Cyber For Hire (Audio)

How Managed Services Providers Can Exceed Evolving SecOps Expectations - Christopher Fielder - CFH #30 Sep 26, 2023

The days of an MSSP or MSP being a security device babysitter are over. Clients expect more from your SOC, SIEM and SecOps offerings, and evolving attacks will demand more of you. It's time to level up -- but how does one upgrade from basic to top-tier services? According to our featured speaker, there are several key steps: more comprehensive, cross-industry threat data collection; more refined, contextual and meaningful analysis of threat telemetry data; and ample use of threat intelligence, data science and security research. This interview will examine the key challenges and opportunities associated with these critical objectives.

Endpoints are everywhere and come in many forms, and especially in today’s BYOD environment, it’s becoming increasingly difficult to maintain visibility and control over all of them. Unfortunately, rouge endpoints represent an enticing attack vendor for adversaries who are always looking for a way inside your network. But according to an August 2023 Cybersecurity Buyer Intelligence survey of 200 security and IT leaders and executives, security professionals are hopeful that newer, more advanced tools such as AI and XDR could help minimize endpoint compromises going forward. This session will analyze this and other key findings from CRA’s Endpoint Security research, and what the results mean from a managed services provider perspective.

Show Notes: https://securityweekly.com/cfh-30

Supply Chain Security: How Moving Accountability Upstream Helps & Hurts MSSPs - Dave Sobel - CFH #29 Jul 31, 2023

One of the most significant takeaways of the White House's recently unveiled National Cybersecurity Strategy is the assertion that software developers, OEMs, and technology service providers must bear the brunt of the responsibility -- rather than end-users -- for keeping cyber environments secure. With the looming prospect of further legislation and regulations looming that could impose greater liabilities on software products and services, MSSPs and other cyber services providers must understand where they fit into the overall scheme of things. Are MSSPs an extension of the end-user or are they one of the upstream providers who will be held accountable when cyberattacks occur? In what ways will the burdens on MSSPs be reduced or shifted due to federal efforts around coordinated vulnerability disclosure, SBOM use and other supply chain security strategies? This segment will explore these key issues. There's a lot that goes into the creation of a managed services contract before the client ever puts their John Hancock on the dotted line. As an MSSP, you want to make sure that expectations, for both sides of the relationship are spelled out clearly and cogently. The language within must address key terms and stipulations related to payments, roles and responsibilities, scope and scale of services, liability, and plenty more. In this segment, we'll discuss some of the most important clauses to include in your MSSP contracts, and how to avoid unfortunate omissions or vagueness that can result in confusion or disputes down the line.

Show Notes: https://securityweekly.com/cfh-29

Balancing Dark Web Threat Intel: Fair Attention for MSSPs - Alex Holden - CFH #28 Jul 25, 2023

Our guest for this segment spends his days where others dare not tread: the deep dark web. Here he collects information on cybercriminal activity that could be a precursor to major attack or evidence that one has already occurred. For companies that can't or won't conduct dark-web recon for themselves, outsourcing this threat intelligence service is a valuable option. Still, this kind of contracted services relationship works only if the provider keeps its intel reports relevant, customized and timely. This discussion will cover how to make the most out of such an arrangement, as well as real some of the most prevalent threats swirling around the corners of the dark web today. Every MSSP customer is different in their own way. But they all deserve to remain secure from attacks. And so it's important that managed services providers don't play favorites to the point where certain clients eat up a disproportionate amount of time and resources. MSSPs must ensure that they are fairly and proportionally allocating their account reps, technicians, support specialists, consultants, security analysts, pentesters and a host of other employees across their entire customer base. This segment will examine recommendations on how to better accomplish this objective. Show Notes: https://securityweekly.com/cfh-28

