The line between IT and security is blurring. For decades, you could clearly delineate the two—network engineers and IT professionals worked together while security teams practiced their own specialization. In many enterprises, we still see specialized groups and roles.
Yet, for IT service providers, customers don’t draw this distinction. Customers look to IT providers to be business partners—they want them to enable their business operations and work as expert consultants to help them achieve these goals. This also means protecting them from risk. Even if service contracts don’t explicitly delineate security offerings, customer expectations often implicitly assume the services provided will include some measure of security.
While there certainly are customers who seek out more sophisticated services from full-blown managed security services providers (MSSPs), managed services providers (MSPs) increasingly fill the role. Today, we’ll talk about the trends causing this line to blur and how MSPs can adapt.
Key trends
While IT providers traditionally focused on enabling business and keeping their end customers’ infrastructures up and running, many have found themselves increasingly in the security business. Let’s look at a few reasons why:
- SMBs don’t draw distinctions: While some businesses may understand the difference between IT and security, many won’t draw a distinction. For many, it’s all interconnected. They expect their IT service providers to handle all things IT. If a breach occurs, the first group they’ll turn to will often be their MSP. Plus, customers pay you to keep their businesses running and their teams productive—if they face downtime or network slowdowns, they won’t care if the root cause is security-related.
- SMBs are targets: While some cybercriminals target larger enterprises, many see SMBs as low-hanging fruit. They don’t care about hitting a large target, they simply want the data that will make them money. Smaller and midsized businesses can sometimes lack the security firepower of larger companies (although, this doesn’t always have to be the case). Add to this the fact that cybercriminal tools are easier than ever to get on the Dark Web and you have a recipe for a lot of businesses falling prey to cybercrime.
- Increased regulations: Over the past few years, we saw a proliferation of data regulations like the General Data Protection Regulation (GDPR) in Europe and the California Consumer Privacy Act (CCPA) aimed at improving consumer privacy. Many require prompt reporting of data breaches to authorities, which can harm a company’s reputation. Plus, data breaches can lead to stiff fines that could seriously hobble an SMB.
- MSPs have become targets: Criminals have increasingly turned their attacks toward IT service providers. That’s why an MSP’s internal security plays a role on their end customers’ security postures.
Key steps to take
As this line has started to blur, it’s important to take consistent steps to help keep your customers safe.
- Keep up with cyberhygiene: Strong security starts with the basics. Patching regularly prevents a lion’s share of threats. Running backup on a regular cadence—and testing for recoverability—keeps your customers’ data recoverable after a ransomware incident. Deploying an email security gateway can help boost protection for your end customers (particularly as most attacks come via email). You’ll also want to protect their workstations and laptops with strong endpoint protection. It’s worth looking beyond antivirus here—with many attacks being aimed at bypassing traditional antivirus (AV), getting a good endpoint detection and response solution can help you prevent a much wider array of attacks at the endpoint level. Protecting your customers with basic cyberhygiene isn’t bulletproof, but it can greatly reduce their risks.
- Protect your own house: As we mentioned, with MSPs becoming the focal point for many cyberattacks, you should make sure your own house is in order. If anything, your security needs to go beyond what you provide your customers. For starters, make sure you practice the same hygiene techniques you offer your customers. Additionally, while using strong passwords matter for your customers, they’re potentially even more essential for your own technicians as an account takeover at your own company could cause a breach for multiple customers. Beyond that, you may want to take additional steps to protect your own systems by periodically getting risk assessments or penetration tests done. It’s your business—it’s worth stress testing your security posture to reduce your own risks.
- Look for tools to support both security and IT: Part of running a profitable IT service involves boosting your team’s efficiency. This means looking for tools that can help you both manage and monitor your end customers’ infrastructure while also helping you protect against cyberthreats. Many RMM vendors have expanded their built-in security features to allow you to offer those features from the same dashboard as you offer the rest of your services. Streamlining the toolset your team uses can pay dividends in terms of both productivity and security.
Simplifying IT and security
As the line continues to blur, IT service providers will have to continue strengthening their security offerings. It’s no longer the province solely of the MSSP.
SolarWinds® N-central® helps IT service providers offer strong security from the same dashboard they use to manage the rest of the IT services they provide. In particular, N-central includes SolarWinds Endpoint Detection and Response (EDR) integrated within the dashboard. EDR uses AI and machine learning to help detect and prevent even unknown threats at the endpoint level. It can even automatically roll back an endpoint to a known safe state after a ransomware incident. Plus, with SolarWinds EDR integrated within SolarWinds N-central, your team won’t have to waste time switching between systems to keep customers protected. Learn more about how it can help you by visiting the site today.
Guest blog courtesy of SolarWinds MSP. Read more SolarWinds MSP blogs here.
