Cyber Insights for Australian MSPs: Navigating Risks and Protections

Alrighty, welcome everyone. This is our first MSPs in Conversation for the year, so we're glad to be back. Today we are presenting a very hot topic: cyber insights for Aussie MSPs, navigating risks and protections. So we've got a few experts here and I'll let them introduce themselves in a second, but very quickly, just introducing Hosted Network. If you don't already know, Hosted Network are a wholesale cloud and telco provider. We deliver cloud and telco the way it should be. We were an MSP, this year marks our 20-year anniversary, and we have been wholesale only, serving MSPs, for 10 years now. We service over 200 MSPs across Australia. I won't go into all of our services, but feel free to reach out if you are new to MSPs in Conversation or if you'd like to learn more about Hosted Network.

But enough about us, guys. Thank you for joining us today. Today we've got Aaron, Andrew and Jason, so I'll start with Andrew. Andrew, can you introduce yourself and share, please?

Absolutely, thank you, Ben. And yeah, it's great to be on this webinar. I'm Andrew Bremner, I'm the managing director of SherpaTech Insurance, and we're specialists in insurance for tech and IT companies. Just a little bit of background: we have an existing business called Sherpa Insurance, and we found that our fastest growing segment was MSPs, and they needed unique, specialized attention. So we've set up a specialist brand and offering just for tech and IT, and that is SherpaTech.

Thanks, Andrew. And Aaron, you're not a stranger to MSPs in Conversation, but today you're wearing a different shirt, or hat, I'm not sure which it is.

Hey everyone. So currently and today I am one of the global sales engineers for Sophos. We handle a whole bunch of different things at Sophos. Any of you that are familiar with Sophos, there's a large range of things that we do, and I focus very much on the MDR and the incident response side of the shop. But prior to that, last year I moved to Sophos, but before that I spent 20 years in the MSP space and I was general manager of Roam Business Solutions. We were, I think, about four thousand, four and a half thousand seats, 150-odd customers.

They're probably double that since you've left, right?

I'm sure it's skyrocketed since I've gone. Yeah, huge numbers.

Great. Jason, welcome.

Thanks, mate. Thanks for having me. So yeah, I'm Jason from ISO365. Basically a business that's focusing on helping MSPs achieve their ISO certifications. I have been working in MSP land for the past 15 or so years across a few MSPs, mainly working in the operations areas of the businesses. And so, you know, like many people on the call today, I think that the conversation about ISO is getting lumped with either the general manager or the Ops guys and girls out there. So yeah, obviously I've been doing that, and now launching ISO365.

Great. Well, today we have a heap of questions that we want to run through for you guys, but I will throw it out to the audience: if you guys have any specific questions that you'd like to ask our panelists, please feel free to drop them in the chat and get the conversation going. As always, we will answer them as we go. But to set the tone, I'm going to stop sharing, because this is all about what you guys have to say as our experts.

The Cyber Threat Landscape: Why Every MSP Is a Target

To set the tone, Aaron, I'm going to start with you. Cyber risk is a very hot topic in general. We're seeing threats go through the roof. It feels like every week there's a major brand on the seven o'clock news that's being breached. I know that you and I have had plenty of chats about war stories, but can you talk to us a little bit about some of the issues that you've seen MSPs facing, and I guess just try and highlight some of the common causes that our customers are being breached by?

Yeah, for sure, awesome. So look, I'll start with: coming to Sophos and then seeing the other side of the fence was mind-blowing, to see the amount of things that go on. You hear about it in the media a lot, but that's the big names, that's the stuff that you see, like you said, in the news. The reality is everyone — I feel like everyone is getting breached. I know it's not everyone, but everyone's a target. It happens a lot. MSPs are under attack, literally everyone's under attack, and it's just more about the low-hanging fruit. These attacks come in every day.

So my team globally, we deal with the incident response, so we see — unfortunately we're the first people responding to an incident. And for anyone, really, not just Sophos customers, also non-Sophos customers. The stuff that we see, yeah, look, it's horrible. The big things that we see really regularly are unpatched things. So Ben, you mentioned big names looking at the tech sector, and look at zero-day vulnerabilities. You automatically think of Microsoft when you think of patching, but there are vulnerabilities in almost everything. The reality is there's vulnerabilities in every piece of software, not all of them have been discovered yet. So where people are getting attacked, it's from not being able to patch quick enough, and that comes back on MSPs.

I mean, you hear all the reports, and every vendor has a statistic and a number, you know, social campaigns and a Gartner chart. And I hate the statistics — 93% of this and 27% of whatever. You can make a percentage about anything, but the real truth of the matter is it's the stuff that, as MSPs, we all are meant to be managing and patching and dealing with that is the stuff that's getting hit. And you can do all your job perfectly, you can patch everything, and then something will come in through a user that gets socially engineered, or, you know, I think of VPN connections without MFA on it. It only takes an intruder just to get in a little bit, and then once they're in, they start working through your environment. And unfortunately they're doing a really, really good job of it. They're better than all the MSPs I've ever met out there, including Sophos, at being able to manipulate their way through a network.

