With the recent news and aftermath of the cyber-attacks affecting companies across the globe, some business owners are realising that perhaps now is time to re-invest, update and manage their systems in accordance with the recommendations from Microsoft, their CIO or IT Partner’s. Such devastating attacks and the inevitable carnage that follows can help business owners focus on the gaps in their own security needs and practices. The obvious question they face is, “Are we prepared for such an attack?”
Investment decisions are often pushed back, budget constrained or in the most challenging cases, subject to a divided opinion on need. IT partners and co. will perform their role and make the necessary recommendations or as suggested by leaders within the security sector but cost is most often the driver that denies change.
Those businesses fortunate enough to adhere to some form of compliance are less prone to delays or division. In order to remain compliant, they must follow the security guidelines laid out before them.
The risks of avoiding or delaying such recommendations, can often far outweigh the costs of implementation and those that would continue to delay put not only their data, but the success and reputation of their business at risk.
The challenge for us as Managed Service Providers, is to help business owners understand both the necessity of investing in and having professionally managed up-to-date systems as well as the evident risks of not doing so. The solution is still a value or bottom line proposition as there is still a limited understanding and willingness to accept the risk.
To Manage or Not to Manage?
An awful pun but a very pertinent question. Having professionally managed and up-to-date systems have obvious benefits. As a SolarWinds® MSP partner, we are able to provide centralised management of servers, desktops, mobile devices and pretty much everything in between. We can empower IT Managers and Internal IT departments to take control of their own landscape and monitor their systems with ease. It is now a common approach that Managed Service Providers (MSP’s) have adopted as it streamlines, protects, reports and it does all of that in abundance. Businesses can reap the benefits of a single pane of glass approach to managing Antivirus, Windows Security Patching, Third Party Software Patching including Windows Server and Desktop Backups. Such systems significantly reduce systems downtime and the subsequent demand on support.
The Security status of devices can be seen in real-time allowing technicians to quickly react to threats and issues with AV and Patching keeping customer networks safe and secure. A threat on one customer site can be mitigated across all other customer sites in near real-time. This has a huge advantage over disparate Antivirus, patch management and backup systems with a lack of visibility and access rights across technicians. This disjointed and time consuming approach can leave customers and their IT partners exposed to significantly longer response times when mitigating or dealing with the aftermath of a successful attack.
We need better protection
Businesses understandably want the vendors of security products to do more to protect them, their employees and their data. MSP’s and businesses are crying out for that support and in most cases, we are seeing it. Security products are constantly evolving to detect the latest threats and can now predict where threats could occur by continually scanning your network for vulnerabilities whilst placing a £ value on the data that’s exposed. Yet, the responsibility cannot be solely placed with them and why should it? Human intervention and the employee determine the final outcome. The zero hour threats (new or latest iteration of a virus or malware) are the most difficult to protect against as a new strain may not have the same signature as its predecessors which means we cannot completely rely on the security products to perform. We all need an additional layer of protection.
This protection comes through education, we must educate our employees to recognise these threats but equally as important, be responsible for their actions. An employee armed with an understanding of consequence and what to look for, follows the guidelines for their own security (separate usernames and passwords for business and private accounts) and communicates with their IT team can single handedly prevent a devastating infection. It already happens several times a day and most don’t realise they are already protecting their employer from exposure!
For instance a spam email with a link or attachment has managed to make its way through all layers of protection and into a user’s mailbox. The decision at that point to be curious or careful is the decision that will determine how much downtime, data loss and financial burden is placed upon the business and IT support. The email looks genuine, it’s from another employee asking to transfer funds to pay an attached invoice, seems legit…but something is off. The reply address is a Hotmail address but it says it’s from the FD?
Having the ability to recognise such threats is the difference between the potential for financial loss and a normal working day. Where security products fail, our employees are our last line of defence and we should at least provide them with the tools and understanding of how to better protect themselves.
Every serious infection of virus or malware we have identified, is the direct result of an employee not understanding their responsibility, their role in the security process and how they can better protect themselves and the business.
So what do we do?
Investing in the right security products is an obvious component in threat protection. It is the responsibility of IT department heads, IT partners and the Security Product Vendors, to help their customers and decision makers better understand the products at their disposal and why they are needed. Configuring those products to help predict, detect and prevent infection can de-risk a signification portion of the IT landscape.
User education is critical and needs to be continually reviewed to ensure employees don’t become complacent. Regular meetings or bulletins reinforcing the importance of being vigilant in their approach as well as updates to what to look for will be the mainstay. We can invest a significant portion of our budgets in the latest products but it can easily be undone by human curiosity or from a lack of education.
If you are unfortunate enough to be a victim of a ransomware attack, you will inevitably turn to your backups or Disaster Recovery Strategy. Local backups can be and are often infected if stored on local servers or Network devices such as a NAS but cloud backups are securely encrypted and safely out of reach of ransomware. Your recoverability determines how quickly you go about your working day so ensure you invest in a backup solution that securely stores your data offsite.
How do we protect our customers?
We are open and transparent about our methods and approach to network management and take pride in having invested in the best tools available. SolarWinds® MSP allows us to manage our customer’s IT landscape with real-time monitoring, Antivirus, security updates, risk intelligence and full disaster recovery solutions delivering an unparalleled support and systems management experience.
Speak to us, we are great at listening