The MSP Zone

CISA published their advisory bulletin addressing risk considerations for organizations thinking about using managed service providers. This is a great advisory, but it has some areas of potential misinterpretation in it, chiefly because CISA has departed from a security group and expanded into territory in which it has little experience.  

Highlights:  

What if organizations stopped using MSPs?  

Yes, all customers ought to be responsible and consider risks of outsourcing. But, risks of not managing IT are far greater than the risks of outsourcing 

Targeting of managed services supply chain vendors is NOT a symptom of poor MSP security, it's a symptom of the unchecked business of cybercrime 

MSP Zone Reading Material: Risk Considerations for MSP Customers | CISA

It is a question we used to get often during the early days of managed services. Particularly, when organizations did not fully understand the requirements of owning IT infrastructure. To be sure, cyber threats, the complexities of managing IT, and the overall reliance on IT for business operations was must different back then compared to today.  

 

Today, however, it may seem odd to ask the question "do we need managed services?" Perhaps a different question would be more appropriate "can you survive without managed services?" 

 

Highlights:  

Vendor management 

Cyber Threats 

Scarcity of people, technology, and process 

 

MSP Zone Reading Materials: 

https://www.ilounge.com/articles/why-do-modern-businesses-need-managed-it-services-today

There has been a lot of discussion concerning the MSP regulation our profession should have. Standards for MSPs, cyber practices to reduce the number of cyberattacks, etc.  

 

Instead, I’d like to turn the conversation into the type of legislation MSPs actually need. There are laws that would make the job of the MSP (and the benefits they provide to clients), more accessible. Those are the laws that should be enacted, not laws that make being an MSP more difficult.  

 

Highlights  

Pass laws that make being an MSP easier, not more difficult

Alignment of MSP and customer goals

Shrink the chasm between MSP practices and client behavior 

Education of the role managed services has in the global market

How should your managed services catalog change, if at all, when delivering your offerings in the cloud? How can you use your updated services catalog to improve your sales and service delivery process, along with reduce your overall MSP risk?  

 

Highlights 

What is a service catalog? 

Does the catalog change with cloud service offerings? 

How does the service catalog interact with the service agreement? 

 

MSP Zone Special Guest: Rob Scott

Every MSP needs to have an important conversation with their clients about cyberattacks and ransomware. These conversations don't have to be difficult, but they have to happen. Here are my thoughts about how you should approach this discussion and how you can use it to change the relationship you have with your customers. Who knows, they may even thank you for it. 

Highlights:  

There is no right time to have it, just make it happen 

Don't avoid the news 

Talk about your expectations for their cybersecurity 

Tell them how you are protecting your MSP practice 

Practice business disruption scenarios with them

In the aftermath of recent ransomware attacks on software companies used by MSPs, the question of how do we respond as a community is, and should, be asked. Some believe that more legislation is the answer. Maybe they are right. But, it would be a grave mistake for any legislation directly involving MSPs to be undertaken without first understanding what measures already exist to protect MSP and clients alike.  

MSPs are responding to the ransomware epidemic. Here's how.  

Highlights: 

MSP Verify  

Leadership council 

Insurance 

Vendor certification

"Secretive" cloud providers have a problem. So do the MSPs who use these cloud providers. Fixing the issue of secrecy and lack of transparency is important to the non-IT world and we must address it now.  

Highlights:  

Cloud vs MSP Transparency 

SaaS & Vendor Transparency 

Applying Existing Standards 

Bank of England to crack down on 'secretive' cloud computing services | Reuters

What's the difference between internal IT departments and managed service providers? There are some important distinctions which define the relationships between internal IT and the external MSP. Understanding those differences can improve how both interact with one another. 

Highlights: 

MSPs have to face a more diverse set of users, ecosystems, and threats. This diversity makes the MSP a far more knowledgeable organization than the vast majority of companies (even those with an internal it department) 

Access to Tools – MSPs, by necessity, use a variety of tools not typically seen in the internal IT department. These tools typically associate themselves with scalable, one-to-many styles of service 

Experimentation. MSPs see things on a more expansive scale than internal IT departments.

It was almost an inevitability that MSPs would begin to rethink their procurement of managed services enabling tools in the wake of the Kaseya ransomware attack. Sure enough, we are starting to hear from MSPs telling us that they are reversing their previous strategy of consolidating tools around big four MSP tool platforms.  

Highlights:  

Should MSPs decentralize?  

How will this impact the MSP market?  

What advice do we have for MSP platform vendors?

What's an MSP? What is an MSSP? What is a SOC? These terms are common throughout the managed services community but often have overlap and can cause confusion. We will explore these terms and examine how they often present themselves in everyday business scenarios.  

Highlights:  

Defining MSP, MSSP, and SOC (including SOCaaS) 

Business characteristics of each 

Common overlaps