As an MSP, you know how quickly things change in the world of cybersecurity. That's why we've put together this timely discussion on how you can stay ahead of the rapidly evolving threat landscape and manage the risks to both your end customers and your MSP.
Series: MSPs in Conversation
Length: 58 minutes
Key takeaways
- If you have a breach, Andrew's first step is to contact your insurance broker or cyber insurer straight away, because the insurer has a 24/7 incident response team whose job is to stop the damage early.
- Andrew explains that the biggest exposure he sees for MSPs is bad advice, and that cover for it is professional indemnity insurance, not cyber insurance. A customer can blame the MSP for a breach, for example for switching off MFA or not patching something.
- Aaron says most attacks come through the low-hanging fruit: unpatched software, VPN connections without MFA and users who get socially engineered. Every MSP needs a proper incident response plan that doesn't rely on one person.
- Andrew suggests MSPs encourage customers to hold their own standalone cyber policy and know who to call, since fines under the Privacy Act can run into millions of dollars per incident.
- Jason explains that ISO 27001 demand is now driven by customers rather than government, and an MSP can lose its biggest client simply because it isn't certified. Being "aligned" without certification can be seen as a red flag.
- When helping clients with cyber insurance proposals, Andrew advises that the client reviews, signs and dates the form themselves, because the proposal forms a key part of the insurance contract.
- Andrew notes that large organisations are starting to require MSPs to carry their own cyber insurance to get on their supplier panel, and that no single measure is a silver bullet: insurance, ISO and detection together reduce risk.
Transcript
Ben: Alrighty. Welcome everyone. This is our first MSPs in Conversation for the year, so we're glad to be back today. We are presenting a very hot topic: cyber insights for Aussie MSPs, navigating risks and protections. We've got a few experts here and I'll let them introduce themselves in a second.
But very quickly, just introducing Hosted Network. If you don't already know, Hosted Network is a wholesale cloud and telco provider. We deliver cloud and telco the way it should be. We were an MSP. This year marks our 20-year anniversary, and we have been wholesale only, serving MSPs, for 10 years. We now service over 200 MSPs across Australia. I won't go into all of our services, but feel free to reach out if you are new to MSPs in Conversation or if you'd like to learn more about Hosted Network. But enough about us.
Guys, thank you for joining us today. We've got Aaron, Andrew and Jason. I'll start with Andrew. Andrew, can you introduce yourself and SherpaTech, please?
Andrew Bremner: Absolutely. Thank you, Ben, and it's great to be on this webinar. I'm Andrew Bremner, I'm the Managing Director of SherpaTech Insurance, and we are specialists in insurance for tech and IT companies. Just a little bit of background: we have an existing business called Sherpa Insurance, and we found that our fastest growing segment was MSPs, and they needed unique, specialised attention. So we've set up a specialist brand and offering just for tech and IT, and that is SherpaTech.
Ben: Thanks, Andrew. And Aaron, you're not a stranger to MSPs in Conversation, but today you're wearing a different shirt, or hat. I'm not sure which it is.
Aaron Jacobs: I don't know. Hi everyone. I'm Aaron Jacobs, and currently I am one of the global sales engineers for Sophos. Any of you that are familiar with Sophos will know there's a large range of things that we do, and I focus very much on the MDR and incident response side of the shop. I moved to Sophos last year, but before that I spent 20 years in the MSP space, and I was general manager of Rodin Business Solutions. I think we were about 4,000 seats and 150-odd customers.
Ben: They're probably double that since you've left.
Aaron: I'm sure it's skyrocketed since I've gone. Huge numbers.
Ben: Right. Jason, welcome.
Jason Maricchiolo: Thanks, man. Thanks for having me. I'm Jason from ISO365, basically a business that's focusing on helping MSPs achieve their ISO certifications. I have been working in MSP land for the past 15 or so years across a few MSPs, mainly in the operations areas of the businesses. Like many people on the call today, I think the conversation about ISO is getting lumped with either the general manager or the ops guys and girls out there. So obviously I've been doing that, and now I'm running ISO365.
