Learn how to build a tech stack that fully protects your clients.
The Internet is a lot like a comic book universe. Cybercriminals are the never-ending group of villains attempting to steal money or identities, or even take over the world. In fact, two-thirds of small or medium sized businesses have suffered cyberattacks in the past year. Plus, each attack can cost a company $3 million! You, the MSP, are the superhero, constantly needing to change up your tactics to defend the good citizens of the digital world. So, let’s talk about how to build a top-notch security stack.
Suiting Up the MSP
Smart superheroes make sure they’re dressed appropriately for the job. Some wear bulletproof suits, while others carry magical devices that transform into weapons and shields. As MSPs, your stab-resistant costume is made from the solutions you use to protect your company. This in turn protects your downstream clients.
If you’re using a remote monitoring and management (RMM) tool, it’s easy for attackers to gain access to all your clients all at once. Always follow the same advice you give your clients so that everyone is protected.
Ever-Evolving Attacks
One thing cybercriminals (and villains) are not is unimaginative. Their methods evolve as we change how we use the Internet. For example, SQL injection is one of the oldest ways to get access to people’s accounts. An “oldie but goodie,” if you will. It’s still used, but websites now sanitize user input to protect against these attacks.
Ransomware, on the other hand, was rarer in the past because there was no easy way to send money over the Internet. Not so today! Even phishing attacks and social engineering techniques have gotten more sophisticated over time. To make their phishing emails more believable, all cybercriminals had to do was fix grammar mistakes and reword awkward phrasing.
Here are some popular attacks to be on the lookout for:
- Ransomware
- Phishing
- Eavesdropping attacks
- Spyware
- Trojan horses
- Password attacks
- DDoS attacks
- Malware, worms, and viruses
The Cybersecurity Framework
According to the National Institute of Standards and Technology (NIST), comprehensive protection means addressing the following five functions of cybersecurity management:
Identify: A big picture of the weak and strong points within an organization can help identify and prioritize critical areas. You’ll want to advise your clients to protect these areas first.
Protect: There should be multiple layers of protection and safeguards. Cyberattacks don’t just come in at one angle or in predictable ways.
Detect: Knowing when the attack is happening allows you to react quickly and effectively. Some superheroes have superhuman senses to detect what’s out there, MSPs have sophisticated applications.
Respond: Heroes never start a fight, but they will finish them. For example, a client receives a phishing email, but thanks to your continuous training programs, they respond by deleting it. No need to break a sweat!
Recover: After an alien invasion or just some humanoid mutant wreaking havoc all over town, superheroes help with the rebuild. Backing up data so that your client can recover quickly from cyberattacks is key to saving money, time, and sanity.
It’s All About the Action
There are eight layers of cybersecurity approaches that will, when put into action, fully drape the cape of invincibility (more or less) over your and your clients’ systems. These multi-layered, proactive defenses free up more time for you to focus on things such as growing your business, providing good customer service, and learning about new tools entering the market.
Identity Protection and Access Management
Protecting accounts and determining who can access which sites are crucial first steps to building comprehensive security systems. There aren’t many one-size-fits-all security measures, but multi-factor authentication (MFA) comes pretty close.
Ninety-nine percent of account hacks are blocked when MFA is turned on. Pair this with strong passwords, and you’ve taken a big leap in protecting data and other sensitive information. And to make sure that your clients are still productive and not spending all their time logging into accounts, suggest that they combine single sign-on (SSO) with MFA, apply conditional access (CA) rules, and help reduce “password fatigue” with a password management tool.
Endpoint Security
Protecting servers, computers, and devices closes off another door for cybercriminals and other unwanted attacks. Today’s Endpoint Detection and Response (EDR) solutions have evolved since the early days of installing anti-virus software. Threats are detected and stopped as they come in. With 70% of attacks coming in at the endpoint, protecting these devices provides users with another layer of protection.
Email Security
Aside from cracking passwords and access devices, email is another easy access point for cybercriminals. And unlike devices, there’s a human element to email that makes it particularly vulnerable to phishing attacks. You might not be able to trick a computer, but it’s pretty easy to dupe an unsuspecting user into clicking a link from the “IRS.”
Aside from cracking passwords and access devices, email is another easy access point for cybercriminals. And unlike devices, there’s a human element to email that makes it particularly vulnerable to phishing attacks. You might not be able to trick a computer, but it’s pretty easy to dupe an unsuspecting user into clicking a link from the “IRS.”
Not all email software comes with layered protection, so it’s important that you provide yourself and your clients with third–party solutions that include:
- Advanced phishing identification and protection
- URL scanning and attachment defense
- Data loss protection
- Compliant email retention and archiving
- Policy-enforced encryption
- Spam and content filtering
- Anti-virus and zero-hour threat protection
Data Protection
A company has many parts, but at the core, companies are their data. You might have clients in healthcare that need to protect patient information and comply with HIPAA regulations. Or perhaps your clients sit on a trove of banking information. Whatever the industry, securing data isn’t just a cybersecurity issue, it’s a way to avoid lawsuits and fines.
Web and Network Security
In 2018, about half of SMBs experienced web-based attacks. These can come from not having a secure network or having poor web security. One of the easiest things to do in an office is to set up a firewall that filters URLs, prevents data loss, and detects and stops anyone trying to get in. A guest Wi-Fi network is another great way to keep unauthorized users from sharing a network with company employees.
Web security also prevents your clients from getting into trouble while they are surfing the web at work. Block not-suitable-for-work and malicious websites; some SMBs may even want you to restrict access to streaming services to preserve bandwidth. Not only are you keeping your clients safe, you’re also helping them increase productivity!
End User Training
Some superheroes might have gotten their super-strength from a radioactive something or other, but many work and train hard every day to keep up that chiseled physique. The same can be said for a company’s cybersecurity. You can implement the best defense software, but no one can stop that one employee from opening a phishing email and downloading its contents.
Ongoing micro–training sessions and phishing simulation training will help keep everyone on guard. Think of these trainings as short but intense sessions at the gym for both your employees and your clients.
Mobile Security
It’s one thing to show up just in time to stop a villain. It’s another to be everywhere, all the time. Unless your superpowers involve time manipulation, you’ll need to give your clients their own tools to manage work-from-home employees.
Outside of the company’s firewall, everyone is more vulnerable to attacks. Solutions such as device management, mobile application management, and content management provide an added layer of security to remote and mobile endpoints.
Disaster Recovery, Backup, and Incident Response Plan
Sometimes, despite all your efforts, a client reaches out and says that the worst has happened. They’ve lost large amounts of data, their systems are down, and who knows how much time and money has already been lost. Fortunately, they hired you.
You’re someone who understands multi-layered security. You’re also someone who had the foresight and prepared for the worst and created a disaster recovery plan. Not only did you identify some of the main threats to your client’s company, you also figured out all the nitty gritty details of getting them back up online quickly.
The Trusty Sidekick
Creating a comprehensive security system for your clients is a lot of work, but you don’t have to worry about tackling it alone. Every superhero needs a reliable sidekick, right?
Pax8 is here to help you identify gaps in client systems, deploy any cloud security solutions they need, and combat cyberthreats together. You can start out by taking a look at our MSP’s Guide to a Multi-Layered Security Approach or go ahead and schedule a call with our team to get started!
