Building a Successful Cyber Security Practice Within Your MSP

Welcome to MSPs in Conversation. This is our first one of the year, and today we are talking about building a successful cyber security practice within your MSP. One of our team actually highlighted that this is the first proper cyber security conversation we've had on MSPs in Conversation, so I don't know how we messed that one up, but I'm excited to have Aaron and Elliot here. I'll get you guys to introduce yourselves in just a moment.

A little bit of housekeeping, though. This is recorded, as always. We cut it up as a podcast on Spotify, Apple Podcasts, all those sort of things. It goes up onto YouTube and onto Vimeo, those sort of things, so afterwards please feel free to share it. And if you do have to drop off, you can always check out the recording or the podcast later. So with that in mind, if you do have any questions throughout the session, please feel free to drop them in. We love to have this as, you know, as it says, MSPs in Conversation, so chuck in any questions that you've got and we'll try and answer them as we go.

As always, a little bit about Hosted Network. If you don't already know, Hosted Network is a wholesale cloud and voice provider for MSPs. We were an MSP way back when, but today we're 100% wholesale and we support over 250 Aussie MSPs across Australia. We have no retail arm, which means we will never compete with you. Our business has been built entirely based off feedback from all of those partners, everything from our partner portal all the way down to how we invoice. So we're really big on that; we've built our business based off that, which means that the problems you face, many other MSPs have faced them as well, and we've been able to address them. We like to say that we get it done right, so throw us the curly ones, the ones that other providers can't help with. Fundamentally, we deliver cloud and telco solutions the way they should be for MSPs: simple, easy, with no margin burn. But that is enough about us.

We will jump into our amazing panelists, who we've got: Aaron and Elliot. Aaron, welcome back. You've been on MSPs in Conversation more times than I can count. Elliot, you're a newbie, welcome, even though we've done a few things with you before as well. Guys, can I get you to introduce yourselves? I was going to say introduce each other then, but that'd be a bit weird. Aaron, I'll start with you.

Sure, thanks Ben. It's been a while since I've been on, but I'm excited to be back. Guys, for those of you that don't know me, I was in the MSP space for 20 years before, about three years ago, joining Sophos as one of what we call Global Solutions Engineers, or sales engineers if you will, focusing on MDR and security operations. So I very much focus on that, which means all things sort of 24/7 monitoring, incident response, anything to do with how either partners or customers manage their security day-to-day, and making sure things aren't missed. That's really sort of my baby, and obviously it's a managed service from Sophos, and that's my background. So, yeah, lots of experience and keen to have this conversation with you all.

Cool, well thank you. And Elliot, would you mind introducing yourself?

Yeah, thank you for having me on, Ben. So, Elliot Seeto. I'm one of the executive coaches for the Academy APAC team in Pax8. If you are familiar with Pax8, we're a cloud marketplace for many applications, anything to do with the channel, and we're 100% channel focused. My role, I guess, is really focusing on the education, you know, upskilling partners to deliver cyber security services, whether that's selling, marketing, or becoming a bit more operationally efficient and effective in terms of how to deliver cyber security services. So, really excited to be on for the first time.

Great, guys. I'll stop sharing. Whoops, they've gone too far. I've stuffed it up already, guys. Had one job. And we will jump into it.

Why Cyber Security Is Critical to the MSP Offering

So today we are talking about building a successful cyber security practice within an MSP. We're going to tell some stories, but we are going to be talking fundamentals, so like I mentioned earlier, if you've got any questions, feel free to chuck them in the chat and we will try and answer them as we go. But we're going to start right at the beginning, and as always I've got lots of questions, and we'll probably run out of time. I guess, Aaron, I'm going to throw this one to you first, and Elliot, feel free to jump in as well: why do you feel that a cyber security offering is critically important for an MSP to be offering in today's market?

Yeah, great question. I guess the first thing that comes to mind when you say that is, times have changed. It's not like it was a long time ago. It's not as simple as antivirus and firewalls anymore and just set and forget. Attackers have changed, the attack surface has changed, and they're crafting new ways every day to take advantage, and ultimately they're trying to make money. So it's critical to have some kind of offering. And also, from the external risk perspective, I would also say just to build trust and be that trusted advisor to your clients. If you're not talking to them about it, someone else ultimately will be, or they're going to learn the hard way, and then that's a bad reflection on yourself as well. So, Elliot, did you have anything to add there? But that's sort of my initial knee-jerk reaction to that one.

Yeah, I think the opportunity is there. There's a lot of opportunity with commoditization of, you know, typical IT services that we've seen. This opens up a lot of new revenue stream opportunities for MSPs to deliver. Many MSPs over the last 20 or so years have already been delivering some form of cyber security, whether that's just patching or the basics like backup. So it's just an opportunity to expand and, like you said, build that trust within the community. And I think it's central to supporting the wider SMB, you know, small and medium businesses, across Australia, because MSPs have been that trusted advisor from a technology front for quite some time already. So they have the ability to sort of kick that off and ensure that they're securing it from those new and evolving threats that we see constantly every day.

Yeah, cool. So, definitely an opportunity. Aaron, I like to comment that if you don't do it, someone else will do it. And I guess if your customer gets burnt and you don't offer it, well, you might lose a customer.

That's right. But it's not even just that a competitor might. I'm sure we've all been into areas where, you know, the primary contact or owner of the business, whatever it is that you're serving, they're at a barbecue. I hate these ones, but they're at the barbecue, right, and someone says, "Oh, I do this," or "This is what my MSP offers," or whatever. That casts immediate doubt, so you want to be on the front foot there.