Ben: Great. Well, today we have a heap of questions that we want to run through, but I will throw it out to the audience: if you have any specific questions you'd like to ask our panellists, please feel free to drop them in the chat and get the conversation going. As always, we will answer them as we go. I'm going to stop sharing, because this is all about what you guys have to say as our experts.
To set the tone, Aaron, I'm going to start with you. Cyber risk is a very hot topic in general. We're seeing threats go through the roof. It feels like every week there's a major brand on the seven o'clock news that's been breached. I know that you and I have had plenty of chats about war stories, but can you talk to us a little bit about some of the issues that you've seen MSPs facing, and highlight some of the common causes of how our customers are being breached?
Aaron: Yeah, for sure. So look, I'll start with coming to Sophos and seeing the other side of the fence. It was mind-blowing to see the amount of things that go on. You hear about it in the media a lot, but that's the big names, the stuff that you see in the news, like you said. The reality is everyone is a target, and it happens a lot. MSPs are under attack. Literally everyone's under attack, and it's more about the low-hanging fruit. That's the real stuff these attacks come in through every day.
My team globally deals with incident response, so unfortunately we're the first people responding to an incident, for anyone really, non-customers or Sophos customers. The stuff that we see, look, it's horrible. The big things we see really regularly are unpatched things. Ben, you mentioned big names, and if you look at zero-day vulnerabilities, you automatically think of Microsoft when you think of patching. But there are vulnerabilities in almost everything. The reality is there are vulnerabilities in every piece of software, and not all of them have been discovered yet. So where people are getting attacked, it's from not being able to patch quick enough, and that comes back on MSPs.
You hear all the reports, and every vendor has a statistic and a number in their social campaigns. I hate the statistics: 93% of this and 27% of that. You can make a percentage about anything. But the real truth of the matter is that the stuff we, as MSPs, are all meant to be managing and patching and dealing with is the stuff that's getting hit. And you can do your job perfectly, you can patch everything, and then something will come in through a user that gets socially engineered, or I think of VPN connections without MFA on them. It only takes an intruder to get in a little bit, and once they're in, they start working through your environment. Unfortunately, they're doing a really, really good job of it, better than all the MSPs I've ever met out there, including ours, at being able to manipulate their way through a network. So look, it's scary. They come in any way they can.
I would always say the vulnerabilities are the huge one. I know statistics might say social engineering, but I often think that when you talk about the really big companies that spend millions of dollars on security, the only reason they get in through social engineering is because those companies have really good systems in place. For all the small businesses and MSPs out there who are juggling way too many things, not being able to put the latest firewall patch on that came out last week and is now being attacked, or the one that came out a few weeks before that, pick a certain vendor here, there's a new one every day: that's the way they're getting in. And once they're in, they start to work their way through. It's pretty eye-opening and scary to see this kind of stuff happening.
Ben: It's interesting you say that. Our internal security team were doing a bit of a demo the other day. We've got our internal project called Guardian, which everyone will hear more about this year. We monitor everyone's connections for vulnerabilities, and we're about to start presenting that data to our partners. It's crazy, the vulnerabilities that will just pop up in a DrayTek or a D-Link or something like that, and it is scary to see how quickly you can actually get in and take control, whether that be an RDP server sitting behind it or not. It's very scary.
So it sounds like a risk that we can't entirely manage, right? We do our best, and I guess that's what today is about. So thank you for setting that tone. The first thing is we need to mitigate and manage that as much as we possibly can, but there's always a risk, which is where cyber insurance comes in. So Andrew, I'm going to go to you next, please. If we have a breach, what are the key things, from an insurance perspective, that we should do, and most importantly, should not do?
Andrew: Absolutely. Love to answer that, Ben. And Aaron, just leveraging from what you said, you're absolutely bang on. Every piece of software has vulnerabilities, and it's a matter of when rather than if. It's really sad. Where we come in is after the data breach has happened, after Jason's piece of work or Aaron's solutions get breached and it doesn't work. We get in at the point where there has been a breach and there's a lot of data at risk, and, you know, what do you do?
