Be Proactive Amid Growing Cyber Security Concerns

Over the past few weeks, we’ve all been paying very close attention to the events unfolding in eastern Europe. As an individual, it’s heartbreaking to see a war break out and the impact it’s having across the region. We know that cyberattacks are now a part of war. We also know cyberattacks can be targeted, but also have the potential for unintended consequences and increased impact as they can spread outside of the initial target. Just last month, President Biden issued a statement on cybersecurity. As security professionals, our guard has been up, and this statement should cause us all to elevate our awareness around a potential cyber threat.

I’m sure our partners are asking themselves a lot of questions:

• What does that mean for me and my customers?
• What should we be doing?
• How do I know if I’m prepared?
• How do we know if an attack is more widespread?
• Will my cyberinsurance cover an attack right now?

And I could go on and on with everything that MSPs and your customers are worried about.

Where should you focus your attention

So where do you start? The answer to this is keep it simple. Focus on enhanced awareness and vigilance. This is nothing new for us during these current times. For anyone who has wanted to travel during COVID, we’ve been receiving updates from our local governments regularly on the risks associated with traveling to various destinations. Our awareness around travel has increased and, especially right now, we need to ensure that our awareness around cyber threats is increased.

The news has been hyper-focused on physical battles that have continued for weeks but, until this week, there has been less focus on cyberattacks. There are a few resources, which are freely available to anyone, where you can ensure that you’re staying on top of what’s happening in the cyber world. A few include:

• US-CERT—Provides detailed alerts around threats, vulnerabilities, and exploits.  You can subscribe to their email notifications to have this information delivered as it’s made available.
• National Cyber Security Centre—The UK cyber security center provides cyber news and advice.
• CERT-EU—Provides detailed information on security advisories, vulnerabilities, and exploits.
• SANS Storm Center—Here you can find new about threats. They provide threat feeds as well as several other tools and resources for security professionals.

There are several other valuable resources you will find particularly useful to you as you become more in-tune with cybersecurity news.

7 Better Business Practices

Since the MSP, and the small yet strategic few of their vendor partners, are usually the ones out front for the IT security of small and midsize businesses and enterprises, I wanted to share these seven better business practices around security gleaned from our team and our partner community. They can quickly be repurposed for business leaders and security executives to:

1. Adopt a zero-trust strategy to IT security. Note the word strategy. Zero-trust is not a solution. It’s an approach—a principle to how best to protect the business.

2. Don’t overlook the simple things including email protection, access management, secure cloud backup, and multifactor authentication (MFA) on all business applications.

3. Spend time, a lot of time, educating your team and your customers to better understand cyber risks and how to protect themselves, the company, and their customers. Build a plan for how to respond and test it in a safe environment.

4. Use the right talent and technology to secure a clear and ongoing view of any and all known, and potential, vulnerabilities within your business, your customers, and third-party alliances.

5. Recognize that the new normal will not always include an office. Embrace technologies including endpoint detection and response tools to stay ahead of the next cyberattack and extend the protection beyond the office.

6. Focus on prevention, but also on recovery planning. Make certain customers have what they need to recover as fast as possible and know what to do when it happens. Again, play this out with business continuity planning and war room practices.

7. Don’t default to “no” when customers want to introduce new applications or gain access to something within the network. Instead, use the opportunity to better understand what it is they want to do and how you can collaborate and find an effective solution together.

And remember, there’s no silver bullet or single solution set to solve for IT security at scale. If there was, more MSPs and security officers—myself included—would be working beachside with an endless bucket of beers. But the fact remains: There is always more we can do to better protect ourselves, our people, our customers, and our connected ecosystem.

Dave MacKinnon is chief security officer at N‑able. You can connect with Dave on linkedIn here.