War Stories: When the Basics Fail

Yeah, okay. All right, so let's continue with a bit of a war story. Aaron, I know over beers we've had many sharings of war stories before, but maybe we can sort of set the tone in a way that'll cement the opportunity and what that can look like. So, have you got one in mind that you've recently experienced, or that an end customer in particular has experienced, that might highlight the opportunity?

Yeah, and again, war stories are probably best over beers, Ben, but let's have a go at it today. Look, I do have plenty of war stories. Honestly, I work on the incident response side here, so I see them almost every day. I guess for the audience here, we've got a lot of MSPs, so I'll tell a story that's somewhat personal to me as well, mainly because I know the end customer quite personally and they mentioned it to me whilst bumping into each other at the shopping center, and then I obviously went and did some research and found out a little bit more.

This story is an interesting one from an MSP perspective and a customer perspective. There were quite a few human errors along the way, so I think at some point everyone on the call will be able to relate to this. Ultimately what happened was the attacker came in, usual story, at 2 or 3:00 a.m. There was an exposed remote desktop server that the attacker just managed to log into. Now, there was no MFA on that, and I'll come back to that, but at the end of the day what happened is the attacker literally just walked in. There was no great hacking, there was nothing major about what they did, they simply logged into the environment. Now, this particular customer has MDR, so this was actually caught within about 40 minutes or so, if I remember correctly, of the attacker logging in.

But I guess the point I wanted to really highlight here is how much actually happened from just that simple event. In this scenario, the attacker managed to very quickly search the drive for the word "password" and collect up everything that it had. Now, there were three Excel files that they managed to get access to. The first one was, it's always funny, sorry, I love it, but the first one was company staff members' BSB and bank account details for payroll, just sitting there in an Excel file. Yep, Elliot, the head nod that normally happens when I say that.

The next one was every employee's username and password to log into one of their major clients' platform for induction, and they'd kept every single employee that they'd ever had over the last 10 years in this thing. Now, that was quite a major customer and they needed to report to that major customer that that had happened, and they had to reset, I think it was a couple hundred of accounts. And then third was every single username and password that this company had to every single platform that they used online. I'm talking social media, I'm talking online transactions, suppliers, all of it. And that was from three files that the attacker grabbed in just 40 minutes.

Now, coming back to how did it happen, that's the more interesting part. This account that they logged in with was a 12-year-old account, and the employee hadn't even been there for eight years, so this comes back to just very simple stuff about HR processes and offboarding. The second part was that that RDP server was never meant to be exposed to the internet, and it wasn't. They'd actually implemented a secure MFA-protected method in, and during testing for an employee that called up and said, "I can't get in," during testing it was very quickly opened to allow this user to do some critical work. And guess what, it was forgotten to be closed. So, a series of events here, human error all over the place, that led to, you know, simple hygiene about accounts, simple standard remote access methods, and then fortunately it was detected quick enough. Still some damage done, but it could have been obviously a lot, lot worse.

Ouch. Yeah. I'm going to do a shameless plug here, right. 100%. I'm going to do a shameless plug here. If you had a connection with Hosted Network, we have this amazing service that's free called Project Guardian. Any of our connected services have it. We monitor for vulnerabilities and ports, and if it's a CVE 8 or higher, we call you and tell you about it. So anyway, I'll plug that later; I'll just throw that in a few times. Marketing's going, "You don't plug our stuff enough," so I'm like, "All right, all right."

Cool. Okay, so it's wild, that story. Unfortunately, you know, I shake my head, but those are the type of stories that come up time and again, and it's typically the basic stuff that is used as part of an attack, whether that's things like MFA or, you know, all the examples that Aaron just mentioned. We're not looking at extreme cases like we see in Hollywood movies where they're using high-tech technology to hack infrastructure and everything else to get inside. Most of the threats out there are typically from basic poor hygiene, right, from the security fundamentals. So it tells a bit of a story that we can't get the basics and the fundamentals right in security and we still haven't. And that's where a lot of partners can help SMBs focus on and make sure they get the basics done first before they start accelerating and putting all these new, you know, rebound technologies in that they claim will improve the security posture. We need to get the basics right first.

Yeah, I couldn't agree more, Elliot. And if I stood back from that one incident and said to you, what do we see the most, it is literally the fundamentals, it's the basics. Obviously there is some pretty awesome, interesting stuff I see as well, I'm not going to share that, like, you know, think nation-state attacks and very, very advanced stuff, but honestly the bulk of what we see is exactly what you just said earlier. It's the basics that are getting done wrong over and over again, or even they're done right but then there's a mistake, it's just a fundamental human error, and that's never going to change. So, yeah, it's a sad story, but it happens over and over and over again.

Common Mistakes When Starting a Cyber Security Practice

I think that's part of the opportunity, if you're not already doing it. I see a lot of partners, and we'll probably touch on it a bit, where they do an assessment to understand what they're walking into. There's some great tools out there to do that. But one of the things I've got here, before we jump into too many of the other questions, is: what are some of the common mistakes that MSPs that are starting a cyber security practice get wrong? You know, be it, I don't know, overpricing, going too complicated. What have you guys seen that just hasn't been able to get off past the start line? You want to go first?