The first thing is to keep in mind that insurance is that second line of defence. So once you have that second line of defence, what do you need to do? The first thing is you contact your insurance broker or you contact the cyber insurer. The reason you do that is the cyber insurer has a 24/7 incident response team on hand, and these guys specialise in actually stopping the damage. Why do they do that? They do that to reduce their exposure and reduce their loss. If they can jump in and get control at the get-go, they have a better chance of succeeding.
So the first thing is you get hold of the insurer, or go via your insurance broker. Then there's a whole bunch of things once you've assessed where the leak happened. Of course you must stop the leak, but again, use the help of the incident response people, because at the end of the day they're in the business of dealing with the data breach. Whereas the MSP is really in the business of keeping the lights on. From what we see, they do an incredible job for their customers. MSPs are amazing and innovative at keeping the lights on, but they're perhaps not so innovative when it comes to data breaches and are not sure what to do. So that's why it's very important to engage that insurer early, and away we go. We've actually prepared a data breach checklist that we'll make available to everyone on the call as a starting point.
Ben: Okay. So if the first thing that we need to do is call, I wonder if many of the MSPs on the line will actually know who to call, or if their customers will know who to call. Jason and Aaron, you've run MSPs before. Was it standard practice that you had those details on hand?
You want to go, Jason?
Jason: Yeah, it depends how organised you are, I suppose.
Ben: Politically correct answer. Well said.
Jason: I wasn't going to be politically correct. I would dare say that a lot of MSPs wouldn't have that information on hand. I'll take the question from an ISO perspective. If they don't have a management system in place, whether it's certified or not, to make sure they know where to go to find these details, then the first port of call is going to be Googling "what the hell do I do? We've just had a breach."
So I don't think that many MSPs out there would know what to do. And depending on how big the breach is, you do have to let the regulators and the authorities know. That can be where it gets a bit scary, because you've obviously got internal reporting, but you've also got external reporting. It all really depends on what's happening in your business, but if you don't have a management system set up for you to be able to go and find out what you need, you're not going to know.
Ben: Okay, so that's a little bit of a takeaway, maybe a tip there. I wonder, from an onboarding perspective, if MSPs should actually be collecting those details of who to call. I'm going to put my little asterisk there and not provide insurance advice, but maybe that's an idea for the people on the call as a takeaway. Aaron, what have you done in the past?
Aaron: Well, look, there are two sides to this conversation. There's one for an MSP having a breach themselves. In itself, Jason, I don't think many MSPs, and definitely not the whole staff, would have any clue if they had insurance or not, or who to call.
Ben: Yeah, good point.
Aaron: I know in our situation it would have been "call Aaron", and that's not a good incident response plan. Everyone needs an incident response plan. I had those details, and a handful of others had those details, but it wasn't plastered all over the walls like it should have been in the event that we weren't available. So a proper incident response plan is important.
And going back to the two sides, Ben: you've got your incident response plan, but then you've got the customers, and they should be different, right? If you're having a systemic MSP breach, "oh my God, my RMM's popped, things have gone wild and I'm losing customer by customer at the moment, what do we do?", well, the incident response plan is going to be pull the cable and then start figuring things out. You might not even be able to pull the cable, who knows. But onto your customers, Ben, I don't know what the right answer is about holding their insurance details. Maybe Andrew can give us some advice there. At Rodin we always put it down to the customer: it's the customer's insurance, it's their cyber insurance, and we're not getting involved. We're definitely not going to be the conduit to contacting insurance. That's not written into our agreements.
Ben: Yeah, I'd expect the customer would have to call them.
Andrew: Normally what we see is the customer needs their own standalone cyber insurance. But the funny thing is, probably the first thing they're going to do is call the MSP: "MSP, please help us, we're in deep doggy-do." So I think there's an opportunity for MSPs to say to the client, in addition to whatever insurance you have, Mr Customer, Ms Customer, make sure that you have a cyber policy in case things break out.
Why do you want to have it? Because yes, you get that incident response, but also protection for things like fines in the case of a data breach. Fines under the Privacy Act are up to $2 million and more per incident. And the Optuses and Medibanks of this world have up to hundreds of thousands of incidents. So it's a scary part, but I think there's a lot of responsibility on the MSP to provide a little bit of that guidance and say, "Hey, talk to your insurance specialist, Mr Customer, Ms Customer, and make sure you have a cyber policy and you know who to call in the case of a breach."
