MSP 1337 | Cybersecurity Education and Security Guidance

We all no there is no magic bullet when it comes to cybersecurity but that doesn't mean it has to be complicated either.  I sit down with Eric Hanson of Inland Productivity Solutions to talk about Incident Management, Incident Response and many more plans, policies and programs that are often reduced to acronyms that get very confusing.  One of the key things we talk about is getting to the root of the questions our clients, insurance companies and our client's clients are asking before we try to give them an answer.  

I try not to pick favorite episodes but this topic was definitely top 10.

Over the past few weeks, Governance, Business Basics, and Vendor Sprawl have had one standard and constant theme... We all feel like we are drinking from a firehose. We all know we need to focus on governance, risk, and compliance, but we all suffer paralysis analysis. Chad Holstead of BKS and I had a great discussion about getting started with cybersecurity governance. We are all drinking from the firehose; as our conversation progresses, we quickly conclude that we are better together than alone!

We have all implemented tools with the intent to solve or address all kinds of different challenges. After they have been implemented, are they working as expected?

I sit down with Brian Weiss of ITECH Solutions to talk about just that. We covered a lot of ground regarding getting tools dialed in and where they need SOC services, and additional layers of security might require 3rd party resources. We also uncovered that not all clients make sense to onboard with today's threat landscape. Surprise..., but what about a client you discover isn't willing to change or has become a risk to your business or your other clients? What about when your client onboards a client of their own that introduces new risks?

We recently started a journey down a path that talks about Governance for SMB, picking the right tools/software to run your MSP, and of course, don't forget you can only pick just one... This week I had the opportunity to sit down with Jessica Millhiser of J Mills Consulting to talk about business fundamentals.  Almost all of our episodes have focused on Cybersecurity, and I had an aha moment over the weekend; you can't have a security-first mindset if you don't have the fundamentals dialed in.  I read a post on Linkedin by none other than Jess and realized that we could really benefit from a reset, get "back to basics."

We often take for granted the products and services we use to help reduce overhead and Full-Time Resources (FTE).  I sit down with Ismael Amado of IT Ninjas to talk about starting a new MSP right before a pandemic and how important a security-first approach is.  Just because the products and services you use aren't associated with cybersecurity doesn't mean they don't directly impact your cybersecurity maturity.

Almost every time I do a security maturity assessment I find that companies are the least mature in Governance.  The areas that seem to need the most attention are Policy and Compliance which is to be expected since that is the area we least like to focus on.  In this episode, Sarah O'Kelley from onShore Security and I discuss the differences between governance and leadership and how cybersecurity plays into the leadership and health of an organization.

As we prepare for 2022 and the opportunities and challenges it is sure to bring I thought we should take a minute to focus on people.  Consumers vs employees, two sides of the same coin, but very different parameters placed on how they interact with the digital world.  Join me as I discuss People, Processes, and products, and services with a focus on people.

This is a bonus episode as we wrap up the year.  Thanks to Joshua Smith of Varonis for taking the time out of his busy schedule to share. I'd also like to thank the MSP-Ignite and all of it's members who actively listen!

I think everyone at this point has heard someone talk about Log4j.  Even my 8th grader has heard about it as it was featured on CNN10.  This week we are doing a special episode featuring Ryan Weeks, in-house CISO for Datto.  This is an episode that every MSP should listen to as it focuses on what MSPs should be doing as it pertains to log4j. How an MSP can be proactive and reduce their threat surface and more importantly create a culture within their company to build out vulnerability management and incident response plans to prepare for future vulnerabilities and exploits.

A special thanks to MSP-Ignite for bringing Datto and Ryan Weeks on to this episode.  It is always a privilege to get an hour with Ryan.  I’d also like to thank all of the MSP-Ignite members who participated as we recorded this episode.