Cybersecurity should be something that every MSP (Managed Service Provider) is thinking about.  The Business Sessions stream at the recent ConnectWise IT Nation Share + Evolve was led by Jay Ryers, CTO of Security Products at Continuum.

As you can probably guess, the event focused almost entirely on Security. Here’s what we took away from the event:

Every MSP needs to be thinking about cybersecurity

In 2018, cyber hacking groups (e.g. APT10) started targeting MSPs. In most cases when an MSP is compromised nearly all of their clients are compromised as well. This means that MSPs are being actively targeted by hackers despite that fact that they will usually take far more precautions than the average business to protect their data. 

These attacks ramped up in 2019, with many businesses falling prey to Ransomware attacks like Ryuk and GandCrab. In 2020, MSPs can expect more attacks than ever before and need to be doing everything possible to secure their client’s data. 

Suggested steps at the conference were:

1. Maintaining multiple internal networks. This is so that you don’t risk your clients and staff compromising your network with infected devices. It also means that if there is a breach you can respond with clean machines that have been kept on a clean network.
2. Regularly monitor client backups. The first thing that most hackers will do when they infiltrate a network is to switch off automatic backups. The second the last uncompromised backup expires you can expect them to swoop in and lock down the organisation with a ransomware attack. For this reason your organisation should be regularly monitoring your client’s backups, increasing the frequency and also conducting regular physical backups of key data just in case. 
3. Segmenting access to your client’s data. A high percentage of cybersecurity attacks involve internal actors. One way of protecting against this (at least in part) is segmenting access to your client’s data so no one person is capable of compromising all of your accounts at once. 
4. Separate admin accounts from general accounts. This means that in most cases when an account is compromised the damage that can be inflicted on your network is minimal. 
5. Enforce control + alt + delete for interactive logons. This makes it much more difficult for people to log on remotely. 
6. Monitor login times. Especially for administrative access. If someone is logging on at 3 AM and accessing large amounts of data, then there’s a fair chance that something is not right. 
7. Enabling Two Factor Authentication. 

More information about this can be found in the ConnectWise University Security Journey.  

Your clients would pay more for cybersecurity

ConnectWise surveyed their client base and found that just 13% of MSPs were having conversations about Cybersecurity with all of their clients (not just one or two key accounts). They also found that:

• 93% of SMBs would switch providers for the right Cybersecurity
• 25% of small businesses would pay more for the right Cybersecurity

(ConnectWise 2020)

The problem with this is that most of your clients have no idea what the right Cybersecurity is, and in many cases would think that the protection measures that are already in place on their accounts (such as backups, virus protection and firewalls) are adequate. They need their MSP to tell them what the right Cybersecurity is. 

Focus on risk to sell Cybersecurity

Cybercrime costs Australian businesses more than $1 billion per year.  66% of small businesses wouldn’t be able to recover from a data breach. The average data breach in Australia costs US$1.99 million or US$108 per record. 

These figures should be alarming to the average small business. Yet many of your clients will refuse to pay more for security services until there has been a breach. By then it is usually too late. 

In 51% of cases where Australian Businesses were attacked by ransomware they paid up. 79% of businesses said that they would pay again if they did not have backups available. The average ransomware extortion payment amount sits at $84,000 and is doubling every quarter. 

You need to be having conversations with them and asking pointed questions like:

• If you don’t have the budget for Cybersecurity, how will you find the budget for a breach?
• How can you operate for without access to their data? 
• If it comes out that your data was breached, how will your customers react? 

Once you start focusing on the risks presented by cybersecurity, it’ll become a lot easier to sell it to your clients. 

Outgrow your competitors by 5:1 through cybersecurity seminars  

Managed Security Services are expected to be worth over $60 billion globally by 2024 (see chart below).

Cybersecurity is a hot topic, and it’s something that most MSPs can talk to their existing client base about. It’s also a way of landing new clients and expanding into other ways of doing business. 

In the Business Sessions, Ryerse stated that “MSPs that hold cybersecurity seminars outperform other MSPs by 5:1. It is the number one thing your business can do to grow your MSP”.

MSPs can use Cybersecurity as a way to land and expand new clients. ConnectWise University has more on the topic. 

Emersion turbocharges ConnectWise Manage through our billing and provisioning integration. Data is automatically synchronised between both systems improving your billing and provisioning operations without changing how you use ConnectWise.