Ben: Putting that onus back on the customer does sound like it's a safe bet, right? Then you don't have to collect everything. Collecting those details was probably not that great an idea.
Andrew: I want to jump in about something that's probably the biggest exposure that we see for MSPs, and that is bad advice. MSPs provide advice to customers, for example selecting applications, keeping the lights on, data migrations that move from Google to Microsoft, whatever it is. The trouble is, if things go wrong, there's a very good chance that the MSP could be held responsible. And that protection is professional indemnity insurance, not cyber insurance. So that's a distinction.
Just keep in mind that professional indemnity does not include cyber insurance. In fact, insurers have gone out of their way in the last four or five years to say, "Hey, we don't come anywhere near the cyber space." Our belief, and what we're actually seeing in clients, is that most of the exposure for an MSP is professional indemnity. It's providing that advice. In a data breach, the customer might end up blaming the MSP for that data breach: they left the door open, they switched off MFA, they didn't patch something, something as simple as that, and then they hold the MSP accountable. So even though it became a cyber incident, the claim is the bad advice, and the protection for the MSP is professional indemnity. Sorry, but I think it's an important distinction for people to know.
Ben: Well, we've actually got a question in the chat. How do you balance getting the insurer involved to help reduce the breach impact in real time, versus the risk of self-incrimination? For example, your duty to mitigate against the breach. Is that what professional indemnity helps protect you from in that sense?
Andrew: Absolutely. It becomes a bit of a duty of care, right? As the MSP, you're probably the number one go-to guru for anything IT for your customer, and if something goes wrong, you can't just leave your client to sink, can you? You've got to do what you believe is responsible. And if you do the right thing, no matter what it is, it's going to be reflected nicely in the claim. I don't think you'd have an MSP going, "Oh, sorry, can't help you, we're going to incriminate ourselves here."
Ben: Not entirely. Most of us got into it because we enjoy it, right? The first instinct for a lot of us is, "Oh yeah, we'll help," even if it is to our own self-incrimination or disadvantage.
I've got another question in the chat from Mark. Mark asks what happens when customers don't want cyber insurance. Can you give us some challenges that we might be able to go back to these customers with? Mark's got an example here: before Christmas a customer got breached, and as the MSP he got them up and running so quickly, in four hours or so, and billed them for it, but they were like, "Oh well, I'll just pay for that when it happens." So my first tip to you there, Mark, is you probably should just charge ten times that. That'll scare them. But Andrew, in your real capacity, what would you suggest?
Andrew: Yeah, exactly. It's a difficult thing, because the customer looks at their own risks and says, "Well, hang on, we don't want cyber. It's hard to get and it's expensive." So I think there's an opportunity for MSPs to say very clearly to the customer: your exposure becomes yours. If you have a data breach, you're not protected in terms of, say, a fine for the breach under the Privacy Act, and the business interruption. We are not responsible.
At this point I need to point out you probably need a lawyer, because it becomes very legal very quickly. So you might need a lawyer to provide some advice. But it really is an opportunity for MSPs to say, "Hey, the complexity of the world is just getting so extreme. You need to understand what your risks are and what your mitigations are." It's not to say that insurance is the be-all and end-all. It is not, it's only one risk mitigation, and there might be a whole bunch of things they can do to protect themselves without buying insurance. But if things really blow up, they need that insurance protection.
Aaron: Just for Mark, just for your incident there: it's probably really important to understand what incident response really is. What you're explaining, that you got them back up and running within four hours, that's awesome. I'm sure that, whatever happened there, you restored backups or images, right? I agree with Ben that you probably should have charged more. But I'm always interested in the root cause. What was the root cause, what took them down? Because what you did was just restoration. It wasn't necessarily forensic root cause analysis to figure out how that breach happened in the first place. All these things are really important for that customer, so you can then say, "This is what happened, and we need to make sure it doesn't happen again."