Yeah, well, the common mistake I've seen over the years is just not getting started. Typically they look at building some sort of cyber security service and they spend six, twelve months trying to put something together that's perfect. As we've seen with cyber security, it's never going to be perfect. But threats aren't going to stop, threat actors aren't waiting for you to get things right before they go through and target your clients or even yourselves. These are things where starting to do something now and improving over time is key. I think that's a big part of it: make sure that you review, improve, and constantly evolve your offering and your stack, and obviously your own security as well, because MSPs are a big part of the supply chain. So that would be my number one. There's obviously a number of others that we've been talking about, but it's just getting started and doing something in the first place.

Yeah, don't let perfect get in the way of great, I always like to say. I was guilty of doing exactly that. I spent probably a number of months that I don't like to talk about doing that, you know, dotting every I, crossing every T, and then just going way too far overboard and then just missing the fundamentals. But I guess, Ben, my answer to that question would be struggling to confidently articulate the value of it. So sometimes, even when they do come up with a fantastic solution, or perhaps it's just incremental steps, they really struggle to articulate it to customers and therefore talk about the value and the outcomes. So then customers don't see the value, they won't buy in, and then you're left with this risk that you kind of have to wear as an MSP. And I guess I recommend that no one should do that. Or it turns into prioritizing cost over security, so then you end up in this situation where the MSP might be deploying weaker solutions, or ones that they're not comfortable with, or they don't fully understand what it does, and therefore there's gaps in the solution, and then that can lead to incidents and things like that. I've worked with so many MSPs where I say, you know, what happened here, and they'll say, "Oh well, the customer just didn't want to pay for it," but then the MSP feels bad, doesn't want to lose the customer, and then spends the time to rebuild the environment and not charge for it. So at the end of the day, all MSPs are doing is wearing that. So I would really encourage some good conversations between MSPs and customers.

I think the challenge there in particular, sorry Ben, is not understanding where to start, and that's where things like frameworks come in, right. We've seen NIST, that's good, we've seen ISO, we've seen other new ones come up like SMB1001, and Essential Eight's there, not really a framework but it is something that a lot of channel partners are using. But that's focusing on the basics, and I think where MSPs can start having those conversations, like Aaron mentioned, is, you know, make someone else the bad guy, right. It's not us telling you, Mr. and Miss End Client, that you need to do this. This is guidance from authorities above us that have gone through the process and understood what should be in place, what we should be looking at from the landscape, and actually putting in some sort of basic or foundational standard.

Building the Fundamental Service Offering

Okay, so from an offering perspective, because cyber security, it's a bit like turning around and going "IT" or "cloud", right, it's a bit of an umbrella term, there's a lot of different products and offerings that can kind of fall into that. You know, I don't see a lot of MSPs offering penetration testing as an example; that's a bit more of a mature and bespoke sort of service offering. In your experience, Aaron, and I'll start with you, what are your experiences with the fundamental offering, call it the basic service offering, that you've seen MSPs have successfully deployed?

Yeah, my experience, and I'm actually going to loop back to something that Elliot said earlier, which is getting the basics right, and it's not a one-time thing. If you think to that story I just said, things were done right but then human error came in. So getting the basics right, I'm going to call that configuration mistakes, which is exactly like that story. So making sure you're having some kind of verification system, whether it's scanning, well, there's many different ways to do this, but the obvious thing is some kind of endpoint protection, firewalls. I'm pretty biased when I talk about having 24/7 monitoring in place, and I'll give my reasons why: I have not worked a single incident in my three years here at Sophos where there wasn't some kind of security tool in the customer environment that was firing and telling whoever's responsible, whether it's the MSP or end user, that something was not right, that something was blocked, that there was suspicious activity. There was something there, no matter what vendor. And normally that went missed, you know, it happened in the middle of the night and no one was there to look at it, or someone did look at it but they just didn't fully understand it.

So I'm pretty big on solid endpoint security, firewalls, 24/7 monitoring, which is a lot easier to do today than it was 10 years ago through MDR services and so forth, and some kind of verification system around your config to make sure that, like what you mentioned, Ben, with Project Guardian, something externally is watching. I think that's really, really important. But making sure the attack surface is covered, it's not just about endpoints and firewalls nowadays. You've got the 365, that's a pretty massive attack surface, you've got other methods, remote access, all of this needs to be covered.

So, I mean, Elliot, not to go down the framework thing, but if you do think of things, NIST or SMB1001, you know, we'll take NIST: identify, you have to understand what it is, and Ben, you mentioned, like, assessments with knowing what you get into, so identifying risk, protecting it through products, then detecting and responding to threats, that's the 24/7 bit, and then having some kind of plan in place to recover. At the end of the day, if the place is on fire, you as the MSP don't want to be running around going, "What do I do, what do I do." You want to at least know you have someone to call, or you've got specialists in house, which most people don't, to be able to respond and deal with this and help the customer recover. And recovery does not mean just burn it all to the ground and restore from backups; it doesn't work like that, unfortunately.

You know, we see that far too often. We're an infrastructure provider, right. We've got data centers across the country where we run workloads from, and we see where it's been breached, not our specific workloads but customer workloads, and they just get restored, and sadly in many cases they're just restoring the vulnerability, you know, all the hackers are still in there. Elliot, do you have anything else to add to that?

