Cyber For Hire (Audio)

In late January, CISA, the NSA and the MS-ISAC released an advisory warning about the malicious the use of legitimate remote monitoring and management software, after uncovering illegal hacking activity on two federal civilian executive branch networks. Whether compromised via social engineering or through exploits, RMM tools can grant unauthorized users potentially unfettered access to your MSP clients. So the question must be asked: Are you using RMM responsibly?

Network difficulties can crop up at any time, as can possible attacks. And companies like having the reassurance that at a moment's notice they can reach out to their MSSP for help. This segment will look at how managed security services providers can operate a top-notch, responsive support desk that meets or exceeds their clients' needs through best practices and policies, optimal workflows and automated tools.

Show Notes: https://securityweekly.com/cfh10

The developer of a commonly used software issues an urgent out-of-band update for a coding vulnerability that is discovered to be under attack. Immediate patching is imperative. Under such circumstances, what can MSSPs do to quickly identify which of their clients are running this vulnerable software version? And then what are the best practices for managing and collaborating with these exposed organizations, in order to ensure timely cooperation and a decisive response? Security Operations Center services are in demand, as many organizations are unable to stand up their own full-fledged SOC. For MSSPs looking to add, grow or mature their own outsourced SOC services offering, a key early question is: Do we build from scratch, partner with third parties or buy these capabilities through a merger or acquisition? This session will look at the various pros and cons of each approach.

This segment is sponsored by Netsurion. Visit https://msspalert.com/netsurion to learn more about them!

Show Notes: https://securityweekly.com/cfh9

In late January, law enforcement officials disrupted the operations of the Hive cybercriminal group, which has profited off of a ransomware-as-a-service (RaaS) business model. And though the takedown was an inspiring victory, there's plenty more ransomware where that came from. Indeed, Microsoft just reported that at the conclusion of 2022 it was tracking more than 100 threat actors using over 50 different ransomware families to extort victims. And many of these criminal networks operate like professional businesses in this underground economy. Bottom line: there's still a lot of work to be done, and it begins by collecting and communicating the right cyber threat intelligence to profile these threat actors and understand how they operate, so we can anticipate and defend against their next move. In this segment, we will discuss the responsibility of the MSSP to understand their opponents while keeping their clients abreast of the latest intelligence reports and adversary TTPs.

The life of a Cybersecurity professional is not for the faint of heart. The job can be stressful, sometimes thankless. And when an attack transpires, you can work long hours knowing the fate of your employer is on the line. Or in the case of an MSSP, the fate of your client. You might even argue that being a managed security services provider magnifies the stress and burnout factor because you must answer to multiple companies at once – all with high expectations of you. With that in mind, this session will examine key policies and strategies that you can institute to relieve your employees of some of this burden. Plus how to manage security professionals through a security crisis or difficult time in order to minimize the emotional toll.

Show notes: https://securityweekly.com/cfh8

Some MSSPs have a hard time leaving their comfort zone when it comes to their toolsets. They prefer to stick to their own tried-and-true suite of tools and are reluctant to add new ones, even though it might be beneficial to do so. After all, not every client has the exact same needs and challenges. This session will look at how MSSPs can potentially boost their revenues, increase their subscription add-ons and increase renewal rates by expanding their horizons and embracing new innovations. It will also explore which emerging solutions in particular should be receiving more attention and love from service providers than they are currently receiving.

The advancement of artificial intelligence and machine learning has for years been both touted and feared in IT and cybersecurity circles. Still, the sudden emergence of the generative AI tool ChatGPT seems to have sneaked up on a lot of people. While ChatGPT can be leveraged as a tool for good to help write Yara rules or uncover vulnerabilities, it can also be misused by malicious actors to create highly convincing spear phishing emails or write malware. And while the tool's ability to generate code can be useful to aid developers, it can also unintentionally create more vulnerabilities that DevSecOps teams will be tasked with correcting. In this segment, we'll look at why MSSPs need to stay ahead of the game and develop policies to address this emerging technology on behalf of their clients.

Show Notes: https://scmagazine.com/cfh7

No matter how well constructed an MSSP's security architecture is, or how tight its security controls are -- all that good work can be wasted or sabotaged far too easily when the client organization fails to follow standard cyber security hygiene practices. Just because a company uses a managed security provider to bolster its cyber preparedness doesn't mean they still don't have a responsibility to promote security awareness across their workforce and institute some basic cyber governance policies. In this segment, Cyber for Hire will seek to identify and find potential solutions for addressing users' key security awareness failings because at the end of the day, security must be a two-way street.