So Mark comes through and says the issue came from a user click-through, right? Okay, but that's where I would start framing questions around: "Guys, you can see how easily this happened. We need to not just put protections in place, you need detections," which we can talk about later. And also, like Andrew has been speaking about, incident response is really important. There are ways to do that through insurance. If they don't want to do it through insurance, there are other ways to have incident response companies ready. Andrew, tell me if I'm wrong, but I don't think you need to get into providing advice about whether they should have insurance or not. It all comes back to risk management, and what they're saying there is, "See, we don't need it, great, it only cost $1,500 this time."
I always talk about this kind of stuff, proactive security and insurance and all of what we're talking about today, as being like when we were selling backup 15 years ago. People were like, "I don't want to spend the money on backup." The second they had a data loss, they threw the chequebook at backup solutions. This security stuff is the same, whether it's insurance or proactive security. Until they have a real nasty breach, they're probably going to be like, "Do we really need it? I don't know if we really need it." And trust me, that one was only $1,500 and four hours. What if it was four weeks and 50% or 60% data loss, and their business could not operate, and there was reputational damage, and the board of directors wanted answers, and sister companies and vendors wouldn't work with them anymore? All of these things happen on the back of a real breach. I see it every day.
So having a root cause, a certificate, a report that says "this is what happened forensically, and this is what you've done about it and fixed it", that's worth its weight in gold. And that's when they'll probably start taking security seriously, which is unfortunate, but it's the reality.
Andrew: Absolutely. And Aaron, just to jump in there, Mark's point was that a user clicked through. For example, for our team, we have cyber training on a fortnightly basis, so every team member has cyber training, because we know statistically one of the biggest exposures is a team member clicking on the wrong link, and then that causing all sorts of problems.
Aaron: It's the main way in for ransomware.
Andrew: And we know that from the claim statistics. So cyber training is not necessarily buying insurance, but it's a risk mitigation that's really important.
Ben: That's a great one, Andrew.
Andrew: We recommend it like crazy.
Ben: We've got a couple of other questions, guys. We've got one here: "We've previously seen clients get breached, and after our remediation efforts have completed and our post-incident review and report is provided, we've advised them to seek legal advice regarding the mandatory data breach disclosure laws." Now, we heard about this a few years ago, but it's kind of died down, although I guess that's why they're on the seven o'clock news. The question continues: what risk is associated with that approach, assuming the client decides not to seek advice, or doesn't follow the regulations around data breach notification?
Andrew: Oh my goodness. That's on their head. Again, you might need legal counsel on this, and we're not lawyers, but it's their responsibility. If company A has a data breach, it's their responsibility under the Privacy Act if they turn over more than $3 million a year. It's on their head.
Ben: And that's changing as well.
Andrew: I think that's right. It's starting.
Ben: We've actually got another question that relates directly to that. Does anyone have any thoughts or details on the recent privacy bill changes? For those of you that don't know, and I don't know if they've actually gone through yet, the government is proposing to remove that $3 million cap for privacy breaches, which means even your local fish and chip shop could be liable. Does anyone have any comments around that?
Aaron: I asked about the changes to the privacy bills, and specifically the increasing fines for data breaches and all these things that are changing or have come in, at a roundtable about two weeks ago with about 20 companies. I asked whether it had changed any company's, CEO's or board's opinion on it. One person out of 20 said yes, they've started asking more questions. This was generally the enterprise and mid-market space, but it was interesting to see that it hasn't even really registered at that level.
Ben: I wonder if it's actually going to register at the other end. Exactly. All right, so we've talked a little bit about what to do in an incident. Now, the threat landscape is changing. Most people know that we kind of follow the US in a lot of areas, and what we're seeing in the US is that MSPs have to have actual MSP insurance themselves. I don't think that's here in Australia yet, but in order to be prepared, we've got things like ISO and SOC 2, which is why we've asked Jason to attend today as well. So Jason, from your perspective, with the landscape changing, what things in your opinion do MSPs need to consider over the next year?
Jason: Yeah, and look, from an ISO perspective, it's always been something that MSPs thought was only for the big boys in town, right? Your high end of town, your government jobs. And that was true six or seven years ago. I can honestly say that was more the landscape back then. If you did want to go for any government work, they were starting to ask, "Are you ISO 27001 certified, or do you at least have the management system within your organisation?" That was the bare minimum back then.
