Why MSPs and their partners must prioritise cyber security – IT Governance UK Blog

Cyber attackers have been increasingly turning their attention to MSPs (managed service providers) in recent years, with devastating results.

MSPs often work with dozens, if not hundreds, of organisations – so a single vulnerability can have far-reaching consequences.

You don’t need to look any further than the ongoing damage at Blackbaud for evidence. The software supplier, which is used by some of the UK’s biggest universities and non-profits, suffered a ransomware attack this summer, the scale of which is still being revealed.

More than 125 organisations were affected, with the University of Exeter, King’s College London and the University of London among those that reported losing sensitive data.

Blackbaud eventually paid the ransom, which averted the short-term risk of data being leaked online. However, it did nothing to protect those whose operations had been disrupted through no fault of their own, no doubt leaving them frustrated.

This demonstrates how perilous the cyber security situation is for MSPs. After all, a cyber attack will not only affect you but also organisations in your supply chain – potentially causing a cascade of problems for which recovery could be impossible.

How MSPs can address cyber security risks

It’s not just large MSPs such as Blackbaud that run into these problems; it’s an issue that everyone faces. The US Secret Service issued a cyber security warning earlier this year warning that that cyber-related attacks on MSPs were on the rise.

Meanwhile, the 2020 MSP Benchmark Survey found that in Europe, the Middle East and Africa, 91% of service providers said their customer base suffered a cyber attack in the previous 12 months.

It also found that 29% of respondents listed “meeting security risks” as the top IT need for their clients, and another 14% said that cyber security services were a top need.

The most common services that those organisations provide are:

• Antivirus and anti-malware;
• Firewall and VPN management;
• Operating system patching;
• Managed firewall; and
• Password management.

Among the less commonly provided services were penetration testing and vulnerability management – which we find strange given how important it is to effective security.

Penetration testers assess vulnerabilities to identify potential attack vectors, weaknesses and entry points. Meanwhile, administrators use perform such tests to find previously unknown or unidentified vulnerabilities that may affect their security infrastructure.

Organisations can use the information gathered during these assessments to shore up products and services, prevent security incidents for third parties work with the MSP.

Unfortunately, only 53% of respondents to the 2020 MSP Benchmark Survey said they provide vulnerability management services, which means that many organisations must conduct penetration tests themselves if they are to be confident in their security.

If you’re considering penetration testing, it’s worth noting that their complexity – and the potential for conflict of interest – means that you should always seek an independent expert to conduct them. That’s where IT Governance can help.

We are a CREST-accredited provider of security testing services, with a range of solutions ideal for all organisations.

We offer on-site and remote testing to help you assess your networks in the most convenient way for you.

You can find out how to get started by speaking to one of our experts.