Dictator 2024 | Cybersecurity Innovator | CISO | Keynote Speaker | 2020 Cyber Educator of the Year | Board Director
Last night a friend shared with me a pretty egregious post from someone who bought into some vendor hype. Without fact checking. Oof. Sounded good. Promises of a breach-free life. Ain’t gonna happen and anyone with a modicum of experience knows it. Why do we keep falling for the latest vendor hype in cybersecurity? Every time I turn around, it’s a new tool, a new platform, a new magic solution that’s supposedly going to fix everything. But let’s be real—none of that’s going to save you. It’s not about what’s in your stack. It’s about doing the hard stuff—like following frameworks, building maturity, and sticking to good cyber hygiene. The basics work. NIST, CIS Controls—those are proven. But no one wants to put in the grind. Most MSPs just want to write a check and feel secure. And clients? They don’t think they’re a target. They don’t believe the damages will cost much, so they don’t see the point. And we’re stuck in this cycle. So here’s my question: If you could change one thing in our industry to break this pattern, what would it be? What’s the #1 thing we need to focus on to actually start fixing this?
I am not one of the “MSP Insiders” so my opinion may differ and I hope no one gets insulted, I at times tend to be blunt, which is excused for us elderly folks. My experiences differ somewhat since I do some consulting with legislators in CA around “what to do to control the IT business”. My company sits on the outside of the normal scope which is providing IT services and in many situations is a brokering of vendor solutions. I have for many decades heard us use numerous marketing terms “trusted advisor” or the new popular one(s) MSP and MSSP. Note MSP or Managed Service Provider was coined by a HVAC company decades ago in CA. When queried by legislators and AG in CA discussions I was asked so what is an MSSP and I responded someone who need to increase their self esteem by adding an S. Now - to the core of the issue for those outside of our industry. How do you become a provider? Self declaration was my response. From a legislative prospective they understand go to an accredited school, get a degree, pass a test (bar exam is what most legislators understand), get a license and become regulated and engage in continuing educaiton. I was asked so what training and education does your industry provide internally?
Roland Gharfine
3mo
Good old risk management. People who claim "security" in their title should at least have that know-how.
Bob Miller
3mo
Put the accountability with who actually owns it. Customers need to own their decisions and the ramifications. Including pretending they DONT HAVE a problem. Providers need to own their performance of their duties. Claim to be an MSSP? Then own that process if you fail to deliver on basic controls for your customers. Psst: that means YOU have to have your basic controls in place!, Government needs to own the fact that not only does it not adopt the level of controls they are busy requiring everyone else to implement, but are willing to develop legislation without those that DO the work at the table to keep them from hurting more than helping. Vendors need to own what their product does and how they talk about it in terms of marketing. And EVERYONE needs to own not misrepresenting the facts. So my one thing is Put the accountability with who actually owns it.
Keith Fast
3mo
The MSP community, as well as industry, puts too much faith in software tools for security. Ask yourself, “What would I do if there were no security software solutions?” Our primary options would be adoption of proven security frameworks, controls, and policies. So instead of buying new shiny things, how about we go back to the proven basics, then add a very short list of best of breed security solutions to backfill the gaps.
Brian J. Weiss
3mo
Getting everyone to start talking about the fact that security frameworks are designed to protect data and actually look at users and devices as cattle? The MSP channel needs products that are easy to sell. Selling security that focuses on users & devices drives a narrative that they should be the focus when it comes to a good security posture. This is broken. Most MSP's don't have a good grasp on where all their client's data lives, leaving gaps in their security posture when they focus primarily on users and devices. Understanding where all your client's data exists is the first step before you can really develop a decent roadmap to achieve a good security posture. The problem? The minute you sell security that focuses on protecting the client's data, it is MUCH harder to sell both from the MSP vendor perspective, and the average MSP who isn't having the right discussions with clients, or properly identifying where all their data lives. I find most of the guidance given in the MSP channel tends to be around "what's popular" vs. "what's right" and there is a lot of ego stroking that causes echo chambers to be created where people sleep better at night just because what they are doing is the "popular choice."
Kyle Christensen
3mo
This “friend” meant well and was very right in ideals. Sometimes our passions don’t read well on the internet as our comments lack the detail that our brains can type quickly. And honestly, we’ve all done this. That being said, marketing and growing a business walks a fine line of failure, BizDev, and success. ‘Fake it till you make it’ is almost required, but at what risk and reputetional cost? “You don’t know what you don’t know” and hindesite is a fickle mistress. What path would you choose?
Chris Cronin
3mo
1. Understand why every regulation and standard requires risk management. Prioritize your efforts and resources on the most likely, most damaging scenarios (hint: this is not maturity scores, it's R=IxL). 2. Include the risk of harm to others in that risk analysis. The lawyers and regulators come after you when you don't address risks to their constituencies, not when you harm yourself. 3. State your risks in business terms, whether using qualitative or quantitative risk analysis. 4. Show executives the risk and state the resources and time you need to reduce those risks. Do not invest more on any control than the risk associated with that control. This is what the law calls "reasonable." 5. Show executives your plan toward reasonable risk using the resurces they gave you. If the plan extends too long, then they see it for themselves. 6. Implement the controls in your plan. If you are not succeeding, show a plan-versus-actual comparison to executives so they can make informed decisions about resources and priorities. 7. Use a control standard to ensure that you are following a good practice. Align any compliance-based standards to CIS Controls for practical guidance on implementing the controls.
Douglas Brush
3mo
Stop incentivizing bad sales behavior. We need to stop looking at cybersecurity vendors as quarterly return investment vehicles driven by voodoo math like ARR. I was constantly in trouble at a vendor for doing the right thing for the customers, driving top line revenue with better margins, and crushing regional sales numbers. But none of that mattered because it didn’t help boost the SKUs on the shelf.
Eric J. Kuitunen
3mo
I know it’s not Monday….But….this feels like laziness. Laziness on the part of the customer Laziness on the part of the provider Laziness on the part of the vendor We’ve been whoo’d by the over simplification and how we can cut our next corner. AI cough cough…. I’ll be the first tp admit, I know very little about NIST or CIS Controls…It’s becoming clear I need to know more. Not to jump on the bandwagon, instead to get an understanding of the processes and become..ummmm…Un Lazy….😎 I take the education of IT practices and how to best safeguard the SMB lost souls very seriously. It’s all about leading by listening. The rest will fall into place once they understand through story telling and excercises.
SMB IT Expert & Peer Facilitator
3moThis is another reason for an SRO. Ask yourself, would this happen if the topic were financial services, medical, accounting/tax, or insurance related? Answer: Nopity, nope, nope, no. And NO! It's tiresome to hear people with only a teaspoon of IT knowledge or experience attempt to weigh in on a professional conversation or topic as if their weight was equal. If I posted tax advice, then had a bunch of CPA's jumping all over it pointing out my transgressions , I'd be mortified and retract my ignorance. But alas... everyone who owns a computer is somehow an expert...