Day 2 coverage can be found here.
Welcome to our semi-live blog coverage of Right of Boom in Las Vegas.
This is the third annual event with an all star lineup of speakers addressing the challenges MSSPs and cybersecurity-centric MSPs as they defend against threats.
Andrew Morgan is the owner and visionary behind this event. MSP Robert Cioffi is the masters of ceremonies for this year's event.
We'll be updating this blog post throughout the day, so check back often.
Opening Keynote: Embrace the Suck and Leadership with Brent Gleeson
Brent Gleeson, CEO of Taking Point Leadership, a management consulting firm, and author of Embrace the Suck (a book that inspired Right of Boom show owner and organizer Andrew Morgan), opened the conference with a keynote address.
His talk on leadership, culture and teams embodied the principles he lived and learned during his time in Navy seals training and his Iraq deployment. He talked about mindset, behavior, adherence to values. How we prepare ourselves to show up every day, trust and accountability are two most important pillars of highest performing teams in the world, he said. Organizations must iterate and capitalize on growth. A continuous state of discomfort is important to continuous improvement and growth.
True champions do not obsess over the goal, he said. True champions focus on having the right systems, processes, methodologies to get them to the achievement of those goals. The question to ask is do we have the right systems in place?
To determine the trajectory, ask yourself, five years from now, if our company was on the front page of a magazine, what would that article say? Then figure out how to grow and scale.
Right of Boom: Threat Actor Initial Access Techniques
Aaron Goldstein, incident response leader at Todyl is talking about the initial access techniques used by threat actors. Here are some of them, and phishing continues to be big.
Phishing as a service. Goldstein says you give them email addresses and they will do the rest. One of these providers even offers a one-day free trial so you can check out their threat services before you buy.
MFA fatigue attacks. Sometimes called MFA bombing, this attack is when the threat actor already has the stolen user credentials and they spam the victim continuously with MFA requests. You keep hitting no over and over, but you are getting annoyed. Then you get a phone call from your company’s IT and they say, just accept the next MFA request and we’ll take care of it for you. But it wasn’t your IT department. It was the threat actor. Goldstein reminds us, almost any organization can fall victim to a cyberattack.
Pirated, Illegitimate software. Maybe you wanted to download the Grand Theft Auto VI preview, but that preview is not legit. If you are getting something for free, you are probably going to be compromised.
Social engineering and fraud. Sometimes this comes in the form of a phone call from “tech support,” or even “Microsoft tech support” and most people want to help out the “technician.” There’s also been a spike in fraud around fake employer and employee scams. “Hey would you like a job? fill out this form, and I’ll get you in with this very large company.”
Data Dumps and leaks. This includes password dumps sold on the dark web.
The attackers’ point of view. From the attacker’s point of view the easiest targets are those that don’t have MFA enabled. Other easy attacks include credential stuffing attacks, standard phishing attacks, and brute force attacks.
Moderate difficulty attacks include those when users have MFA enabled, MFA fatigue attacks, those based on single sign-on misconfigurations.
High difficulty level attacks include social engineering attacks and SIM swaps.
To protect the technology estate, Goldstein recommends MSSPs focus on the following:
Right of Boom: Secure Onboarding
Karl Bickmore is presenting a business session about Secure Onboarding. He is CEO and one of the founders of MSP Snap Tech IT and one of the founders of Raven Automation. He’s an advisory board member for Sophos and a Connectwise advisory board member alum.
Bickmore evolved from a less structured approach for asessments and onboarding to an approach incorporating frameworks and best practices including using NIST CFS questions.
Bickmore is an advocate of charging for assessments before onboarding. He arrived at that approach after a project that he initially scoped and priced to take 60 hours ended up taking 450 hours.
Initial assessments consist of the following:
Following an assessment he creates an MSA (master service agreement) and an assessment document and presents them to the client as separate modules.
When he arrives at the actual onboarding portion he has the following:
Here’s Bickmore’s math for pricing onboarding and assessment:
Bickmore said his philosophy on the business side of this is to maintain 40% labor gross margin at minimum on assessments, onboarding, offboarding and remediation projects.
When onboarding, Bickmore said it’s a good practice to assume the client is infected.
Bickmore’s company tells clients the stack of services they are getting, unless they opt out. Hardly anyone opts out, “so stack alignment is great. The problem before was me thinking that the customer didn’t want to pay for this.”
Who runs Bickmore’s onboarding:
How do we improve on our project templates? Document, write it down, and then have a constant improvement process.
Right of Boom: Vulnerabilities
Christopher Henderson, senior director of threat operations at Huntress, and previously senior director of information security at Datto, presented on Vulnerabilities.
Vulnerability is defined as a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
Vulnerability types:
Zero days are terrible because there is no patch, Henderson said. N-days are where cybersecurity pros can manage vulnerability and can be preventable through updates and patching. Organizations manage N-days and prepare for zero days. Conducting regular inventories is how organizations prepare for zero days.
Henderson noted that the Citrix Bleed Zero Day had a 14-day timeline, and the ConnectWise ScreenConnect a few months later was much shorter.
“The timelines you have will shrink," he said. "You have days to hear about these and patch. There’s not always patches available. Sometimes you will need to take a critical business system offline.”
Tom Millar a CISA vulnerability management branch chief, joined Henderson on stage and discussed the work his group has done creating checklists and other tools for organizations. For instance, his team manages cybersecurity performance goals and offers a checklist of 38 practices that it recommends everyone applies to their systems and organizations, including operational technologies and applications in industrial control environments.
He discussed Secure by Design, which is designed to move cybersecurity responsibility from the end user up to the vendor... “the end user is the least clued in.” Millar also discussed the new initiative from the White House encouraging the industry to use memory safe languages.
He said MSPs should look for Secure by Design vendors by asking for a Software Bill of Materials (SBOM). Once they get an SBOM, look at the OS version. If it’s 10 years out of date, don’t buy that product, he advised.
Chip Buck, co-founder and CTO of SaaS Alerts, presented on business email compromise (BEC): how to spot it and mitigate it
BEC is an unauthorized entity gaining access to a business email account and use that access to impersonate the legitimate owner of the account.
What is BEC?
What’s the scale of a BEC?
Data breach facts:
Common BEC scams:
Who is the attacker?
TTPs — how are accounts attacked:
What’s at stake?
“Microsoft will not be liable for any loss that you may incur as a result of someone else using your password or account, either with or without your knowledge. However, you could be held liable for losses incurred by Microsoft or another party due to someone else using your account or password. You may not use anyone else’s account at this time without the permission of the account holder.”
Protecting against BEC
Right of Boom: Performance and Alignment
Gary Pica, former owner of two MSPs, founder of TruMethods and leader of the TruMethods peer groups, presented on Performance and Alignment.
Pica recommends setting clear expectations with customers around responsibilities. The MSA is a piece of it, but conversations are important too. Conversations were always important, but they are way more important now that security and risk have become a central part of the mission.
A big question about cybersecurity services is always, How do you show the customers ongoing value of services?
Here's how:
Packaging and pricing has become more complex today.
If you can’t get the right commercial relationship with your customers, you won’t be able to deliver. You’ll have a math problem.
Core stack offering:
Premium offering:
The average MSP has 40 tools, there are some that have 60. You have to understand all the costs that come off them.