Brian Johnson - CFH #27 Jul 25, 2023

Try as they might to keep their clients in compliance with privacy and security regulations, managed services providers are still at the mercy of the organizations they serve. Unfortunately, companies don't always follow the MSSP's or vCISO's advice on items like responsible data stewardship, privacy policies and breach notification. If an attack does transpire and the company draws the ire of regulators, the security services provider could even end up a scapegoat, or even embroiled in a liability case. This Q&A discussion will look at what resource an MSSP or vCISO service has when their customer fails to make basic compliance a priority. The consequences of a cyberattack can be devastating, and it does make sense for managed security services providers to impress on their current and prospective clients the risks of not investing in prevention and response. However, many cyber thought leaders believe that certain lines should not be crossed. Advice is one thing; fearmongering is another -- and if you pursue the FUD angle too hard, you may simply come off as a predatory opportunist looking to push your services on the customer. This discussion will reveal how to convey your message and market your services in a way that doesn't exaggerate existing threats and turn off your clients.

Show Notes: https://securityweekly.com/cfh-27

M&A Integration Challenges & Alert Fatigue: MSSP Strategies for Client Escalation - Jim Broome - CFH #26 Jul 04, 2023

Last year, ChannelE2E listed more than 1,000 merger and acquisition deals involving MSPs, MSSPs and other similar service provider organizations. Typically when any M&A deal occurs, there are bound to be redundancies and overlaps in services, tools and personnel. For MSSPs that find themselves in this situation, it's important to consolidate and integrate the best of their assets across multiple entities, while maintaining operational consistency. This is no small task, but this segment will offer examples and tips to help move in the right direction. MSSP SOC analysts are often barraged with security alerts that pop up as anomalous activity is detected on clients' networks. Not all of these notifications are worth reporting and acting upon, but it takes only one overlooked incident to result in a full-fledged attack on the customer. This segment will look at the perennially challenging question of when it's the right time to let your clients know that something may be amiss, without inundating them with unnecessary reports. Also, we'll examine how automation can help reduce the burden on strained SOC analysts.

Show Notes: https://securityweekly.com/cfh-26

Quantifying Risk & Optimizing Responses: Scaling Your MSSP for Reduced Randomness - Ira Winkler - CFH #25 Jun 27, 2023

Risk isn't a static measurement. Threats like malware campaigns, vulnerabilities, human error and unreliable third-party partners can fluctuate in their severity depending on ever-changing circumstances. That's why knowing which risk is of highest priority at any given time can allow MSSPs to dynamically adjust their prevention and mitigation efforts, for both themselves and their clients. But which sources of risk do you measure, and what factors go into such a calculation? How frequently do you remeasure? And upon learning the latest risk scores, what are sound tactics for prioritization, response and mitigation? This session will explore the big questions surrounding risk quantification and optimization for managed security providers. Managed services providers know that investments in talent, tools and infrastructure can take a heavy financial toll. But as MSSPs continue to grow and take on more clients, they can hopefully achieve certain economies of scale such that their previous infusions of funds eventually pay for themselves. This session will look at the key investment areas where security providers can get the most bang for their buck as they expand their business and expand their customer base.

Show Notes: https://securityweekly.com/cfh-25

Going Passwordless: Preparing Your Clients for a Credentials-Free Future - Christine Owen - CFH #24 Jun 13, 2023

It's been a big year for the passwordless movement, with tech giants Apple, Google and Microsoft supporting the FIDO Alliance's efforts to replace conventional credentials with passkey technology. Still, passwords have long been engrained into people's daily routines, so users may need some convincing to change their behaviors. And likewise, managed security services providers may need to persuade their own corporate clients that passwordless is the future. This segment will examine some of the key breakthroughs and remaining challenges surrounding passwordless technologies from an MSSP perspective. You’re a big fish in a pretty big pond. But there are vast oceans to explore. Do you test the waters or not? For MSSPs who have prospered regionally, there’s a lot to be considered before expanding into new geographical territories, especially international markets. Such as: business culture differences, market preferences, regulatory factors, language barriers, and differences in cyber threat risk factors. This segment will examine these factors as well as the client’s point of view. After all, you need to figure out how to sell to them as a newcomer in a particular market.