Yeah. Well, with the fundamentals, you know, you could point to the Essential Eight for the bare bones of it, but I agree with Aaron. Endpoint protection has been something that has been kind of mandatory for quite some time now. That's evolved from basic AV right through to the EDR and MDR functions that we have today. But the 24/7 stuff is definitely something I think needs to be looked at, because when we look at the criminal cyber criminal organizations these days, a lot of that's coming out of the US and Europe, and when we look at how they're set up, they're set up like businesses, right. They don't have a 24/7 operation, they typically run in business hours, you know, they're 8 to 5 in the US or Europe, which just coincides with our after hours. So from a regional perspective, a lot of those attacks coming from those areas just happen to be after our business hours. So that's where we need to make sure that we're not looking just at protecting the users when they're potentially online, but all of these other assets and data sets that are live and active after hours as well. So whether that's some sort of MDR service or facilitating that within your own business by creating your own SOC, having some sort of 24/7 operation is definitely valuable.

Understanding MDR and Outsourced SOC Services

So I'm just going to scratch at that one a little bit more, because you just mentioned creating your own SOC 24/7, and I'm not trying to plug any particular product here, by the way, but that's what, you know, I remember when I first started this, sort of looking at going, "Okay, how are we going to operate 24/7?" For that, it's not practical. You know, Aaron, you mentioned MDR, for those of you that, oh my goodness, sorry, I should have used the acronym, managed detection and response. What are those, because there are different offerings, and I know you guys both provide offerings in that sense, but what does that look like from an MSP's perspective, and how does that sort of service offering allow an MSP to accelerate their time to market?

Yeah, so look, if you think of it from trying to build your own SOC, I went through this. I thought, "I'm going to build my own security practice," and then I quickly realized that I was the only one that was actually interested. So it was great that I had all these fancy tools, and I got suddenly a whole stack, an overload of alerts, everything required investigation. That's not what I was trying to build. I realized I didn't have the skill set internally, but more importantly I wouldn't have had 24/7. And even if you do have the security person, they take leave, they have weekends, they sleep. So a managed SOC...

Sleep? Yeah, I know, very rare, but sometimes it's forced upon us.

But, yeah, a managed detection and response service, or an outsourced SOC, another acronym, Security Operations Center. No matter which vendor it's from, they're effectively doing a similar kind of role. There are some slight differences, but at the end of the day they're looking at your environment, whether it's their own security tools or other security tools, and when those things are creating alerts and noise, so I mean alerts, logs, things in your firewall, think Microsoft 365 suspicious activity, think stuff happening on your endpoints and servers, they are going to jump in, they are going to investigate, determine if it's a false positive or not, figure out what's happening, and then, and this is the difference, some do, some don't, some will alert you that it's time for you to take over and do something, others will actually respond for you, which is my preference, because if it's 2 a.m. on a Saturday, I don't want to be dealing with that. So that's what an MDR or managed detection and response service can do. And then again, some are all different, when you get to that level of, okay, if it does turn into a major incident, are they going to do the forensics and all that work for you to answer those inevitable questions of how did this happen? So that's an MDR service. There's a million out there. Elliot and I obviously have options for you, if that's something you want to talk about, but yeah, at the end of the day I think they're super valuable, just from the amount and scale of different things going on. And you know, it's hard for an MSP, they have to look after so many different platforms and so many different products, it's hard to keep up.

Yeah, cool, thank you. I thought that was just worthwhile, that we sort of cover what that is, because there's a lot of cost associated with building a SOC, right, not to mention staff are hard to find, all those pieces of it, and you need a big critical mass in order to do it.

Incident Response Planning

So we talked about response planning. I always like treating it almost like project management: starting, if you get things right at the word go, things flow a lot better. And I know I said don't let perfect get in the way of great, but understanding what happens when someone gets breached... We did a cyber insurance talk last year sometime, and the amount of people that gave us feedback that if something happened they didn't actually know who to call for their insurance. Fundamentally, it was like they're paying for this thing but they didn't actually know what to do with it. So having that sort of plan, what is that incident response plan? Is it a 50-page document? And Elliot, feel free to jump in, what does that sort of look like for an MSP?

You want me to start?

No, you can take it, mate, I'll jump in at the end.

From my perspective, it's two parts. There's incident response plans and playbooks. The playbook is the expansive one; the plan is the basic one, I should say. It's understanding that each plan is going to have a different path to a resolution. For a lot of the speaking engagements I've been at, I've asked a question: how many of you have got an incident response plan on paper, documented? And it's a bit wild that I barely get a hand go up in those type of conversations. A lot of MSPs who are quite technical, maybe working with small teams, they have it in their heads. And you talked about cyber insurance and, from a legal perspective, not having a process like your incident response plan documented can be detrimental from a liability perspective. If you get taken to court, or your insurance provider asks for information and you don't have a plan, that's what they can use to come at you and say, well, what guidance have you put in place to follow, what's your communication plan, what are these things that you've determined should be the right course of action if there is an incident, whether that's a business compromise, whether that's a ransomware attack, and all the other threats out there. If we don't have something in place in the first place, like a plan of action that's properly documented and typically tested through some sort of simulation even, those can be a potential legal liability for partners.

So if you are offering cyber security services, and going back to NIST, if we look at the five core pillars of NIST, with obviously the sixth one added in with governance, two of those elements are where MSPs commonly focus, right, which is the left of boom, that's all the preventative stuff, that's putting the tools in place, having some sort of support. But three of the others are the right, the detect, the respond, and the recover, are the right-of-boom elements, and they all align with some sort of incident plan, which we don't seem to have. And when we look at the stats out there, it's widely considered that a cyber security attack is not a matter of if now, it's a matter of when. Could be tomorrow, could be two years down the track, but incident response planning should be a core part of that.

