MSP 1337 | Cybersecurity Education and Security Guidance

We recently talked about BCDR and making sure there is a plan in place that is communicated.  It felt like we left a few things out so this week I sat down with Charles Love again to hash out some of the procedures.  Join us as we discuss Tolerance, Expectations, and Categorical identifiers and how each have their own deliverables to ensure the best outcome for all involved.  No internet for 15 minutes?  No Power for 2 hours?  What happens if the power is going to be out for 4 hours or all day?  Just some of the scenarios we will discuss.

Thanks Again to your sponsor ITPRO.TV

I don't think there are any MSPs who aren't dealing with backups of data for their clients, whether it is for onsite data or cloud services it has become par for the course.  In this episode I sit down with Charles Love of ShowTech Solutions to talk about pitfalls and obstacles we face with our clients when trying to appropriately size and position a BCDR solution.  We even talk about the risks and security that go into deciding which vendors or solutions to use.  CIS v8 Control 15 anyone?

Thanks to ITPro.TV for making this episode possible.

Security and Compliance go hand in hand, but we live in a world where cybersecurity obligations are still driven by what our clients might require of us. 

You don't have to become an MSSP to prioritize cybersecurity in our own businesses and our clients.  We don't have to be experts in cybersecurity controls, but you need to participate and guide your clients on the controls they need to address.

As you work towards or maybe have already added an "s" in MSsP, are you providing guidance and helping to provide evidence to support how to address security controls internally and with our clients.  Brian Doyle of vCIOToolbox and I discuss this and other points brought to light as we address cybersecurity and the compliance control sets used to prove that security posture.

Thanks to ITPRO.tv for being our sponsor.

Power outages, slow internet, ransomware, and many other scenarios cause a finger to get pointed at someone.  I know I have had a few fingers pointed at me and I know that I have also done my own share of finger pointing.  In recent discussions with other MSPs I came to the following conclusion... Finger Pointing doesn't help!  

Eric Hanson of Inland Productivity and I sit down to discuss ways to reduce the finger pointing during crisis to get the client back online and working as quickly as possible.

With T-Mobile, AT&T, and now even Microsoft reporting breaches questions start to come up as to what can be done.  Why is this happening? Don't these companies focus on securing our information?  I have also noticed that many of the answers coming from these large companies is a bit cold and lacks any real empathy towards their customers who have now become potential victims.

Join me as I discuss this with Chad Holstead from BKS and our take on what can be done as an MSP and how taking a proactive approach may prevent or at least reduce the impact on those compromised.

We have all had an opportunity to work with a Microsoft product or two in our careers.  This week I sit down with Charles Love to recap some recent O365 challenges we both faced and better prepared for future migrations, upgrades, and enhancements.  Cybersecurity and O365 don't play nice out of the gate with each other, but that doesn't mean we can't get it locked down appropriately.  We cover licenses and product types as pertains to different compliance frameworks and regulations.  We discuss MX Records and DNS Monitoring, and we get into some of the security defaults that often get overlooked when an MSP onboard a client that already has O365 in place.

It seems we have covered different cybersecurity frameworks and the challenges MSPs face to become compliant, but until now we haven't talked specifically about HIPAA compliance.  As an MSP you might find that you are a Business Associate and not knowing doesn't let you off the hook.

Join Bryan Sullo and me as he fires questions about HIPAA compliance and I try to answer as many of them as I can.  If we leave something out please let us know.

It seems that more often than not we talk about Cyber Insurance.  The last two episodes we talked specifically about risk and going back to December 2020, Episode 8, we talked about cyber insurance and ransomware with Frank Bauer of Vade Security.  A recent voicemail from Eric Hansen of Inland Productivity Solutions prompted a discussion around Cyber Insurance.  Here are the key discussion points:

1. Do I have enough insurance?

2. If I make a claim will my insurance company pay?

3. My clients don't have it so how does that impact my risk?

These are just a few questions and as we explore the topic we ask you the listener to send in additional questions that we might answer on future episodes.  

Last we we discussed client risk and even a bit about our own risks.  Throughout our discussion I kept thinking we need a way to score our prospective or existing clients to help determine those that bring us more risk.  There is one person I know that is meticulous in how he manages the onboarding process and so I am happy to say Charles Love is back to give us some tips on how to create a client or prospect scorecard.