Show Notes: https://securityweekly.com/cfh-24

CFH #23 - Bill Brenner May 30, 2023

Today marks the beginning of the Identiverse conference in Las Vegas, where leaders in security gather to discuss advancements in the world of identity and access management. For MSSPs that specialize in managed IAM services, it's important to stay on top of the latest trends, including those revealed in a series of reports and articles that CyberRisk Alliance has published as part of its overall Identiverse pre-show coverage. For starters, CRA's Security Buyer Intelligence Report on IAM looks at the progress organizations have made toward implementing user-friendly IAM, the biggest pain points impeding their IAM journeys, and the tools and solutions that adopters are prioritizing. This session will discuss these and other findings from CRA's coverage.

Obviously, managed security providers want to optimize their rapport with customers. But don't overlook the importance of fostering a mutually beneficial relationship with your cyber solution vendor partners as well. In this segment, we'll look at how MSSPs can best leverage their vendor agreements to ensure they're receiving top-notch, responsive service and gaining access to the most up-to-date solutions and the most flexible pricing plans.

Show Notes: https://securityweekly.com/cfh-23

CFH #22 - Don Pecha May 23, 2023

Infosec leaders shouldn't just be reporting to the board room to explain themselves when things go wrong. They should be a regular part of the strategic business discussions that take place inside a company's executive halls. That's true whether they're directly employed by the company or they're a contracted vCISO provided by an external managed services provider. In this segment, we'll discuss how managed service security leaders can land themselves a coveted spot in the board room and assert their influence on future business decisions.

It's understandable why many organizations' cyber investments heavily concentrate on protecting core networks and data centers from breaches and ransomware attacks. But let's not overlook the importance of ensuring that your website remains operational, especially when it directly drives revenue through sales or advertisements. Threats such as DDoS, bots, e-skimmers, malvertising and drive-by downloads continue to plague websites -- so why aren't there more managed service providers offering specialized help in this area?

Show Notes: https://securityweekly.com/cfh22

CFH #21 - Merike Kaeo May 16, 2023

Risk assessment questionnaires are a standard practice when evaluating current or prospective third-party partners. And yet some folks may justifiably ask: How valuable are these questionnaires if there are no consequences for fudging your answers, or even outright lying? This session will examine common weaknesses and oversights in the third-party assessment process, while recommending how to improve vendor transparency by obtaining key documentation, asking the right questions, and enforcing regulations.

A great many MSSP security professionals are truly passionate about making the digital world a safer place for businesses and their users. But at the end of the day, it is still a business, and good cybersecurity isn't free. And therein lies the strategy around pricing: What pricing models work best for your organization and appeal most to your customer base? And how do you ensure that your pricing policies are fair and transparent? This session will examine the key considerations and best practices around pricing and billing.

Show Notes: https://securityweekly.com/cfh21

CFH #20 - Pete Bowers May 16, 2023

What’s the best way to ensure operational resilience against cybercriminals’ tactics, techniques and procedures? Well, just rearrange the letters in TTP, and you get PPT: people, process and technology. This session will examine how organizations can score, benchmark and improve their cyber resilience through a combination of security processes, proper cyber hygiene and employee behavior, and a robust technology infrastructure. To do it right, all three elements need to be in place.

The worst has happened. You failed to protect one or more managed services clients from a cyberattack. Maybe you were even infected yourself. Or perhaps a failed product launch or negative engagement with a customer has resulted in a scathing review. There are lots of ways an MSSP can wind up with a tattered reputation -- and sometimes they're not even fully to blame. And that's why a good incident response and disaster recovery plan means not only getting your IT networks up and operational again; it also means salvaging your reputation and not letting this incident define you. This session will look at strategies for restoring your image after something goes very wrong.

Show Notes: https://securityweekly.com/cfh20

CFH #19 - Mike Hamilton May 02, 2023

The cyber talent shortage is well documented. Rather than just trying to outbid each other in a competitive job market, wouldn't it be nice if MSSPs were also able to build out their talent pipelines through professional development programs? This session will look at strategies for creating an assembly line of ready-to-go cyber professionals to add to your managed services team, including coordinating with cyber universities and boot camps, and sponsoring apprenticeships, mentorships and internships.

