The question often arises: Is monitoring logs from workstations worth it? While servers, firewalls, and other high-value assets are typically on the cybersecurity radar, workstations often fly under the radar. For MSPs, when advocating for monitoring workstation logs, many clients express concerns.
Let's explore whether it is worth monitoring workstation logs and delve into the common complications faced by MSPs when convincing their clients to invest in workstation log monitoring. By understanding and addressing these challenges head-on, MSPs can enhance security and effectively communicate the significant benefits to their clientele.
How Do You Communicate the Importance to Your Customers?
Overcoming Objections
Common objections we hear are about domain-joined workstations; they are already monitoring the servers, so why bother? Also, with remote work challenges, they are already on a VPN, so why bother again? And, of course, the potential costs of vendors charging by the endpoint. Instead of a rigid answer— yes, you should monitor workstation logs, or no, you shouldn’t — let's consider risk appetite.
Risk Appetite to Understand Benefits of Workstation Log Monitoring
To overcome objections, start by identifying scenarios detectable only by monitoring workstation logs. Once you and your clients know this, you can make informed decisions based on their specific needs and risk appetites, as every organization has a different threshold and there is never a fixed answer.
What Can You Detect?
The kinds of workstations we typically look at for detection include Windows OS, MAC OS, and Linux:
- Windows OS. Detect user logoff times, executed programs, PowerShell launches, offline access attempts, and removable media usage.
- Mac OS. Provides insights into system integrity, logon/logoff activities, and user account management.
- Linux. Offers monitoring options for authentication logs, brute force attacks, and package installations.
Once you know what workstation detections are possible/meaningful and understand that, bottom line, they help detect and disrupt attacks faster, you can make more informed decisions.
Business Value to MSP
The business benefits of monitoring workstation logs for MSPs extend beyond cybersecurity, encompassing client satisfaction, regulatory compliance, and revenue growth.
The Takeaway
It’s important that we educate decision-makers about why endpoint security and audit logs from endpoints are so crucial. We have to move beyond the mainframe-inspired mindset that security only matters on centralized systems where critical data resides. Regulatory compliance may necessitate workstation log monitoring, and you can tighten your security procedures. However, your mileage may vary, depending on your organization's and client's specific needs and existing security measures.
Workstation log monitoring is a potent tool for MSPs to enhance cybersecurity efforts. By addressing objections, understanding the unique insights gained, and emphasizing the value for both security and compliance, MSPs can communicate the benefits effectively. As the cybersecurity landscape continues to evolve, staying ahead with comprehensive log monitoring practices is a strategic move that not only protects clients but also contributes to increased revenue and business success for MSPs.
Check out a short video with more information about how monitoring workstations boosts your overall security posture.
Need help monitoring your client's workstation logs with the help of a 24/7 SOC? Check out Netsurion’s Managed XDR and Npower Partner Program for a comprehensive solution to meet you and your customers' goals.
Blog courtesy of Netsurion. Read more Netsurion guest blogs and news here. Regularly contributed guest blogs are part of MSSP Alert’s sponsorship program.
