicate with the client to provide updates on the situation and inform them of the steps being taken to address the disaster.
Prioritizing critical systems: Prioritize restoring critical systems and data to ensure the client’s business operations can continue as soon as possible.
Providing technical support: Provide technical support to the client’s IT staff to help properly restore the necessary systems and data.
Evaluating and documenting the response: After addressing the disaster, evaluate the response and document any lessons learned to improve future responses.

Responding to client incidents

MSPs are responsible for monitoring and managing a client’s cybersecurity infrastructure. When a cybersecurity incident occurs, the MSP must respond quickly and effectively to minimize the impact on the client’s business. There are several critical steps MSPs should follow when responding to client incidents. This includes:

Identifying the response team: Identify the employees who will assist clients and ensure they have the training to assist with incident response services.
Communicating alerts: Communicate with the client to confirm the incident and obtain any additional information needed.
Analyzing the incident: Thoroughly analyze the incident to determine its scope, severity, and potential impact. They must document all steps, notes, and timelines at the time the action is taken.
Containing the incident: Once you’ve analyzed the incident, take steps to contain the incident and prevent it from spreading further.
Mitigating the risk: Work to mitigate the impact of the incident. This may involve restoring affected systems from backups, patching vulnerabilities, or taking other steps to prevent further damage.
Documenting and reporting: Throughout the incident response process, maintain detailed records of all actions taken and provide regular updates to the client. This documentation can be used to assess the response’s effectiveness and identify areas for improvement.
Conducting a post-incident analysis: Once the incident is resolved, conduct a post-incident analysis to identify the incident’s root cause and determine how to prevent similar incidents in the future.

Don’t forget—you don’t have to worry about responding to client incidents alone. ConnectWise Incident Response Service™ can help ensure the threat is neutralized efficiently and that you and your clients are back up and running as soon as possible.

Team certifications

Certifications can be important for MSPs for several reasons, including:

Committing to the profession: certifications and educational pursuit help differentiate MSPs from those with no real background in cybersecurity.
Establishing credibility: Certifications demonstrate that an MSP has met a certain level of competency and expertise in a specific technology or service. This can help build trust and credibility with clients.
Creating a competitive advantage: Having certifications can give an MSP a competitive edge in the market. It shows that they are committed to staying up to date with the latest technologies and trends in their field and have the skills necessary to provide high-quality services to clients.
Ensuring compliance: In some cases, industry or regulatory standards may require specific certifications. For example, MSPs providing services to the healthcare industry may need HIPAA compliance certification.
Training and development: Obtaining certifications often involves taking courses and undergoing training, which can help MSPs stay current with the latest technologies and best practices in their field.
Maintaining vendor relationships: Some vendors base pricing discounts on the number of certifications held by the team.

Summary

This blog is meant to serve as a high-level overview of the cybersecurity factors unique for MSPs. For a more detailed understanding of each of these unique factors, download “The Ultimate Operations Guide for MSP Cybersecurity” eBook in its entirety.