In the last few years, many companies have found that their home offices and their internal on-prem networks are no longer always the central core around which their business operations revolve. Even with more employees returning to the office now, remote and hybrid workforce models are here to stay, thanks to an exponentially increased reliance on cloud-based architecture and services, as well as edge computing practices that allow for the processing of data closer to edge devices. All of which means that critical data and business functions are constantly taking place right at the network's edge -- a perimeter that these days is becoming difficult to define. In this segment we will examine how cybersecurity models must adapt in order to accommodate this recent shift in network dynamics and architecture.

Show Notes: https://securityweekly.com/cfh19

CFH #18 - Juan Valencia Apr 25, 2023

Your favorite intelligence feeds are warning of several up-and-coming new campaigns that are victimizing companies much like your clients. Maybe they're even targeting MSSPs themselves. Now it's up to you to assess and prioritize these latest threats, and determine to what extent they require you to change your approach, institute additional safeguards, or update your security awareness messaging. What's a reasonable response? What's a knee-jerk overreaction? This session will examine how managed services providers and security professionals in general should and shouldn't react to the latest threat intel release. Our guest will also review some of his favorite top trends and incidents from this past year's Verizon Data Breach Investigations Report.

Jugglers! Magicians! Freebies! You can find plenty of commotion and distractions on the show floor at the RSA conference or any major cyber convention for that matter. If you're a managed security services provider trying to sell your wares, it can be a challenge to distinguish yourself amid all the noise and chaos of events like these. This segment will offer tips and recommendations for making your customer impressions more memorable so that you stand out from the rest of the crowd and your marketing message is not lost in the blur. At the same time, we'll also examine what questions savvy MSSP leaders should be and likely will be asking on the show floor as they hunt for the right vendor partner.

Show Notes: https://securityweekly.com/cfh18

CFH #17 - Michael Smith Apr 18, 2023

Who won the Super Bowl this year? Everyone did, in the sense that there were no major cyberattacks that disrupted the flow of the "Big Game" -- unlike, for instance the Pyeongchang Olympics, where ticket distribution was affected on the night of the Opening Ceremonies. For contracted cybersecurity services providers, protecting a prestigious one-off event like a sports championship or political convention brings major challenges such as building a secure network infrastructure at a temporary location, identifying the unique risks and relevant threat actors associated with each particular event, and combining physical security with digital security. In this session, the former cybersecurity adviser for the 2014 FIFA World Cup and 2014 Winter Olympic Games will examine these and other challenges, while citing best cyber practices associated with large-scale gatherings.

It's a tough call for MSSPs: Be really good at a small subset of services, which potentially limits your customer base? Or become a jack of all trades, but potentially stretch your resources thin and risk the possibility that you won't be able to truly master any of your specializations? This session will hopefully help cyber service providers find a happy medium between these two outcomes, by examining when it's best to stay in your comfort zone and when to broaden your horizons.

Show Notes: https://securityweekly.com/cfh17

CFH #16 - Craig Robinson Apr 11, 2023

Having a clear and cogent taxonomy that classifies your managed cyber services into distinct buckets or categories is an important step for MSSPs looking to define and differentiate their market offerings to clients. Customers can refer to your taxonomy to better understand your scope of services and ensure they don’t leave gaps in their security plans, while you as a service provider can leverage your own taxonomy to assess your portfolio and identify future opportunities for deliverables. Also in the second half of our discussion, we’ll look at some recent results from assessments of managed services companies in various cyber taxonomy categories, exploring what the best performers are doing differently in order to excel.

Creating a zero-trust architecture is a gradual process that starts with understanding precisely what you need to implement a “never trust, always verify” approach within your extended organization. Rather than materializing all at once, organizations often develop a ZTA in phases over time. However, during this maturation process, gaps in zero-trust processes can form – creating potential weak spots. This session will look at some of the most common holes that develop in zero-trust architectures and the steps can be taken to close them.