Yeah, and there are, for me, two parts, like you said, Elliot. For me, even having the plan is great, and definitely everything Elliot said, following it, knowing what to do. But I see more value, funnily enough, the plans can just sometimes be thrown in the bin when stuff actually happens, but I see a lot more value in actually just doing the exercise of creating a plan, just asking the questions. And look, if there are MSPs on the line here today that don't have one and don't know where to start, start with a one-page document that literally just says, "If we were taken offline now, and we ended up with a phone call or a message that said all of your customer data is online, what would you do?" And if any part of that plan says "I'm going to get Jimmy in the corner to do X," make Jimmy remove himself from the business and then do it again. Just make sure that you know what you're doing, make sure there is someone to call. Where would you go, who would you turn to? That exercise, even if it just ends up on one A4 piece of paper, that's critical, right, that's a good starting point. Then of course you can work back from there, who do we call, and then also thinking of it from a customer perspective: if one of my customers was breached, what would we do? Because that's different. And that's not a customer's incident response plan, they need their own. But if their plan is to call you, that's not a plan, that's a reaction. They need a little bit more than that.

So the other part of it all, as well, is, actually, which, that's a mental blank of what I was going to say, but either way, doing the exercise is fantastic and making sure you have the steps and you know what you want to do. I've had that exact example happen to me where a partner's client had some sort of attack. It was a financial attack where they got access to the banking account details and were able to transfer money out of that. It was somewhere to the degree of $100,000 to $150,000, from memory. This was a couple of years ago. The first point of call was to reach out to the account manager, which is definitely not something you should do. The second point of call was to reach out to me, which, if you're doing that, that is a big miss. It was just unfortunate timing that they were actually rolling out their cyber services at the time, and they were just in the early stages of that, they didn't have cyber insurance, they didn't have anything to go to. So we had to basically find a lawyer, and I recommended they reach out to the ACSC as part of that to see if they could do anything about it. Lucky enough the AFP got involved and they were able to recover the funds before they went overseas. But those are the situations where it's going to cause a lot of stress if you don't have at least the basic contact details, like you mentioned there. If you don't have cyber insurance that you can go to, if you don't have a legal representative, if you don't have a forensics team that can support you with that, then have someone, whether that's the AFP or the ACSC or some sort of contact point, that you can at least start the process to initiate that incident response plan.

Yeah, and incident response can be very expensive, so for anyone on the line that has not been through it, and hopefully that's most of you, it's an expensive process. It's not like you just call the ACSC and suddenly they roll in for free and clean it all up. It doesn't work like that, much as nice as it would be. But Elliot, it did remind me what I was going to say as you were speaking. If you are thinking about offering cyber security services to your clients, you must have your own plan. Like, you cannot go out and call yourself an MSP with a cyber security offering unless you have a plan for both your own business and what would happen if a customer got impacted. And that obviously would have multiple paths in it, because some customers are going to be on your incident response plans or your cyber security offerings and some won't be. So you don't want to find out with a ransomware note; that's the last way you want to find out. But if you do, you need to have a plan for that.

Guys, that's great. And I guess where I was going with that question was, I've seen many times where something's been sold and they're not necessarily thinking about what happens next, kind of thing. Many project guys out there have probably been dumped into, had a project lumped on them that a sales guy sort of sold, and that's what I'm trying to get the conversation going about, okay, sales all the way through to, okay, well, what if? You know, is there any resource, though, rather than the guys and girls on the call reinventing the wheel, is there anything that you've seen, good resources online to sort of help with incident response plans, apart from ChatGPT, and I wouldn't even recommend that?

I have. Yeah, at the Pax8 Academy we actually deliver a course on incident response, incident response planning and playbooks and where to get started for that. But there are a ton of resources out there, typically templates and checklists. The ACSC or the cyber.gov.au website has it, NIST has it, CIS controls have it if you're following any of those. There's a ton of resources out there. The only thing I would say regarding using those templates is don't just have it as a copy and paste, because there are a lot of unique things within your clients' environments, or even your environments, that you'll have to modify. Could be basic things like contact points and stakeholders within, you know, who's responsible for each part of that, whether you have multiple teams within your business, or the ultimate responsibility comes down to, not the MSP, but the client, and where they have cyber insurance as well. So that's where I talk a bit about cyber insurance, and I'm a big advocate for that, because if you don't know what to do with incident response planning, many of the good cyber insurance providers do have their own IR teams where they can come in and support you, including providing legal support, not just the financial elements to it, but forensic support and everything else in between. They basically can help you put together your incident response plan rather than you trying to figure it out yourself. But if you're looking for a starting point, I think Sophos even have some, and Aaron, correct me on that, but there are a ton of templates out there that you can use as a structure to build out on.

Yeah, we do. Without doing too much of a plug, however, I will put an asterisk on this. So, you can for free absolutely go into Sophos Central, hit up the top, for those of you that are using it, there's a little University hat icon in the top right, and there is an entire incident response planner tool there that will build out an incident response plan for you based on the information you put in. That's all free. I'm going to, this is the asterisk, it's going to produce a 52-page document. It is a completely fully fledged incident response plan with legal definitions and everything all the way through, and flowcharts and the whole bit. It will suit everyone that needs that level of detail. If you are looking for a starting point, sure, it's great. If you are a very small MSP that services the SMB space, that's going to be a very large document that most people aren't going to read. So I would suggest taking it, understanding it, calling out what you don't need, and then, to Elliot's point, making sure that there is something there that you can use, that makes sense, and that you can follow.

