Despite increased awareness of the importance of strong cybersecurity measures, many small to medium-sized MSPs continue to believe that their networks (and their customers’) can fly under any hacker’s radar. The scary truth is SMBs have become more vulnerable to cyberattacks with the increased use of cloud technologies over the last year. In fact, SMBs are 61% more likely to be targeted for a hack in 2020, up from 53% last year.
With cybersecurity incidents increasing month over month, every MSP is dependent on a well-planned, multilayer cybersecurity plan. You can only protect your MSP against unwanted ransomware attacks, cloud data breaches, and attacks on endpoint devices in 2021 if you address all security threats with a multifaceted security strategy.
Start with the basics
Identify and catalog your assets. It’s critical to have an accurate accounting of all the data on your system and its criticality and sensitivity. Understanding the data also helps you create a compliance program to ensure data is properly classified.
Remember, not everyone who works at the bank gets keys to the vault. So, assess how many people in your MSP have access to every file and every system. Access control is one element of security that you have complete control over. What’s coming into your network matters as much as what is leaving. Create and maintain your Egress Traffic Enforcement Policy and make sure you have monitoring in place to catch anomalies in data trying to leave your network—either with the help of hackers or perhaps a disgruntled employee.
Once you’ve captured all the data in your environment, locked down access levels—it’s time to move on to devices. Just as you can’t protect data you don’t know about, you can’t secure devices you aren’t aware of. Understand every single device that connects to your network—from phones to laptops to printers and more. Don’t overlook guest access; you will need to segment those visiting devices from your other secure environment.
Fortify your security against ransomware
Ransomware is one of the most active and profound threats facing MSPs today. In a moment it can cripple business operations. Email phishing and spam are the main vehicle for ransomware attacks and the best way to stop them is a two-prong approach—security measures and simple awareness. Use Secure Email Gateways with targeted attack protection for detecting and blocking malicious emails that deliver ransomware.
Set up and test backups as well as apply for ransomware protection in security tools. Invest in monitoring tools that can detect unusual file access activities and viruses in time to block ransomware from activating.
The bottom line with phishing is that the biggest risk lies with people. About 91% of cyberattacks start with an email. The risk of an employee clicking a suspicious link from these emails continues to grow as social engineering gains sophistication—fake URLs and website have never looked so real.
To spot and avoid such phishing emails, it is important that you train your employees around basic cybersecurity hygiene. New hires are often the weakest link in the chain, and it is crucial to train them as soon as possible so they are up to date with the applications they use and aware of new threats.
Add more layers of security to your network
A lone firewall is inadequate protection for IT networks in 2021. MSPs must consider the use of multifactor authentication, wireless security protocols, and, of course, antivirus.
Applying patches and security updates immediately is an essential security practice. One solution to hassle-free patching is setting up your network to patch and update workstations automatically when users are away from their machines. For better endpoint management, use a separate guest WiFi so people outside your business only have access to the internet, not your data files and backup.
Work on cybersecurity concerns more cohesively
Does your MSP treat cybersecurity measures as “set it and forget it”? It is easy to lose focus on security with your own business—and sometimes, with long-term clients that may be otherwise running smoothly. Don’t make this mistake. Sit down with your CTO each week to discuss the latest major cyber threats and your MSP’s strategy to defend against them—internally and with clients’ networks. Remember relying on outdated software and security hardware can pose significant security risks. Be sure to review software and systems and have a strategy in place to implement newer and safer technologies.
Have a disaster recovery plan
As much as we don’t like to think about them, business-crippling cyberattacks happen all the time. While we can’t prevent or even foresee every attack, we can prepare for them. Part of your security stance should be a clear response plan that covers communications, data protection and recovery, and more. If your MSP has followed the best backup practices, you can restore your systems and resume normal operations even after an unfortunate security breach. The point is that all your IT systems must be given serious consideration in your disaster recovery planning process.
Final Thought: With the work from home trend likely to last well into 2021, cybersecurity will continue to be a major challenge for all MSPs and their clients. Yet, it can be easy to put stricter cybersecurity measures in place and safeguard your network from attacks, if you know where to begin and how to plan ahead.
Need help with security? Learn more here.