Show Notes: https://securityweekly.com/cfh16

CFH #15 - Jessica C. Davis Apr 04, 2023

What are the market trends that are driving growth and changes in the managed security service provider market? MSSPAlert.com, an affiliate of Cyber for Hire, does an annual survey of MSSPs to find out about growth trends, technology providers, different types of incidents they see in their work with small and mid-sized businesses, and other information and insights. In this edition of Cyber for Hire, we’ll talk about some of those trends revealed in the survey. For instance, some of the factors driving growth in the MSSP market today include the global shortage of talent across enterprise, mid-market and small organizations. Hybrid and remote work are another factor that is contributing to demand for MSSPs. Find out more about what’s driving the growth as well as other market trends in and around the MSSP market in this episode of Cyber for Hire.

Segment Resources:

Link to subscribe to a newsletter that will alert you of when we open our MSSP 250 Survey for 2023 (second one from the bottom): https://www.msspalert.com/sign-up-for-enewsletter/

Ask Jessica C. Davis, editorial director of MSSPAlert any questions about participating in the research at: Jessica.c.davis@cyberriskalliance.com

ChatGPT and all of its competitors are not just text generators, they are also powerful tools that can be used for good or for evil in the realm of cybersecurity.

• What are the implications for MSSPs in the scope of their own services as well as the threat vectors for clients?

• What are the applications of generative AI for hackers and threat actors?

• What tools are available or in development to help security service providers deal with the escalating quantity and quality of attacks?

Segment Resources:

• https://www.darkreading.com/vulnerabilities-threats/generative-ai-changes-everything-we-know-about-cyberattacks

• https://www.theregister.com/2023/03/28/chatgpt_europol_crime_report/

• https://www.msspalert.com/cybersecurity-services-and-products/ai/microsoft-debuts-ai-chatbot-for-cybersecurity-defenders/

Show Notes: https://securityweekly.com/cfh15

CFH #14 - Matt Miller, Joe Alapat Mar 28, 2023

Now in its eighth iteration, the Center for Internet Security's Critical Security Controls (CIS Controls) framework provides organizations with 18 categories of high-priority best practices that they can follow in order to improve their cyber hygiene, while remaining in step with key regulations. In this segment, we'll look at what MSSPs and their client base need to know if they opt to follow CIS' guidelines vs. other competing frameworks. What are the biggest barriers to successful implementation? What are the biggest benefits? Which best practices are managed services providers best equipped to conduct, and where might they need some assistance?

This segment is sponsored by Liongard. Visit https://msspalert.com/liongard to learn more about them!

It's a tough call for MSSPs to make, but sometimes when a client relationship isn't working out, it may be time to cut your losses. Perhaps the customer isn't honoring its commitments to security hygiene; or maybe you're at odds over strategy; or it could be that they are a drain on your resources. This session will examine when to know it's the right time to go separate ways -- and what's the most professional and responsible way to end your relationship.

Show Notes: https://securityweekly.com/cfh14

CFH #13 - Ryan Jamieson Mar 21, 2023

Security is a shared responsibility between MSSPs and their clients. Yes, the provider was hired to do a job -- be it SOC operations, threat intelligence or offensive security -- but part of the job is also to consult and communicate with the client to help them gain some degree of cyber self-sufficiency. This discussion will reveal how providers can teach their clients how to develop a secure corporate culture, how to share responsibility and accountability for security matters, and how to broaden their security awareness through partnerships with professional development organizations and information sharing groups.

To what extent should compliance with privacy and security frameworks -- whether imposed by government bodies or industry standard organizations -- be the decisive factor when MSSPs choose their tech stacks and craft their threat defense strategies? Meanwhile, are would-be MSSP customers deciding which managed services provider to hire largely based on their compliance needs, or are they more influenced by other market forces and threat trends? And for those organizations who ARE building their managed services strategies around compliance, which frameworks, laws or standards should be highest priority? This segment will offer important perspectives on these key questions.

