Blogs

Good on paper and great in theory, dedicated Managed Security Service Providers proclaim to have a business’ back. Until they can’t. Nick Sone, Chief Customer Officer, explores why a plethora of providers muddies the waters when threat actors knock, why the technology convergence gives MSPs the fighting edge in cyber defence delivery, and how to avoid the blame game when things go wrong.

The warning lights are blinking red. And a client is losing their mind. Bombarded with 1,000’s of failed log-on attempts, from an internal VPN interface on their main firewall against a domain controller, the client’s ‘specialist’ managed services security provider (MSSP) has missed an enormous security breach.

Maybe it’s because the all-out assault occurred in the small hours of a Sunday morning. But it’s now Tuesday, a full two days later. And the MSSP? Still MIA.

This is no drill, but a real incident that recently affected one of our clients. Had they also been our security partner, the response would have unfolded very differently. There’s no way we would have missed a brute force attack. Even at 3AM on a Sunday. And we hadn’t.

As their managed service provider (MSP), we had spotted the incursion, flagged it within minutes, and recommended a clear course of action. Regrettably, that was all we could do within our purview. Given full jurisdiction of their security controls, we’d have instantly blocked the attack, initiated emergency changes, then conducted a rigorous and coordinated post-incident investigation, rather than leaving the client hanging in the wind.

The emergence of convergence

There’s long been an argument that having specialised security providers offers copper-bottomed, gold-plated surety. That MSPs are only ever good for baseline security. That security shouldn’t be rolled up into broader MSP agreements. That MSPs shouldn’t be marking their own homework.

But when I hear of the security failings taking place on an MSSPs watch (and the one above is no isolated incident), and then think more broadly about the incredible convergence of security and technology we’ve witnessed in the past twenty years, the more sceptical I become of these claims.

Subjects that used to command boutique skillsets – be it a vendor for endpoint, a vendor for networks, or a vendor for applications – now operate as consolidated platforms.

Skills once seen as mystically complex have now been greatly simplified. These days, technology is far more capable, far simpler to use and work with, and far easier to respond to. And as the technology has simplified, the skills and capabilities of MSPs have grown.

A recipe ripe for conflict

Incident detection – once the bread-and-butter of an MSSP – is, by-and-large, now detected through technology and automation, rather than human intervention. All an MSSP can do is alert an organisation with the problem, potentially run a scan, and possibly isolate a machine. At that point, the ability of an MSSP to do anything of tangible value runs out.

Issues are inevitably handed off – be it to the client, their MSP, or, in some cases, multiple MSPs – and the solving (rebuilding Active Directories, networks, key infrastructure, and applications) is then shouldered by the MSP.

But in our experience, that’s not before fireworks and frustration. There are plenty of examples of MSSPs siloed in security, with an MSP working on everything else. But we rarely see it working as efficiently as if one organisation was handling it all. When it goes wrong, it’s a relationship ripe for conflict.

Defusing the blame game

“Who does what?”. That’s really at the core of this. When no-one is clear, it’s the client who loses out. The blame game gobbles up time. Inertia takes hold. And it’s those delays threat actors love. It simply creates space to seed more chaos, more destruction.

When incidents arise, we’ve seen clients unnecessarily involved in ugly dispute management and conflict resolution. It’s a bad look for everyone. And for business’ who assumed everyone knew their role at the outset, it’s stressful, frustrating, and costly.

But rolled up into a single provider, an MSP can detect, respond, and recover, all within the remit of a single business. One account team, one delivery manager, one organisation. It simply dissolves inertia. When handed the responsibility for everything – infrastructure, application security, network – an MSP can proactively coordinate a collective response, bringing in teams, and deploying fixes, rather than sitting on their hands awaiting further instructions.