So yeah, look, it's scary. They come in through any way they can. I would always say the vulnerabilities are the huge one. I know statistics might say social engineering, but I often think that when you talk about the really big companies that spend millions of dollars on security, that's the only real way they can get in, through social engineering, because they have really good systems in play. For all the small businesses out there and MSPs out there who are juggling way too many things, not being able to put the latest firewall patch on that came out last week and is now being attacked, or came out a few weeks ago before that, or the — you know, pick, insert vendor here, there's a new vendor every day — that's the way they're getting in. And once they're in, they're starting to work their way through. So yeah, it's pretty eye-opening and scary to see this kind of stuff happening.

Yeah, it's interesting you say that. Our internal security team, they were doing a bit of a demo the other day. We've got an internal project called Guardian, which everyone will hear more about this year, and we monitor everyone's connections for vulnerabilities, and we're about to start presenting that data to our partners. And it's crazy the amount of vulnerabilities that will just pop up, being a DrayTek or a D-Link or something like that. It is scary to see how quickly you can actually get in and control, whether that be an RDP server sitting behind or whatnot. It is very scary. So it sounds like a risk that we can't really entirely manage, right? We do our best. So I guess that's what today is about, so thank you for setting that tone.

What To Do When a Breach Happens: The Insurance Perspective

So I guess the first thing is, we need to mitigate and manage that as much as we possibly can, but there's always a risk, which is where cyber insurance comes in. So Andrew, I'm going to start with you next, please. If we have a breach, what are the key things from an insurance perspective that we should do, and most importantly, should not do?

Yeah, absolutely, I'd love to answer that, Ben. And Aaron, you've basically just — leveraging from what you have said, you're absolutely bang on. Every piece of software has vulnerabilities, and it's often more a when than an if. It's really sad. And where we come in is, once the data breach has happened, after Jason's piece of work, or Aaron, your solutions actually get breached and it doesn't work. We get in at the point where there has been a breach. There's a lot of data, and here's, you know, what do you do?

So the first thing is, keep in mind that insurance is that second line of defense. So once you hit that second line of defense, what do you need to do? The first thing is, you contact your insurance broker, or you contact the cyber insurer. And the reason you do that is the cyber insurer has a 24/7 incident response team to hand, and these guys specialize in actually stopping the damage. Why do they do that? They do that to reduce their exposure and reduce their loss. So if they can jump in and get control at the get-go, they have a better chance of succeeding.

So first thing is, you get hold of the insurer, or via your insurance broker. Then there's a whole bunch of things. Once you've assessed where the leak happened, you must, of course, stop the leak, but again, use the help of the incident response people, because at the end of the day, the incident response people are in the business of dealing with the data breach, whereas the MSP is really in the business of keeping the lights on. And from where we sit, they do an incredible job for their customers. MSPs are amazing and innovative to keep the lights on, but they're perhaps not so innovative when it comes to data breaches, not sure what to do. So that's why it's very important to engage that insurer early, and away we go. And we've actually prepared a data breach checklist that will make available to everyone on the call as a starting point.

Okay, so if the first thing that we need to do is call — I wonder, with the MSPs on the line, if many of you will actually know who to call, or if your customers will know who to call. Jason and Aaron, you guys have run MSPs before. Was that kind of a standard practice that you found, that you had those details on hand?

Yeah, you want to go, Jason?

Yeah, it depends how organized you are, I suppose. The politically correct answer.

Well said. I wasn't going to be politically correct.

Yeah, I would dare say that a lot of MSPs wouldn't have that information on hand. I'll take the question from an ISO perspective, but if they don't have a management system in place, whether it be certified or not, if they don't have a management system in place to make sure that they know where to go to find these details, well then the first point of call is going to be Googling "what the hell do I do, we've just had a breach." So yeah, I don't think that many of those MSPs out there would know what to do. Depending on how big the breach is, you do have to let the regulators and the authorities know. That's where it can get a bit scary, because you've obviously got internal reporting, but you've also got external reporting. So it all really depends on what's happening in your business, but if you don't have a management system that's set up for you to be able to go to quick-smart and find out what you need, yeah, you're not going to know.

Okay, so that's a little bit of a takeaway, maybe a tip there. I wonder, from an onboarding perspective, if MSPs should actually be collecting those details of who to call. I'm going to put my little asterisk there, you know, not provide insurance advice, but maybe that's an idea that, from the people on the call, that as a takeaway. Aaron, what have you done in the past?

Well look, there's two sides to this conversation. There's one for an MSP having a breach themselves. That in itself — Jason, I don't think many MSPs, definitely not the whole staff, would have any clue if they had insurance or not, or who to call.

Yeah, good point.