Show Notes: https://securityweekly.com/cfh13

CFH #12 - Ashwin Radhakrishnan Mar 14, 2023

In late 2022, the MITRE Engenuity foundation revealed the findings from its first-ever ATT&CK Evaluations for managed security service providers. The report measured various MSSPs' ability to recognize, analyze and report the TTPs of the OilRig Advanced Persistent Threat group. This session will dig into the findings to help MSSPs better understand where they can stand to improve when it comes to hunting, detecting and responding to threats posed by sophisticated cyber adversaries. Plus, MITRE will reveal how managed security providers can participate in the next round of assessments. In the cybersecurity job market, it's "Advantage Worker," as the demand for talent has opened up a world of possibilities for security professionals to seek out greener pastures. Meanwhile, other infosec pros are so stressed and burned out that they're looking to quit the daily grind altogether. These factors have combined to create a cyber talent turnover crisis, which can result in organizational instability, stalled implementations, slow responses to threats, and overworked, stretched-thin employees. In this segment, we'll identify some of the best talent retention practices and policies that give you better odds of earning loyalty from your cyber workforce.

Show Notes: https://securityweekly.com/cfh12

CFH #11 - Chris Bell Mar 07, 2023

For managed services providers looking to build their market strategy around XDR and MDR -- or a hybrid of the two solutions -- it's important to understand how this approach will shape future priorities for their tech stacks and toolsets, their clients and their vendor partners. What kinds of next-generation services can they build from an XDR/MDR foundation? How does this differ from a more traditional MSSP approach? And how can managed services providers clearly communicate and define what XDR constitutes to clients who don't fully understand the concept?

Once upon a time, organizations that relied on Macs or Linux machines could rest easy knowing that they were too few in number for cybercriminals to bother targeting them. This is no longer the case. As adoption of non-Windows operating systems has increased, so has the number of incidents victimizing devices running on these OSes. In this segment, we'll identify some of the latest non-Windows cyber threats and assess whether MSSPs currently have the specialized knowledge to successfully service organizations that run on macOS, iOS, Linux and other less common OSes.

Show Notes: https://securityweekly.com/cfh11

CFH #10 - Remote Monitoring & Management Hijackings Feb 28, 2023

In late January, CISA, the NSA and the MS-ISAC released an advisory warning about the malicious the use of legitimate remote monitoring and management software, after uncovering illegal hacking activity on two federal civilian executive branch networks. Whether compromised via social engineering or through exploits, RMM tools can grant unauthorized users potentially unfettered access to your MSP clients. So the question must be asked: Are you using RMM responsibly?

Network difficulties can crop up at any time, as can possible attacks. And companies like having the reassurance that at a moment's notice they can reach out to their MSSP for help. This segment will look at how managed security services providers can operate a top-notch, responsive support desk that meets or exceeds their clients' needs through best practices and policies, optimal workflows and automated tools.

Show Notes: https://securityweekly.com/cfh10

CFH #9 - A.N. Ananth Feb 27, 2023

The developer of a commonly used software issues an urgent out-of-band update for a coding vulnerability that is discovered to be under attack. Immediate patching is imperative. Under such circumstances, what can MSSPs do to quickly identify which of their clients are running this vulnerable software version? And then what are the best practices for managing and collaborating with these exposed organizations, in order to ensure timely cooperation and a decisive response? Security Operations Center services are in demand, as many organizations are unable to stand up their own full-fledged SOC. For MSSPs looking to add, grow or mature their own outsourced SOC services offering, a key early question is: Do we build from scratch, partner with third parties or buy these capabilities through a merger or acquisition? This session will look at the various pros and cons of each approach.

This segment is sponsored by Netsurion. Visit https://msspalert.com/netsurion to learn more about them!

Show Notes: https://securityweekly.com/cfh9

CFH #8 - Jason Lewkowicz Feb 07, 2023

In late January, law enforcement officials disrupted the operations of the Hive cybercriminal group, which has profited off of a ransomware-as-a-service (RaaS) business model. And though the takedown was an inspiring victory, there’s plenty more ransomware where that came from. Indeed, Microsoft just reported that at the conclusion of 2022 it was tracking more than 100 threat actors using over 50 different ransomware families to extort victims. And many of these criminal networks operate like professional businesses in this underground economy. Bottom line: there’s still a lot of work to be done, and it begins by collecting and communicating the right cyber threat intelligence to profile these threat actors and understand how they operate, so we can anticipate and defend against their next move. In this segment, we will discuss the responsibility of the MSSP to understand their opponents while keeping their clients abreast of the latest intelligence reports and adversary TTPs.