Sometimes it feels like security professionals and business leaders are speaking different languages. That's why it's critical for managed security providers to communicate with their clients' financial decision-makers in a business-aligned manner that conveys how cybersecurity can help advance and protect the company's corporate interests. This featured topic will identify strategies for translating infosec concepts into business objectives, avoiding confusing cyber jargon, finding cyber champions on your client's payroll who can amplify your message, and blocking out external forces and influences that muddle your message.

Show Notes: https://scmagazine.com/cfh6

A lot of thought goes into which cyber solutions vendors MSSPs ultimately align themselves with. There are many factors to consider: What capabilities do you want to prioritize based on client demand? How do you assess your weak points or gaps in services? And then what are the top qualities in vendors you're looking for? Today's episode will look at some of the key strategies for MSSPs looking to build their own alliance of vendor partners.

It sounds ironic, maybe even a little paradoxical, but it might just take hiring third party to help an organization assess and mitigate the risk posed by their other third-party partners. For organizations that cannot or prefer not to spearhead this task internally, MSSPs can provide a scalable and consistent third-party risk assessment program that yields insightful, enforceable and actionable recommendations. This segment will examine the marketable benefits of having MSSPs evaluate third-party partnerships that exist outside of their clients' organizational boundaries, plus best practices when conducting outsourced risk assessments, and the latest trends in third-party risk that MSSPs are observing.

Show Notes: https://scmagazine.com/cfh5

It's not uncommon for IT security professionals and OT engineers to be at odds with each other over cyber governance policies and procedures inside industrial settings. And when the IT professionals work for an outside firm such as an MSP, then that can create another level of separation that can further expand the schism between IT and OT. With that in mind, what are some key considerations that managed security providers and their industrial clients must account for in order to develop a governance framework that meets the needs of both IT security pros and OT engineers?

You're an MSSP that has just experienced a severe ransomware attack that's disrupting your services. How do you make sure that the infection isn't passed along to your clients? And what do you do if sensitive information on your customers has been exfiltrated? In this segment, Cyber for Hire will lay out some of the key initial response steps MSSPs must take when they themselves turn out to be the victim.

Show Notes: https://scmagazine.com/cfh4

Let's play the dating game! When pairing up a company with a fractional or virtual CISO, there are a lot of factors to consider. Personalities count, as do cyber skills and IT background, industry sector experience, geographical limitations, and the company's stated core objectives. The available IT expertise on the client's corporate payroll also makes a difference. This session will look at how to find a healthy, harmonious match between vCISO and client, and what warning signs to watch out for if the relationship starts to get rocky.

When finding cyber talent is difficult, end user organizations often turn to managed security providers to fill the void. But then where do MSSPs turn to hire infosec professionals? What are their top strategies for developing and optimizing talent? And for that matter, what makes a quality MSSP infosec pro to begin with? Who's built for this kind of job, working with multiple clients, not just one company?

Show Notes: https://scmagazine.com/cfh3

It's becoming increasingly difficult to qualify for cyber insurance. Insurance providers are wary of multimillion dollar payouts resulting from costly ransomware attacks, and so the onus is on companies to prove that they can meet certain minimum cyber hygiene standards. One of the potential paths to reach this objective is by contracting a managed security provider who can ensure that you meet coverage criteria. But just how big of a difference does this strategy make -- enough for MSSPs to make insurance a key selling point? Conversely, do cyber insurance companies judge MSSPs' coverage worthiness based on the clients they keep? And what are some examples of exclusionary language that cyber insurance policy holders in an MSP relationship should watch out for? There is a basic expectation that an MSP should create a single, standardized stack of tools that they will use to service every one of their customers. And while that makes perfect sense for the MSP, it puts the client in a tricky position: either abandon the infrastructure and processes they already have in place and make a big adjustment to align with the MSP's standards… or accept that they cannot access the MSP's services. This segment will examine the pro and cons of this dilemma.

Show Notes: https://scmagazine.com/cfh2

If you were to ask most companies right now, "Why you have you hired an MSP?" the answer probably would sound something like: "Resources are strained. Talented is limited. So we're outsourcing certain security functions to a firm that has the built-in capabilities to manage this for us." But is the MSSP model becoming more than a convenient economics and personnel decision? Is this actually becoming a go-to "must have" for all organizations -- the next logical evolution in the industry's approach to solving security? Plus: Dear Cyber for Hire, our marriage counselor advice column for MSPs and their clients. And The Security Detail, our curated rundown and analysis of the latest cybersecurity news. Companies must communicate clear expectations when contracting with pentesters, red teams and vulnerability hunters in order to set key ground rules for what data and systems can be accessed, what's off limits and who is responsible if something breaks. Of course, if you set too many restrictions and parameters, then how do you really know if you're safe from malicious hackers, who of course don't play by the rules? Plus: We Speak Geek, a weekly segment where our guest shares what they geek out about!

Show Notes: https://scmagazine.com/cfh1