I know in our situation it would have been "call Aaron," and that's not a good incident response plan, but everyone needs an incident response plan. So I had those details, and a handful of others had those details, but it wasn't correctly plastered all over the walls like it should have been in the event that we weren't available. So a proper incident response plan is important. And going back to that two sides of it, Ben, you've got your incident response plan, but then you've got the customers'. Now, they should be different, right? If you're having a systematic MSP breach, "oh my God, my RMM's popped and stuff's gone wild and I'm losing customer by customer at the moment, what do we do?" Well, your incident response plan is going to be pull a cable and then start figuring things out. But you might not be able to pull the cable, who knows, right?

But onto your customers, Ben, I don't know what the right answer is about you holding insurance details. Maybe Andrew you can give us some advice there on customers, because I, at Roam, always put it down to "no, customers' insurance is their cyber insurance, we're not getting involved, we're definitely not going to be the conduit to contacting insurance, that's not written into our agreement." I'd expect that the customer would have to call them. Andrew, how would that usually operate?

Yeah, normally what we see is the customer needs their own cyber insurance, you know, standalone. But the funny thing is, if they have a breach, probably the first thing they're going to do is call the MSP: "MSP, please help us, we're in deep doggy-do." So yeah, I think there's an opportunity for the MSPs to say to the client, in addition to whatever insurance you have, Mr Customer, Miss Customer, make sure that you have a cyber policy in case things break out. Why do you want to have it? You want to have it because, yes, you get that incident response, but also protection for things like, in the case of a data breach, the fines under the Privacy Act are up to two million dollars and more per incident. And, you know, the Optuses of this world, the many banks of this world, they're up to hundreds of thousands of incidents. So it's a scary part.

But I think there's a lot of responsibility on the MSP to provide a little bit of that guidance, to say, "hey, talk to your insurance, Mr Customer, Miss Customer, talk to your insurance specialist and make sure you have the cyber policy and you know who to call in the case of a breach." By putting the onus back on the customer, that does sound like it's a safer bet, right? Then you don't have to collect everything.

Okay, that's what we were doing.

Professional Indemnity vs Cyber Insurance: Knowing the Difference

I want to jump in and talk about something that's probably the biggest exposure that we see for MSPs, and that is bad advice. So MSPs provide advice to customers, for example, selecting applications, keeping the lights on, data migrations — the move from Google to Microsoft, whatever it is. So the trouble is, if things go wrong, there's a very good chance that the MSP could be held responsible, and that protection is professional indemnity insurance, not cyber insurance. So there's a distinction. And just keep in mind that cyber professional indemnity does not include cyber insurance. In fact, insurers have gone out of their way in the last sort of four or five years to say "hey, we don't come anywhere near the cyberspace."

So our belief is most of the exposure from an MSP — and actually what we're seeing in claims, the exposure — is professional indemnity. It's providing that advice, and the data breach of a customer might end up that the customer blames the MSP for that data breach: "they left the door open, they switched off MFA, they didn't patch something, something as simple as that," and then hold the MSP accountable. So even though it became a cyber incident, the claim is the bad advice, and that protection for the MSP is professional indemnity. I think it's an important distinction for people to know.

Well, we've actually got a question in the chat. How do you balance getting the insurer involved to help reduce the breach impact in real time versus the risk of self-incrimination? So, for example, your duty to mitigate against the breach — is that professional indemnity, is that kind of what that helps protect you from in that sense?

Absolutely. And there becomes a bit of a duty of care, right? So as the MSP, you're probably the number one go-to guru for anything IT for your customer. And if something goes wrong, you can't just leave your client to sink, can you? You've got to do what you believe is responsible. And if you do the right thing, no matter what it is, if you do the right thing, it's going to be reflected nicely in the claim. So I don't think you'll have an MSP going "oh sorry, I can't help you, that's — we're going to incriminate ourselves here." We got into IT because we enjoyed it, most of us did anyway, right? And the first instinct for a lot of us is to kind of go "oh yeah, we'll help," even if it is at our self-incrimination or disadvantage.

I've got another question in the chat from Mark. Mark asks, what happens when they don't want cyber insurance? Can you give us some challenges that we might be able to go back to these customers with? Mark's got an example here that before Christmas they got breached, and as the MSP they got them up and running, but he got them up and running so quickly, in four hours or so, and billed them for it, but they were like, "oh well, that's — I'll just pay for that when it happens." So my first tip to you there, Mark, is you probably should just charge, I don't know, 10 times that, that'll scare them up. But Andrew, what, in your real capacity as advice, would you suggest?

Yeah, exactly. It's a difficult thing, because the customer, they look at their own risks and they say, "well hang on, we don't want cyber, it's hard to get, it's expensive." So I think there's an opportunity for MSPs to say very clearly to the customer, your exposure, it becomes yours. So if you have a data breach, you're not protected in terms of, say, a fine for the breach of the Privacy Act, and the business interruption — we're not responsible. You really — probably at this point I need to point out, you probably need a lawyer, because it becomes very legal very quickly. So you might need a lawyer to provide some advice. But it really is an opportunity for MSPs to say, "hey, the complexity of the world is just getting so extreme, you need to understand what your risks are and what your mitigations are." It's not to say that insurance is the be-all and end-all, it is not, it's only one risk mitigation, but there might be a whole bunch of things that they can do without buying insurance to protect themselves. But if things blow up, really blow up, they need that insurance protection.

Just for Mark, just for your incident there, it's probably really important to understand what incident response really is. What you're explaining, that you've got them back up and running for four hours, that's awesome. Whatever happened there, you restore backups, images, great. I agree with Ben, you probably should have charged more. But I'm interested, and I'm always interested, in root cause. What was the root cause? What took them down? Because what you did was just restoration, it wasn't necessarily forensic root cause to figure out what happened, how that breach happened in the first place. All these things are really important for that customer, so you can then say, "all right, well this is what happened, we need to make sure it doesn't happen again."

Now, I see your comment come through, this was from a user click-through, right, end users. Okay, but that's where I would start framing questions around, going, "so you can see how easy this happened, we need to not just put protections in place, you need detections" — which we can talk about later — "but also, like Andrew's been speaking about, that incident response is really important." There's ways to do that through insurance. If they don't want to do it through insurance, great, there's other ways to have incident experience and response companies ready if it's not insurance. I don't think you need to get into providing the advice — Andrew, tell me if I'm wrong there — on whether they should have insurance or not, but it all comes down to risk management. And what they're saying there is, "see, we don't need it, great, it only cost 1500 this time."

I always talk about this kind of stuff, proactive security things and insurance and all of this that we're talking about today. It's like when we were selling backup 15 years ago, people were like "I don't want to spend the money on backup," and the second they had a data loss, they threw the checkbook at backup solutions. This security stuff is the same, whether it's insurance or proactive security, it's the same, until they have a real, nasty breach. They're probably going to be like, "do we really need it? I don't know if we really need it." And then, trust me, that one was only fifteen hundred dollars in four hours. What if it was four weeks and 50 or 60% data loss, and their business couldn't operate, and it was reputation, and the board of directors wanted answers, and sister companies and vendors wouldn't work with them anymore? All of these things happen on the back of a real breach. I see it every day. So yeah, having a root cause, a certificate, a report that says this is what happened forensically, this is what you've done about it and fixed it, that's worth its weight in gold. And that's when they'll probably start taking security seriously, which is unfortunate, but it's the reality.

I think we've ultimately experienced it, right?

Absolutely. And Aaron, just to jump in there, like, in Mark's point, you know, it's a user click-through. So for example, for our team, we have cyber training on a fortnightly basis. The whole team, everyone, has cyber training, because we know statistically one of the biggest exposures is a teammate clicking on the wrong link and then that causing all sorts of issues.

Yeah, it's the main way in for ransomware, and we know that from the claim statistics. So the cyber training, it's not necessarily buying the insurance, but it's a risk mitigation that's really important.

Cool, agreed. Fortnightly, Andrew, you're cracking the whip.

Yeah, we recommend it like crazy.

Regulatory Change: Privacy Act Reform and Data Breach Disclosure

We've got a couple of other questions, guys. We've got one from Broden here: we've previously seen now ex-clients get breached, and after our remediation efforts have completed, and our post-incident review and report is provided, we've advised them to seek legal advice regarding the mandatory data breach disclosure laws. Now, we heard about this from a few years ago, but it's kind of died down a little — I guess that's why, well, to a degree they're on seven o'clock news now, right. But Broden continues, what risk is associated with that approach, assuming the client decides to not seek advice, doesn't follow the regular regulations around their data breach notification? Is that on them?

Again, get legal counsel on this, we're not lawyers, but it's the responsibility — if company A has a data breach, it's their responsibility under the Privacy Act, if they turn over more than three million dollars a year, it's on their head. That might be changing as well, and I think that's right, it's starting.

So we've actually got another question that relates directly to that. Does anyone have any thoughts or details on the recent privacy bill changes? For those of you that don't know — I don't know if they've actually gone through yet — but the government is proposing to remove that three million dollar cap for privacy breaches, which means even your local fish and chip shop could be liable. Does anyone have any comments around that?

I asked, about the changes to the privacy bills and the fines, specifically the increasing fines for data breaches and all these things that are changing or have come in, I asked this at a round table about two weeks ago with about 20 companies: has that changed any company's — CEOs, board, anyone's — opinion on it? And I got one person who said yeah, they've started asking more questions, out of 20. And this was generally enterprise space, mid-market. But it was interesting to see that that hasn't even really registered. So it hasn't registered at that level of town, I wonder if it's actually going to register at that point.

Exactly.

The Rise of ISO Certification: When Customers Demand Standards

All right, so we've talked a little bit about what to do in an incident. Now, the threat landscape is changing. Something that we've seen — I think most people know that we kind of follow the US in a lot of areas, and what we're seeing in the US is that MSPs have to have MSP insurance themselves, right, like actual MSP insurance. I don't think that's here in Australia yet, but in order to be prepared — and this is why we've got things like ISO, SOC 2, which is why we've asked Jason to attend today as well. So Jason, from your perspective, with the landscape changing, what things in your opinion do MSPs need to consider over the next year?