The life of a Cybersecurity professional is not for the faint of heart. The job can be stressful, sometimes thankless. And when an attack transpires, you can work long hours knowing the fate of your employer is on the line. Or in the case of an MSSP, the fate of your client. You might even argue that being a managed security services provider magnifies the stress and burnout factor because you must answer to multiple companies at once – all with high expectations of you. With that in mind, this session will examine key policies and strategies that you can institute to relieve your employees of some of this burden. Plus how to manage security professionals through a security crisis or difficult time in order to minimize the emotional toll.

Show notes: https://securityweekly.com/cfh8

CFH #7 - Michael Miora Jan 31, 2023

Some MSSPs have a hard time leaving their comfort zone when it comes to their toolsets. They prefer to stick to their own tried-and-true suite of tools and are reluctant to add new ones, even though it might be beneficial to do so. After all, not every client has the exact same needs and challenges. This session will look at how MSSPs can potentially boost their revenues, increase their subscription add-ons and increase renewal rates by expanding their horizons and embracing new innovations. It will also explore which emerging solutions in particular should be receiving more attention and love from service providers than they are currently receiving.

The advancement of artificial intelligence and machine learning has for years been both touted and feared in IT and cybersecurity circles. Still, the sudden emergence of the generative AI tool ChatGPT seems to have sneaked up on a lot of people. While ChatGPT can be leveraged as a tool for good to help write Yara rules or uncover vulnerabilities, it can also be misused by malicious actors to create highly convincing spear phishing emails or write malware. And while the tool's ability to generate code can be useful to aid developers, it can also unintentionally create more vulnerabilities that DevSecOps teams will be tasked with correcting. In this segment, we'll look at why MSSPs need to stay ahead of the game and develop policies to address this emerging technology on behalf of their clients.

Show Notes: https://scmagazine.com/cfh7

CFH #6 - Candy Alexander Jan 24, 2023

No matter how well constructed an MSSP's security architecture is, or how tight its security controls are -- all that good work can be wasted or sabotaged far too easily when the client organization fails to follow standard cyber security hygiene practices. Just because a company uses a managed security provider to bolster its cyber preparedness doesn't mean they still don't have a responsibility to promote security awareness across their workforce and institute some basic cyber governance policies. In this segment, Cyber for Hire will seek to identify and find potential solutions for addressing users' key security awareness failings because at the end of the day, security must be a two-way street.

Sometimes it feels like security professionals and business leaders are speaking different languages. That's why it's critical for managed security providers to communicate with their clients' financial decision-makers in a business-aligned manner that conveys how cybersecurity can help advance and protect the company's corporate interests. This featured topic will identify strategies for translating infosec concepts into business objectives, avoiding confusing cyber jargon, finding cyber champions on your client's payroll who can amplify your message, and blocking out external forces and influences that muddle your message.

Show Notes: https://scmagazine.com/cfh6

CFH #5 - Nick Ellsmore Jan 17, 2023

A lot of thought goes into which cyber solutions vendors MSSPs ultimately align themselves with. There are many factors to consider: What capabilities do you want to prioritize based on client demand? How do you assess your weak points or gaps in services? And then what are the top qualities in vendors you're looking for? Today's episode will look at some of the key strategies for MSSPs looking to build their own alliance of vendor partners.

It sounds ironic, maybe even a little paradoxical, but it might just take hiring third party to help an organization assess and mitigate the risk posed by their other third-party partners. For organizations that cannot or prefer not to spearhead this task internally, MSSPs can provide a scalable and consistent third-party risk assessment program that yields insightful, enforceable and actionable recommendations. This segment will examine the marketable benefits of having MSSPs evaluate third-party partnerships that exist outside of their clients’ organizational boundaries, plus best practices when conducting outsourced risk assessments, and the latest trends in third-party risk that MSSPs are observing.