And I think Daniel's put in the chat here, it's important that everyone is trained on the plan as well, so you don't have the frontline help desk doing their own thing in a critical security incident, circumventing the plan. That is a very great comment, Daniel, and if it's a 50-page doc, that's probably going to happen.

So, probably likely that the level one hasn't actually read the 52-page document.

That's right. So, yeah, plenty of tools, but to Elliot's point, make sure they fit and you understand them, and you turn them into your own, not just copy and paste.

We'll consolidate, we'll put together a little bit of a list. You guys have mentioned some, so we'll put those together in a follow-up email after the recording, as with the recording and whatnot as well, so you guys can check that out.

Upskilling: Training, Certifications and Specialization

Guys, speaking of incident response plans, sort of taking it to the next step but staying on the topic of resources and training, what resources do you recommend for technicians or MSP owners that want to upskill and learn more about this, so that they're more comfortable offering a cyber security practice? Are there any good programs that you can recommend?

I think you have to understand security first before you can put an offering out. I think you need to understand your market. Elliot, I guess we can both shamelessly plug CompTIA here, given that we're both part of it, but they have some fantastic security courses that will help more around the technical, I would say. I believe there are different levels of their courses and they go through different components, but look, I think at the end of the day you need to understand where your risk is before you can put a package together. So understanding security, even if it's at a relatively high level, would be good, and then understand your customers, understand your attack surface, and then build a solution to fit. Elliot can probably help with all the right vendors to speak to when it comes to that. I saw a comment, Tony, what was the last course? So, CompTIA, what was the old CompTIA Security Plus, I think the basic one, and then they go up from there. Thanks, Ben.

Yeah, I was going to say CompTIA, I'm still getting used to it being called that. Elliot, your experience, anything that you want to add?

Yeah, obviously, being on the education side of Pax8 now, you know, the Academy, we provide a ton of different opportunities for learning, whether that's through on-demand learning or the courses I run through the instructor-led training programs. And obviously my focus is around cyber security, so things like building out an incident response plan, or packaging and positioning cyber security from a sales and marketing perspective. We have a number of different courses out there. The most recent one upcoming would be SMB1001, understanding and implementing that. So there's a ton of opportunity out there, but there are other industries and organizations out there that could support you. I know ISACA is one of those organizations. ISC2 would be a fantastic opportunity to get started. I believe they still have their foundation course, which is a certification of cyber security, still running that, and they're making it available for free for the first one million people that sign up to it. So I think they're only about 100,000 in, so there's a mass of opportunity to upskill your team there. That'll start talking more around the basics or foundation elements of cyber security, moving into the governance topics and things like that.

But I guess you need to work out, as a service provider, where you want to focus your attention. If you're trying to do cyber security, and cyber security is a massive beast, there are 20-odd domains that you have to cover off. I've spoken about this before, there's no way most MSPs can deliver every single service for all 20 domains. So my recommendation is to find some areas that you want to specialize in, and a lot of that will really come down to understanding your partner base, or your target market, I should say, and where the highest risks are, what are the threats that they're seeing most often. When we look at the threats out in the market, whether that's looking at the ACSC reports or otherwise, you know, a focus on email protection as an example, endpoint protection, simple things like MFA, the fundamentals that we talked about before. But it really comes down to, all right, well, what do you want to take, and then what are the risks behind that, and build your service catalog to align with that, rather than trying to do everything out there.

And for those areas that you don't have resources for, or you don't have the expertise to deliver, I'm pretty proud of working with the MSP and the wider channel community that we have. You know, we're generally pretty friendly overall, even though there's a lot of competitive edge there, where there's opportunity to partner with each other. If you're a partner and you're doing endpoint protection and email security, find another partner that can focus on network security as an example and deliver that. There's massive opportunity out there, and that's one way you could potentially look at a fuller service offering, I should say, by partnering with others that can actually provide those services and come together as a community.

Pricing and Packaging Cyber Security Offerings

You mentioned a few different products there, and Aaron, you and I actually did a topic on, I don't think it was MSPs in Conversation, but it was on pricing and packaging a cyber security offering, like a year ago, two years ago?

Yes. But time flies when you're having fun.

A few more gray hairs. I just want to touch on that a little bit, sort of how, what have you seen in terms of how a best-in-class MSP has packaged their cyber security offering. Is it an add-on, are they just passing margin, how do they charge for this?

What a can of worms you have opened.

I know, and we'll try and keep it, because I've got another one that I want to jump to as well, and we've only got 15 minutes, so, I was about to say how many hours have we got. But that's why I sort of use the term best in class, right, like, what have you seen, what are the key things, if you can rattle them off, of what they need to charge for and potentially how to package it?

Yeah, look, there's a lot of ways to do this. I'm not going to say I'm an expert in any of them. I've probably made every mistake there is to make in this department, but with that comes some lessons, right. I'm a firm believer that you should not offer managed services anymore without having security as part of that offering. I don't like options, I don't like bronze, silver, gold, or good, better, best, and then we make the best so unachievable that they'll take the better one. I don't like any of those strategies when it comes to security, because I think it's either secure or it's not. I don't believe you can be sort of secure. So when it comes to that, I think as part of the offering, I know a lot of MSPs now are calling them sort of secure managed services, or the different kinds of namings, but I'm a firm believer that your offering should be secure by default, and that should come with whatever it is that you need. Now, standard things obviously, endpoint protection, firewalls, that's all standard, normal stuff everyone's been doing for 20 years. Some kind of 24/7, which I know we've already touched on, but I see people selling these things, you know, just the managed MDR services alone, I see people selling for around $25, $30 per user per month just for that 24/7, and that's going to cover their 365, that's going to cover their endpoint, cover everything. I see that sold very commonly, and a lot of the best people out there are doing that. So I know there's a lot of concerns from people saying, "How could I possibly sell that for that much?" I guess my short answer to you is, don't skimp out on it, there's plenty of margin to be made there, and bundle it in a way that works for your clients. But that all starts and comes back to what I said earlier, which is having those conversations. You have to have them. Elliot, you probably get that question every day.

Yeah, this is something I talk a lot about, and I do have courses around this very topic. I guess a couple of things there. I agree and disagree with you with some of the stuff that you mentioned. I agree in the sense that security should absolutely be something that's mandated, right. If you're providing technology services, your security packages should be a part of that, right, or your offering. But to be realistic, what I've seen over the years is we need to do that gradually, right, and this is kind of where that "good, better, best" comes in, is trying to identify how we slowly increase that over time and make sure our plan is based, and without sort of losing too much revenue or having too much churn. So at some point in your journey into cyber security, as you mature, the best-case scenario, or the scenario you hope you'll get to, is you have one security offering that is embedded into, as part of, your full security, full IT offering or technology offering. That's because you own a lot of that risk, right. You are obviously a big part of that risk to your clients as well, as probably the biggest component of that supply chain. So that's where you're also protecting them as well as yourself. There is no specific liability for MSPs yet, it's kind of a gray area, but with things like the Privacy Act changes coming, it could be that MSPs may inherit some sort of liabilities or legal ramifications if they're supporting your clients. So there are a lot of things out there that you will need to consider. But I guess, if you're on your journey, or you're starting out, look at the areas that are risky for yourself, and what is something that you would absolutely not allow a client to do, right, to expose you to that risk. Are you going to let a client remove their backup, or not jump on with your backup or your MFA? What are the basic elements that you would include as part of your offering? So that's where frameworks that we talk about give you that guidance, right. Whichever you choose, I don't really care, but pick something that's going to help you have those conversations, help you build something out, and start with the areas that are the biggest risks for yourself and your clients, and that will at least get you on the right path as you slowly mature and increase your service portfolio.

Cool, that was great, guys. I'm just thinking a few things that I've seen as well to add to that. Making sure you're charging for assessments at the beginning, so you know what you're actually getting into, outside of your actual monthly retainer. Would you recommend, I know my opinion, but would you recommend including remediation in that, or is that excluding remediation?

Definitely exclude remediation. If it comes down to a cyber security attack, of course. It's that fundamental thing there, that incident response into a cyber incident is not technical support. There's a very clear line down the middle there, so make sure, again, talking to your clients about that and helping them understand the difference, because if they don't take something up, or negligence from someone's behalf is done, you should not wear that cost. I've seen people wear hundreds and hundreds and hundreds of hours, and it's going to take them three or four years for that customer to be a managed client to get that, for them to be profitable again. No MSP should put themselves in that situation, right.

So that remediation can be potentially hundreds of hours' worth of work, right?

Huge, absolutely. You don't know what it is at that point. So, and I guess for anyone that is, you touched on this earlier, Ben, anyone that is just sort of saying, "Oh, I've had an incident, that's okay, I'll just restore from yesterday's backup," there are a number of problems with that. The attacker still could be inside if you don't figure out how they got in, or they could be in the backups. But more importantly, and Elliot, you just touched on it, with sort of ramifications for MSPs, I've firsthand seen multiple times where that exact action was taken, and evidence was wiped in that process, and then the customer makes a cyber insurance claim, and then the legal teams all come looking for who removed evidence, who poured bleach all over the crime scene, and it was the MSP. So I just want to call that out. I love to call that out in front of MSPs, because I've seen that a lot, and I don't want anyone to ever go through that.

So, yeah, we've seen that before as well, like I mentioned earlier. So yeah, if you're going to restore, take a copy of the current state.

Yes, or restore to a different hardware, whatever.

Yeah, yeah. I've seen where the customer's actually gone after them because they've breached their insurance, right. So you want to be real careful with that.

Cyber Security Assessments and the Business Risk Conversation

Guys, I've got one last question. Actually, there's two, there's one in the chat, we got a few here, sorry. Have you guys seen any templates for cyber security assessments, any you can shout out anywhere that someone can find that? And if you don't know off the top of your head, have a think.

Yeah, as in security assessments? The assessment at the beginning process, I would align to something, you've got to pick a framework like Elliot mentioned. My personal favorite is NIST, and there are many tools out there you can use to do NIST assessments that'll guide you through it. We have one, again, it's free. There are many out there, so I would stick with something like that. Elliot, you probably know more about SMB1001, and I know it's a fantastic framework. I love the idea of the tiers and everything, and I think it suits probably this audience really well. NIST can be a little bit overwhelming to begin with.

Yeah, I know there are a few vendors out there that have incorporated SMB1001 now. It's one of the newest standards or frameworks out there, so it's still getting a bit of traction globally now. I can't think of one off the top of my head, if there's a particular one, but if I find one I'll send it over to the Hosted team, to Ben, to share with everyone. But with the assessments, you know, it's something that when SMBs look at it, they think of cyber security as purely technology, right, things in the cloud, things they use, the computers, right. There's a lot more to consider when doing a security assessment. You know, what are the physical things you could be doing right? Have you got a server room in your office, is there a locked door on your server room? All of those type of things are parts of your cyber security, your hygiene, that you should be considering. And the human element, right, that's not necessarily technology. If you're having meetings in a boardroom and using the whiteboard, is there sensitive information on that whiteboard that you forgot to wipe down? Can everyone see in a confidential meeting, in your meeting room, can everyone see that sensitive information that's shared on screen? Those are the type of things that often get missed when we consider cyber security threats, is looking at those physical items and not relating that to also being part of the cyber security threats, right. So what I would look at is, you can Google this, but look for "business impact analysis" as an example, to do a sort of broader-scope cyber security assessment rather than just purely a technology assessment, and you'll get a better understanding of the inherent risk that your clients might have in their day-to-day jobs.

I like that. I've been saying to quite a few partners recently that they're not IT advisors, they're actually more business advisors these days, right. And ironically, Ben, there's a lot of money to be made in that type of consulting.

So, to our point about outsourcing and partnering, that's the hard stuff. No one wants to look at logs and security alerts 24/7. Like, really, I know a lot of people think they do, and then they do it and they're like, "This is terrible." That was my scenario as well. And trust me, there are some very skilled people that can do that for you for a fraction of the price. But consulting in the business space, helping people understand their business risk, is where huge, huge money is, and guess what, it's not a 24/7 job either.

So that's a really good point. I have one last question, then we're going to wrap up. Guys, I was doing a session two, three weeks ago, and one of the biggest challenges that a lot of the MSPs that I was doing this session with had was that they get a lead, you know, for a, and the customer just couldn't understand the risk because they hadn't been burnt yet. Have you got any tidbits of wisdom to help end customers see the benefit and why they need to do this?

From my perspective, I'm very real-world operational, so I like to lean on stories. So I recommend everyone getting stories from either their vertical, their local area, state, whatever it is. There's plenty of these out in the media, and using them to basically expose the gap to the customer, help people understand that there is a gap in your environment and this is what could happen. So it's like, most of you probably haven't dealt with a major incident, and I hope you don't, neither have customers, they're even more removed from this. So if they think, "This has never happened to me before, then why would it happen again?" you need to highlight what can happen and what the outcomes of that can be, because there's a very real human toll on this stuff. Businesses can shut down, you know, massive liability problems, but just the human toll is pretty major when it comes to a business. So if you can make them feel that emotional connection around what could happen to their business and who the finger would be pointed at, and if they are the owner of an SMB or something of that nature, that it all comes back to them. Call things out like, what if you could not process payroll? So it's not about data loss, it's not about my IT, it's about payroll, it's about your staff not paying their mortgages. Things like that can make it real for people to understand.

Yeah, cool. Yeah, those exercises and simulations, I'd recommend it as a sales approach, for the most part, because it can be a bit of an expensive exercise, as a final approach to convince the client on what the risks are and what they may see if they had an incident. So whether that's a ransomware attack or any other threats that they may experience, look at doing some sort of tabletop exercise, right. Help them sort of think through the examples of, you know, what if you didn't have access to your CRM systems for two weeks, what would be the challenges there, what would be, particularly for business owners, what would be the financial issues if you couldn't process bills and invoices for a two-week period? Those are the type of things that it's easy for us to speak to, and it kind of makes sense when we're talking about it, but to experience it in some sort of simulated fashion where they can go through and properly articulate and potentially visualize it, because everyone learns a little bit differently, those are areas where you can start going through, and you know, getting them to really think through a simulated experience of what that might be and how they would manage it.

That's good. I'm going to steal that, and those MSPs that I was talking to, I'm going to give them that example. Thank you, guys.

Wrap-Up and Project Guardian

With that, we are pretty much at time. I'm going to do another quick shameless plug of Project Guardian, because marketing is telling me to, so they've actually added the slide for me. Very quickly, if you don't know what Project Guardian is, it is a free tool in our portal where we actually monitor all of your services that are exposed to the internet, for free, and we monitor for open vulnerabilities, ports, high-risk services like RDP, SSH, things like that. And anything that is eight or higher, our team will actually call you. You get alerts, of course, but we'll actually call you and let you know and provide you guidance on how to remediate that, or just close it off. Really handy if one of your techs opens a port, for example, because the customer has asked them to. You know, we've seen some pretty crazy things, from security cameras being exposed to the web in medical practices, we've seen FortiGate routers that have just simply been forgotten to be added into FortiManager and haven't been patched, or security camera systems or phone systems that have got vulnerabilities, lots of different things. So that's free if you're a Hosted Network partner, for anything that gets connected to the internet. Anyway, I never do this many shameless plugs as this, so you'll have to excuse me.

Guys, I want to thank you both heaps. Our next MSPs in Conversation, we're going to tackle the topic of AI. It's a topic I've kind of avoided, but we are going to go there. We're going to be talking around two things: the opportunity itself, how you can actually sell a service, if you will, but also how you can derive greater efficiencies within your MSP. We're doing some really cool things within Hosted Network. I've actually asked our COO, Luke Bragg, to join us as well, so I'm going to be interviewing him and a few others as well that are doing some cool things, and share some of the things that we're actually doing, and whatnot as well.

With that, we are at time. Aaron, Elliot, thank you so much, it has been absolutely amazing. Again, guys, the recording and whatnot will be sent out, and we'll make sure we get some of those resources into the follow-up emails. And if you do have any questions following this, feel free to flick them through, and we'll try to direct your questions in the right direction. Thanks again.

Thanks, everyone. Thanks.