Yeah, look, from an ISO perspective, it's always been something that MSPs have thought was only for the bigger boys in town, right? Your data comms, your high end of town, your government jobs. And that was true, you know, six, seven years ago. I can honestly say that that probably was more the landscape back then. If you did want to go for any government work, they were starting to ask, you know, "are you ISO 27001 certified, or do you have at least the management system within your organization?" That was the bare minimum back then.

What I've seen happening now — and, you know, Medibank and Optus have kind of really sped this up — is that it's now being driven by customers rather than by government. So what I mean by that is, every MSP on this call would have their one marquee customer that they bend over backwards for. You know, they're great for profit, all that kind of stuff, great relationships. And I just ask the question: if they were all of a sudden to ask you, "hey, have you guys got your ISO 27001 certification? Our insurance company is now asking it from all of our suppliers," what would you do? And that's generally the catalyst for a lot of these MSPs to turn around and go, "well, I don't think that I need it, but if my best client is about to leave, well then I've kind of got no choice, right."

And so it kind of gets driven via your own customer base now. And it's like, well, do we invest in the system itself now to make our business a better functioning business — because that is a benefit of putting in a management system — or do I let my client walk because they now can't do business with us? Because although we think that we're hyper-secure and we've got all the best practices, an external authority hasn't tested that or signed off on that, right. And so you kind of get left in this landscape of, you could potentially lose some of your biggest clients, not because of your service, but because you're not up to standard from what they need their suppliers to have.

So that sounds like a mid-market-up issue, but with the laws that are changing and where we might end up in the next couple of years, does that impact smaller business?

Oh, absolutely, I think that it does. I mean, going back to that one marquee client, if any MSP on this call kind of lost their one marquee client, I'd say it would be massively detrimental to their business, right. And so it's about mitigating every risk that you can in order to keep your business thriving. The thing that's important to understand is that MSPs these days are generally doing a really good job with their clients. This is more of a formality and a nice stamp of approval, I suppose, to be able to say, "yes, you are great at what you do, you have invested in the right technologies, you are looking after your clients in the best possible way." But you still can't verify that, right, it's still your word against others'. And so, if it comes down to a 50/50 deal and a client is weighing you up versus one of your competitors, and they've got the certification, it's something in their favor that you just can't possibly compete with. So I definitely see that that certification is going to be pushed all the way through, even to your very small MSPs, because it's already happening now, and I'm having a lot of conversations with MSPs that are just starting up, just to get that out of the way so that that doesn't become a risk for them in future.

It's interesting you say that. I can testify to that being true. When we ran our MSP, we had a pharmaceutical company as a client, and as most MSPs, you know, 80% of the revenue came from 20% of that core client base. We were doing a great job, had great relationships, but their regulatory pieces required that they had ISO and bits and pieces, and at that stage we didn't meet those requirements, and we lost that client to someone else that met them. And unfortunately it was one of the big guys, which they paid a lot more for, and all of our contacts said they certainly didn't want to, but they didn't have a choice. They're a public company and the rules were the rules.

So I guess from that perspective, it would be interesting, for those of you that are doing QBRs or even just general account management meetings, asking your clients about what changes are happening within, to try and stay ahead of that. We certainly weren't doing that. It caught us off guard back then and it hurt, it really did. It was a major client that we thought was secure, and ultimately it wasn't.

Okay. So I think part of ISO 27001 is a recommendation that you should only work with other vendors that have ISO 27001, right? So if they go through those certain practices, it could be a red flag, but it's not a strict — correct me if I'm wrong, Jason — but it's not a strict requirement, it's a recommendation, right?

Yeah, absolutely. The more organizations that are certified to ISO 27001 and working together means that you have an overall more secure ecosystem, and so that's the idea behind it.

Yeah, a rising tide lifts all boats kind of style. But I, in my MSP days, Ben, I've walked away from, I want to say, at least five deals, because they were very strict on it. They were like, "no, we want ISO, put a strict thing together but you'll have it within 12 months," and I just said no thanks, wasn't going to do it. I wasn't prepared to absorb the cost and do things — we're obviously working with other frameworks and doing our own security in different ways — but I wasn't prepared to not just comply with ISO, it was more about the actual certification, getting the rubber stamp. So yeah.

Cyber Insurance: Capacity, Underwriting and Why ISO Helps

Okay, so we've got another question relating ISO certification in the context of cyber insurance. Andrew, how do cyber insurers look upon that, does it have any context?

Yeah, so, just stepping back, three, four, five years ago cyber insurance used to be the insurance you could not sell, and now it's become the insurance you cannot buy. So I suppose that's the starting point. Because of the loss ratio — so last year globally loss ratios were 120 percent. Now what that means is, for a hundred dollars of premium, the insurers paid out a hundred and twenty dollars in claims. So the thing is, the insurers need to at least break even. It's not sustainable that they make losses, for a whole bunch of reasons, but I won't go into that. They need to survive. So they've been absolutely smashed, and it's not just here, it's London, US, everywhere, smashed.

So what have they done? They've reduced their capacity. What that means is they reduce the number, or the amount, of policies, or the exposure that they can take. That's the first thing. Second thing is, a lot of the syndicates out of the London market have lost their security totally. So basically the supply of insurance is reduced, premiums have gone up, and the underwriters have become very, very picky about the risks that they choose to back.

So the ISO stuff that Jason does on the outside of the security, the data security piece, is awesome, because it helps paint the picture that that particular risk considers their data security as something that's very important. So it's not something that we see insurers requesting, but it's part of the story that we put together to say, "hey, this is a great risk, Mr Insurer, we think you should take it on."

Right, interesting. And those of you that — because I know not everyone will have cyber insurance on here, but I do know that the cost of cyber insurance has quadrupled in the last year, and a lot of people, to your point, aren't even offering it now. So it sounds like, if we're talking in that year-to-two-year path, if that continues, certainly having ISO is going to be a benefit, because at the end of the day, if the end client can't get insurance, it could impact your ability to actually provide your services to that client as well, right. So swings and roundabouts in that sense.

I'm sure most people on the call have probably, if they haven't filled out their own cyber insurance form, they've had to help a client fill out the cyber insurance.

Yeah, that's changed over the years, correct?

I used to do this fortnightly, I don't know, probably weekly got to it at a point there, but yes.

The questions they ask — and Andrew, you're the expert in this — but they change, and they ask the questions that are from, Jason, all the things that ISO are asking you to do, but then you get into other things which — oh, we're all related, right, it's all in the same thing. But you see it, whether it's the NIST framework or CIS or ISO, they're asking the questions, and, you know, "do you have EDR tools, do you have 24/7 coverage" — which is a security operations center, a SOC — "do you have ISO, do you comply to any other framework?" All these questions make up that, and like you said, make the insurer more confident. And I'm sure that changes the insurance premiums as well. I don't know if they'll actually tell you as such, but I'm sure it does.

Yeah. Aaron, it's actually more whether you get insurance or you don't get it, correct, out of that, than price.

Is price irrelevant?

Yeah, absolutely. Because obviously globally — sorry, we see, because my team's global, and we have plenty of customers sending us their insurance forms asking how our product, the MDR product, fits, and how does this work, and things like that in the States. And I don't know if you've seen these ones, Andrew, I haven't seen it in Australia yet, but in the States they're actually now saying, "what product do you use?" And there's a dropdown, and you literally have to pick the vendor, whether it's Sophos or CrowdStrike or whatever, you have to pick which EDR tool you use and say you're using it. So you call it out, right. Which, as you know, Andrew, and I think everyone would know, means if you're not using that tool, when you're going to make a claim, that's going to be a problem, right. So very interesting.

Absolutely. And individual insurers have been burnt by different things. So, yeah, SolarWinds — I won't name the insurer, but they got absolutely smashed by SolarWinds claims, breaches through there, and now a key question on their proposal is that. One thing I just like to say for the MSPs: just be careful about completing the proposals for your client. I would make sure that they have reviewed that proposal and signed and dated, and they are comfortable with it, rather than it making you on the hook in the case of the proposal not stating something that they should have, or not acknowledging claims or whatever. I just put that little caveat out there.

That's an awesome point, Andrew. I, once I got to a point, was very strict about it. I never ever would fill out the form for them. I would always write either a second document answering the questions separately, or I would just mark it up as comments on Adobe or whatever, but I would never ever write the answers in for them. Never.

Well, because the proposal forms a very key component of the insurance contract. So whatever you put in there, it's embedded with two other documents, and that's the insurance policy combined. Yeah.

Building Credibility: ISO, NIST, CIS and the Frameworks That Matter

Changing topics again a little bit, back to the ISO but other certifications in general. MSPs are having to really skill up across the board, and we've got a question from Paul here: are there other certifications that MSPs can have, or retain, to help build credibility when it comes to work within the cyber security space? Guys, and Jason, I'll start with you, what have you seen that helps build an MSP's credibility, beyond maybe ISO?

Yeah, so I would start with ISO being the main thing that you need to look for. If you're offering cyber security services and you're not certified yourself, it's going to look weird to your clients. And so it's the one certification that is global, I suppose, that is recognized across the world, so it doesn't matter where your clients are located. It's an all-encompassing information security management system. Every country is going to have their own individual little certifications, if you want, or different avenues to go down. A lot of people always ask, "oh, you know, why don't we just do Essential Eight in Australia?" And it's like, well, yeah, Essential Eight is super important, but it's not — and, or, it's both, right. And so, launching a cyber security practice, I would say at a bare minimum you need to be ISO certified, as a lot of the cyber security houses are in the market. And then obviously you have everything else from there as well, like Aaron was saying before, with NIST. There are others out there, they are not necessarily global, but it depends on what you want to hone in on, I suppose, and what services you want to offer to be able to build your credibility. But absolutely, at a bare minimum, if you're going to be offering cyber security services, you'd need to be certified yourself.

And I do wonder how many MSPs that have an absolutely amazing tech stack — because I know how much MSPs love their tech stack — don't tick that box. Aaron, from your side, I mean, you're on vendor land now, but I'm sure Sophos is an absolutely amazing part of every MSP's tech stack, but what else, from a certification, do you see that your partners —

Well, you've got to remember there's frameworks and then the certifications, right. So just like Jason was saying, there's ISO 27001, that's the standard. You can align to it, but you can also be certified in it, and it requires recertification and everything around that. The frameworks, the cyber security frameworks, are a little bit different. I personally love NIST, but this can get quite complex if you dig in too far. But I like the concept, the top level, the sort of five pillars of it, and I think that is an easy way to help start conversations. The CIS framework is really good, that's a more technical framework. So for MSPs out there, if you're looking to get started, look at the CIS framework, pick level one and start there, that's a good one to go with.

The good news story out of all these different frameworks is there's a lot of overlapping things, because they're all good. If you do a lot of things from CIS, there's a lot of overlap to NIST, and if you do a lot of things from NIST, there's a lot of overlap to ISO 27001. They probably all copied things off each other at some point.

Oh, the NIST came from — it was a joint combination between the public and private sector in the US. So a lot of the insurance forms, if you know NIST well, you can see the questions are actually straight from there, or from ISO. So there's a lot of overlap.

ISO, it's really important, I think, Jason, to say that ISO 27001 is not just about technical stuff. So if you're an MSP technical person here saying "let's go to ISO 27001," you've never looked into it, you're about to find out it's a huge, encompassing business information thing. It's pretty big, and Jason's the one to help you get through that. But I definitely wouldn't say take it on yourself. The more technical ones, the ones that you can take to your customers, in terms of "right, we can make some checklists and I can do some things" — I'd say the NIST in that regard.

So ISO is largely about protecting the information that's coming in and out of your business, right, all of your information assets, where you're storing information, all of your clients' personally identifiable information, all of that kind of stuff. So it is largely around securing information, where some of those other standards are more highly technical and more on the technical control side. But they are very different.

Yeah, and like they all have similar things, right. We talk about controls a lot — you just said the word then, that's what triggered it for me. And Andrew, you spoke about having training every 14 days, that's awesome, but it still doesn't stop someone clicking on something, it definitely minimizes the risk a bit. And all these frameworks, when you go into them, if you start looking, they'll talk about all the controls you need to have, but then the detection, and then the response, and all these things are really important. That's why I love — if you've never done any of this, look at NIST and look at the five top pillars and just start to get your head around that, because I think that's a really good starting point.

So that's identify, which is identifying your assets, so understanding what you have. Protect, and that's generally where the MSPs and the IT people go, you think of protection such as backups and your antivirus and all those types of things. Detection is the next one, so that's really that 24/7 security operations center stuff that probably gets a bit scary for a lot of the smaller MSPs out there. Very easy ways to do it now, but that's where that MSSP world comes in, I'm into that detection. Your response is obviously how you actually respond when something goes wrong, and that's, in my opinion, almost the most critical part, because you do everything else right, but then you don't actually have a plan for when something goes wrong, then what do you do? Just close your eyes and run around while the house is on fire? So that's important. And then recover, and that's how you recover after the event. So that's why I really like those five pillars, because it gets your head in a really good framework to then help with your insurance and your ISO and everything else that comes along the way.

So to touch on Jason's point earlier, I think it's important that it's not just the top-down person, it's the whole organization understands those, you know, making sure it's clear and concise.

Getting Started with ISO: Gap Analysis, Audits and Certification vs Alignment

So staying with the ISO piece of it, what are the first steps, if we're going to go down that certification path that sounds like many MSPs are going to need to, to build that maturity within their business? What are the first steps?

Generally it's to get in there and see what you've got already, right. A lot of MSPs are running really successful, great businesses — that doesn't happen by accident, it's because you've already invested so much time creating certain policies and making sure that, you know, when a new user starts at your MSP, that you're not just copying the last person that started and giving them their permissions. If this is how you're running your MSP, you're going to be in for a rude awakening very soon, unfortunately. But I know in my heart, I'd like to think, that everyone on this call isn't doing those sorts of things.

And so, as far as where do you start, you just need to figure out what you've got already, and then figuring out what your gaps are. There's always gaps, because, like Aaron was saying, ISO 27001 is all-encompassing, it is quite a large standard. And so gaps might be in the form of, you might see a lot of your risks, but you're not documenting those risks, and then you're not actually mitigating those risks if you can, or you're not treating them, and you're not actually having discussions with your leadership teams and management about actually, you know, what are we doing about XYZ that's happening in the market. So it actually does increase your posture over time, once you get used to operating within the standard itself.

But essentially, going back to starting points, you'll have a lot of stuff already, you just need to figure out what your gaps are, and then you essentially go through a two-stage auditing process. So you go through a stage one, which effectively is an external auditor coming into your organization and just making sure that every policy and procedure exists, so that the management system is complete. So stage one is just about writing, it's all documentation. And then shortly after that, if you pass your stage one with flying colors, there's no non-conformances, then you do your stage two, which is effectively external auditors checking for evidence within your organization that you're actually doing what you're saying that you're doing in those policies.

So if you say that you're training every team member when they come on board in XYZ, well then you want to have a record of that, you want to show that when this person started in July of 2023, that they went through an ISO onboarding session and they were told about their information security requirements for them as an employee, and how seriously you take it, and things like that. And so once you pass stage two from an evidence perspective, you get your certificate, and then from there it's basically 12-month external audits, which are called surveillance audits, and you dive into that each year. But it's not as hard as what the market has led everyone to believe. It is difficult, but like everything, as long as you've got the right help or the guidance or the resources, you'll be able to achieve it, there's no doubt.

Okay, I think that's really valuable. I know when we first started to look into ISO it was kind of like, where do you start? And one thing I thought was interesting, and Aaron touched on before, which I made a note of, the difference between aligning to an ISO standard and actually being certified. Can you run us through what the differences are?

Yeah, so you can, on an insurance form or on a supplier form, tick that you are aligned to ISO 27001. That basically means you've done all of the hard work, you've got your policies, you believe that you're running the system the way that it should be, but you haven't had an external authority or external auditors come in and give you that ultimate stamp of approval. So aligning, compared to being certified, means you're saying that yes, we have it, but it's not certified, right. There is the risk with being aligned and not certified, that some MSPs in the past have found that it might be an easy way to save on some auditing fees and just say that you are. But if you're saying that you are but you haven't been certified, it's a red flag as it is, because if you're aligned truly, then you would be absolutely mad not to actually go ahead and just complete that process and get your certification. So alignment is a little bit of a red flag, from an ISO 27001 perspective.

And Andrew, from an insurer's perspective — Jay's in touch with them, but from an insurer's perspective — is that a red flag as well?

You know what, there's all these different insurers with different requirements. Cyber insurance is a relatively new insurance, it's not very mature, it's like a teenager that's a bit pimply and does their own thing. It looks like an adult but inside they're just a five-year-old child. And so there's lots of variation. This is unlike, say, professional indemnity or public liability insurances that are very mature, being around for, you know, 100, 150, even 200 years. So there's lots of variation, each insurer takes a different view. But it's back to the insurance that you can't now get — if you use the ISO stuff as part, and you say "hey, we're ISO certified," and there's a whole bunch of other things that we do to mitigate the risk, because keep in mind, there's no one silver bullet. Insurance is not a silver bullet, ISO is not a silver bullet, the detection stuff that Aaron has, that's not. But the combination reduces your risk of taking a hit, and that's what it's all about, that's the key to it.

So for us, from an insurance specialist, we have to paint the picture to make your risk look good to be able to get offers from markets and get it in place. And where it's becoming more important is, what we're seeing is, particularly big end of town, they're requiring you, as an MSP, to carry cyber insurance to be on their panel. So whether you like it or not, if you want to play with a Qantas or a Rio or others, you need that, and then you need your insurance specialist, whoever it is, to help you paint that picture to secure a policy to enable you to do business.

So that's interesting, because I think everyone on here has seen on one of their — if they've gone for credit terms or whatever it might be, you've got to actually put down, is it your PI or however much you're insured for, or whatnot. So it sounds like that's going to be one of those extra questions where you've actually got to sort of list down your coverage on that as well eventually.

Absolutely. And it's only going one way, that way, up.

Yeah, insurance is just becoming enormous, it's getting worse. And look, I'd encourage everyone on the call, don't try and figure it out yourselves. That's what we want to present you guys with, a couple of different experts here, and there's plenty of them out there. There are risks, but there's also margin to be made as well, right. So wherever there is a risk — but with that, that brings us to time, guys.

So I just wanted to say a huge thank you. It's been an absolute pleasure having you guys on the call. It was very, very engaging, I had plenty of questions today, which is always good to see. If you guys do have any other questions from the audience, feel free to shoot them through. We will be sending around everyone's details, we've got some assets that we'll be sharing as well, so make sure you check those out, and if you have any questions, let us know.

Just quickly, put up our upcoming events, so our next MSPs in Conversation, hopefully we can see that on April the 18th, is our next one, which is streamlining your MSP operations, best practice tools for increased profitability. So very exciting. The other ones are subject to change, but April 18th is 100% locked in. As always, if you've got a topic that you would like us to bring to you guys, please let us know. Meryl, our marketing manager, is always excited to have that chat, so feel free to reach out and let us know. Again, guys, thank you so much, it's been a pleasure. Thanks everyone. Jason, Aaron, Andrew, cheers, see you guys.