Show Notes: https://scmagazine.com/cfh5

CFH #4 - Harpreet Sidhu Jan 10, 2023

It's not uncommon for IT security professionals and OT engineers to be at odds with each other over cyber governance policies and procedures inside industrial settings. And when the IT professionals work for an outside firm such as an MSP, then that can create another level of separation that can further expand the schism between IT and OT. With that in mind, what are some key considerations that managed security providers and their industrial clients must account for in order to develop a governance framework that meets the needs of both IT security pros and OT engineers?

You're an MSSP that has just experienced a severe ransomware attack that's disrupting your services. How do you make sure that the infection isn't passed along to your clients? And what do you do if sensitive information on your customers has been exfiltrated? In this segment, Cyber for Hire will lay out some of the key initial response steps MSSPs must take when they themselves turn out to be the victim.

Show Notes: https://scmagazine.com/cfh4

CFH #3 - Brian Haugli Jan 03, 2023

Let's play the dating game! When pairing up a company with a fractional or virtual CISO, there are a lot of factors to consider. Personalities count, as do cyber skills and IT background, industry sector experience, geographical limitations, and the company's stated core objectives. The available IT expertise on the client's corporate payroll also makes a difference. This session will look at how to find a healthy, harmonious match between vCISO and client, and what warning signs to watch out for if the relationship starts to get rocky.

When finding cyber talent is difficult, end user organizations often turn to managed security providers to fill the void. But then where do MSSPs turn to hire infosec professionals? What are their top strategies for developing and optimizing talent? And for that matter, what makes a quality MSSP infosec pro to begin with? Who's built for this kind of job, working with multiple clients, not just one company?

Show Notes: https://scmagazine.com/cfh3

CFH #2 - Joseph Edward Brunsman Dec 27, 2022

It's becoming increasingly difficult to qualify for cyber insurance. Insurance providers are wary of multimillion dollar payouts resulting from costly ransomware attacks, and so the onus is on companies to prove that they can meet certain minimum cyber hygiene standards. One of the potential paths to reach this objective is by contracting a managed security provider who can ensure that you meet coverage criteria. But just how big of a difference does this strategy make -- enough for MSSPs to make insurance a key selling point? Conversely, do cyber insurance companies judge MSSPs' coverage worthiness based on the clients they keep? And what are some examples of exclusionary language that cyber insurance policy holders in an MSP relationship should watch out for? There is a basic expectation that an MSP should create a single, standardized stack of tools that they will use to service every one of their customers. And while that makes perfect sense for the MSP, it puts the client in a tricky position: either abandon the infrastructure and processes they already have in place and make a big adjustment to align with the MSP’s standards… or accept that they cannot access the MSP’s services. This segment will examine the pro and cons of this dilemma.

Show Notes: https://scmagazine.com/cfh2

CFH #1 - Chris McCurdy Dec 20, 2022

If you were to ask most companies right now, "Why you have you hired an MSP?" the answer probably would sound something like: “Resources are strained. Talented is limited. So we’re outsourcing certain security functions to a firm that has the built-in capabilities to manage this for us.” But is the MSSP model becoming more than a convenient economics and personnel decision? Is this actually becoming a go-to "must have" for all organizations -- the next logical evolution in the industry’s approach to solving security? Plus: Dear Cyber for Hire, our marriage counselor advice column for MSPs and their clients. And The Security Detail, our curated rundown and analysis of the latest cybersecurity news. Companies must communicate clear expectations when contracting with pentesters, red teams and vulnerability hunters in order to set key ground rules for what data and systems can be accessed, what’s off limits and who is responsible if something breaks. Of course, if you set too many restrictions and parameters, then how do you really know if you’re safe from malicious hackers, who of course don’t play by the rules? Plus: We Speak Geek, a weekly segment where our guest shares what they geek out about!

Show Notes: https://scmagazine.com/cfh1

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected