The MSP Zone

My Thoughts on the CISA MSP Advisory

CISA published their advisory bulletin addressing risk considerations for organizations thinking about using managed service providers. This is a great advisory, but it has some areas of potential misinterpretation in it, chiefly because CISA has departed from a security group and expanded into territory in which it has little experience.  
Highlights:  
What if organizations stopped using MSPs?  
Yes, all customers ought to be responsible and consider risks of outsourcing. But, risks of not managing IT are far greater than the risks of outsourcing 
Targeting of managed services supply chain vendors is NOT a symptom of poor MSP security, it's a symptom of the unchecked business of cybercrime 
MSP Zone Reading Material: Risk Considerations for MSP Customers | CISA 

Can You Survive Without Managed Services

It is a question we used to get often during the early days of managed services. Particularly, when organizations did not fully understand the requirements of owning IT infrastructure. To be sure, cyber threats, the complexities of managing IT, and the overall reliance on IT for business operations was must different back then compared to today.  
 
Today, however, it may seem odd to ask the question "do we need managed services?" Perhaps a different question would be more appropriate "can you survive without managed services?" 
 
Highlights:  
Vendor management 
Cyber Threats 
Scarcity of people, technology, and process 
 
MSP Zone Reading Materials: 
https://www.ilounge.com/articles/why-do-modern-businesses-need-managed-it-services-today 

The MSP Legislation We Need

There has been a lot of discussion concerning the MSP regulation our profession should have. Standards for MSPs, cyber practices to reduce the number of cyberattacks, etc.  
 
Instead, I’d like to turn the conversation into the type of legislation MSPs actually need. There are laws that would make the job of the MSP (and the benefits they provide to clients), more accessible. Those are the laws that should be enacted, not laws that make being an MSP more difficult.  
 
Highlights  
Pass laws that make being an MSP easier, not more difficult
Alignment of MSP and customer goals
Shrink the chasm between MSP practices and client behavior 
Education of the role managed services has in the global market 

MSP Service Catalogs in the Age of Cloud

How should your managed services catalog change, if at all, when delivering your offerings in the cloud? How can you use your updated services catalog to improve your sales and service delivery process, along with reduce your overall MSP risk?  
 
Highlights 
What is a service catalog? 
Does the catalog change with cloud service offerings? 
How does the service catalog interact with the service agreement? 
 
MSP Zone Special Guest: Rob Scott 

How to Have the "Ransomware Conversation" with Your Clients

Every MSP needs to have an important conversation with their clients about cyberattacks and ransomware. These conversations don't have to be difficult, but they have to happen. Here are my thoughts about how you should approach this discussion and how you can use it to change the relationship you have with your customers. Who knows, they may even thank you for it. 
Highlights:  
There is no right time to have it, just make it happen 
Don't avoid the news 
Talk about your expectations for their cybersecurity 
Tell them how you are protecting your MSP practice 
Practice business disruption scenarios with them  

MSPs Are Responding to Ransomware Attacks

In the aftermath of recent ransomware attacks on software companies used by MSPs, the question of how do we respond as a community is, and should, be asked. Some believe that more legislation is the answer. Maybe they are right. But, it would be a grave mistake for any legislation directly involving MSPs to be undertaken without first understanding what measures already exist to protect MSP and clients alike.  
MSPs are responding to the ransomware epidemic. Here's how.  
Highlights: 
MSP Verify  
Leadership council 
Insurance 
Vendor certification 

How to Fix the “Secretive” Reputation of Cloud Providers

"Secretive" cloud providers have a problem. So do the MSPs who use these cloud providers. Fixing the issue of secrecy and lack of transparency is important to the non-IT world and we must address it now.  
Highlights:  
Cloud vs MSP Transparency 
SaaS & Vendor Transparency 
Applying Existing Standards 
Bank of England to crack down on 'secretive' cloud computing services | Reuters 

The Difference Between Internal IT and the MSP

What's the difference between internal IT departments and managed service providers? There are some important distinctions which define the relationships between internal IT and the external MSP. Understanding those differences can improve how both interact with one another. 
Highlights: 
MSPs have to face a more diverse set of users, ecosystems, and threats. This diversity makes the MSP a far more knowledgeable organization than the vast majority of companies (even those with an internal it department) 
Access to Tools – MSPs, by necessity, use a variety of tools not typically seen in the internal IT department. These tools typically associate themselves with scalable, one-to-many styles of service 
Experimentation. MSPs see things on a more expansive scale than internal IT departments.  

MSP Tool Decentralization

It was almost an inevitability that MSPs would begin to rethink their procurement of managed services enabling tools in the wake of the Kaseya ransomware attack. Sure enough, we are starting to hear from MSPs telling us that they are reversing their previous strategy of consolidating tools around big four MSP tool platforms.  
Highlights:  
Should MSPs decentralize?  
How will this impact the MSP market?  
What advice do we have for MSP platform vendors?  

Defining MSP, MSSP, & SOCaaS

What's an MSP? What is an MSSP? What is a SOC? These terms are common throughout the managed services community but often have overlap and can cause confusion. We will explore these terms and examine how they often present themselves in everyday business scenarios.  
Highlights:  
Defining MSP, MSSP, and SOC (including SOCaaS) 
Business characteristics of each 
Common overlaps