A lot of thought goes into which cyber solutions vendors MSSPs ultimately align themselves with. There are many factors to consider: What capabilities do you want to prioritize based on client demand? How do you assess your weak points or gaps in services? And then what are the top qualities in vendors you're looking for? Today's episode will look at some of the key strategies for MSSPs looking to build their own alliance of vendor partners.

Show Notes: https://securityweekly.com/cfh5

It sounds ironic, maybe even a little paradoxical, but it might just take hiring third party to help an organization assess and mitigate the risk posed by their other third-party partners. For organizations that cannot or prefer not to spearhead this task internally, MSSPs can provide a scalable and consistent third-party risk assessment program that yields insightful, enforceable and actionable recommendations. This segment will examine the marketable benefits of having MSSPs evaluate third-party partnerships that exist outside of their clients’ organizational boundaries, plus best practices when conducting outsourced risk assessments, and the latest trends in third-party risk that MSSPs are observing.

Show Notes: https://securityweekly.com/cfh5

You're an MSSP that has just experienced a severe ransomware attack that's disrupting your services. How do you make sure that the infection isn't passed along to your clients? And what do you do if sensitive information on your customers has been exfiltrated? In this segment, Cyber for Hire will lay out some of the key initial response steps MSSPs must take when they themselves turn out to be the victim.

Show Notes: https://securityweekly.com/cfh4

It's not uncommon for IT security professionals and OT engineers to be at odds with each other over cyber governance policies and procedures inside industrial settings. And when the IT professionals work for an outside firm such as an MSP, then that can create another level of separation that can further expand the schism between IT and OT. With that in mind, what are some key considerations that managed security providers and their industrial clients must account for in order to develop a governance framework that meets the needs of both IT security pros and OT engineers?

Show Notes: https://securityweekly.com/cfh4

When finding cyber talent is difficult, end user organizations often turn to managed security providers to fill the void. But then where do MSSPs turn to hire infosec professionals? What are their top strategies for developing and optimizing talent? And for that matter, what makes a quality MSSP infosec pro to begin with? Who's built for this kind of job, working with multiple clients, not just one company?

Show Notes: https://scmagazine.com/cfh3

Let's play the dating game! When pairing up a company with a fractional or virtual CISO, there are a lot of factors to consider. Personalities count, as do cyber skills and IT background, industry sector experience, geographical limitations, and the company's stated core objectives. The available IT expertise on the client's corporate payroll also makes a difference. This session will look at how to find a healthy, harmonious match between vCISO and client, and what warning signs to watch out for if the relationship starts to get rocky.

Show Notes: https://scmagazine.com/cfh3

There is a basic expectation that an MSP should create a single, standardized stack of tools that they will use to service every one of their customers. And while that makes perfect sense for the MSP, it puts the client in a tricky position: either abandon the infrastructure and processes they already have in place and make a big adjustment to align with the MSP’s standards… or accept that they cannot access the MSP’s services. This segment will examine the pro and cons of this dilemma.

Show Notes: https://scmagazine.com/cfh2

It's becoming increasingly difficult to qualify for cyber insurance. Insurance providers are wary of multimillion dollar payouts resulting from costly ransomware attacks, and so the onus is on companies to prove that they can meet certain minimum cyber hygiene standards. One of the potential paths to reach this objective is by contracting a managed security provider who can ensure that you meet coverage criteria. But just how big of a difference does this strategy make -- enough for MSSPs to make insurance a key selling point? Conversely, do cyber insurance companies judge MSSPs' coverage worthiness based on the clients they keep? And what are some examples of exclusionary language that cyber insurance policy holders in an MSP relationship should watch out for?

Show Notes: https://scmagazine.com/cfh2

If you were to ask most companies right now, "Why you have you hired an MSP?" the answer probably would sound something like: “Resources are strained. Talented is limited. So we’re outsourcing certain security functions to a firm that has the built-in capabilities to manage this for us.” But is the MSSP model becoming more than a convenient economics and personnel decision? Is this actually becoming a go-to "must have" for all organizations -- the next logical evolution in the industry’s approach to solving security? Plus: Dear Cyber for Hire, our marriage counselor advice column for MSPs and their clients. And The Security Detail, our curated rundown and analysis of the latest cybersecurity news.

Show Notes: https://scmagazine.com/cfh1

Companies must communicate clear expectations when contracting with pentesters, red teams and vulnerability hunters in order to set key ground rules for what data and systems can be accessed, what’s off limits and who is responsible if something breaks. Of course, if you set too many restrictions and parameters, then how do you really know if you’re safe from malicious hackers, who of course don’t play by the rules? Plus: We Speak Geek, a weekly segment where our guest shares what they geek out about!

Show Notes: https://scmagazine.com/cfh1