What I've seen happening now, and Medibank and Optus have really spun this up, is that it's now being driven by customers rather than by government. What I mean by that is every MSP on this call would have their one marquee customer that they bend over backwards for. They're great for profit, great relationships, all that kind of stuff. And I just ask the question: if they were all of a sudden to ask you, "Hey, have you guys got your ISO 27001 certification? Our insurance company is now asking for it from all of our suppliers," what would you do?
That's generally the catalyst for a lot of these MSPs to turn around and go, "Well, I don't think that I need it, but if my best client is about to leave, then I've kind of got no choice." So it gets driven by your own customer base now, and it's like: do I invest in the system itself and in making our business a better functioning business, because that is a benefit of putting in a management system? Or do I let my client walk, because they now can't do business with us? Because although we think we're hyper-secure and we've got all the best practices, an external authority hasn't tested that or signed off on it. So you get left in this landscape where you could potentially lose some of your biggest clients, not because of your service, but because you're not up to the standard they need their suppliers to have.
Ben: That sounds like a mid-market-up issue. But with the laws that are changing, and where we might end up in the next couple of years, does that impact smaller business?
Jason: Absolutely, I think it does. Going back to that one marquee client, if any MSP on this call lost their one marquee client, I'd say it would be massively detrimental to their business. So it's about mitigating every risk that you can in order to keep your business thriving.
The thing that's important to understand is that MSPs these days are generally doing a really good job with their clients. This is more of a formality and a nice stamp of approval, to be able to say yes, you are great at what you do, you have invested in the right technologies, you are looking after your clients in the best possible way. But without it you still can't verify that. It's still your word against others. And if it comes down to a 50/50 deal, and a client is weighing you up against one of your competitors who has the certification, that's something in their favour that you just can't possibly compete with. So I definitely see that certification is going to be pushed all the way through, even to the very small MSPs, because it's already happening now. I'm having a lot of conversations with MSPs that are just starting out and want to get it out of the way so that it doesn't become a risk for them in future.
Ben: It's interesting you say that, and I can testify to that being true. When we ran our MSP, we had a pharmaceutical company as a client. Like most MSPs, 80% of the revenue came from 20%, that core client base. We were doing a great job and had great relationships, but their regulatory requirements meant they needed ISO and those bits and pieces, and at that stage we didn't meet those requirements. We lost that client to someone else that met them. Unfortunately, it was one of the big guys, and they paid a lot more for it. All our contacts said they certainly didn't want to, but they didn't have a choice. They were a public company, and the rules are the rules.
So from that perspective, for those of you doing QBRs or even just general account management meetings, it would be worth asking your clients what changes are happening within their business, to try and stay ahead of that. We certainly weren't doing that, and it caught us off guard back then. It hurt. It really did. It was a major client that we thought was secure, and ultimately it wasn't. I think part of ISO 27001 is a recommendation that you should only work with vendors that have ISO 27001, right?
Jason: Yes. They go through those certain practices, and it could be a red flag.
Ben: But correct me if I'm wrong, guys, it's not a strict requirement. It's a recommendation, right?
Jason: Absolutely. The more organisations that are certified to ISO 27001 and working together, the more secure the overall ecosystem. That's the idea behind it.
Ben: A rising tide lifts all boats.
Aaron: But Ben, in my MSP days, I walked away from, I want to say, at least five deals because they were very strict on it. Like, "No, we want ISO. Put a strict plan together that you'll have it within 12 months." And I just said no thanks. I wasn't going to do it. I wasn't prepared to absorb the cost. We were obviously working with other frameworks and doing our own security in different ways, but I wasn't prepared to comply with ISO. It was more about the actual certification, getting a stamp.
Ben: Okay. So we've got another question relating to ISO certification in the context of cyber insurance. Andrew, how do cyber insurers look upon that? Does it have any context?
Andrew: Yeah, so just stepping back here. Three, four, five years ago, cyber insurance used to be the insurance you could not sell, and now it has become the insurance you cannot buy. I suppose that's the starting point. Because of the loss ratios: last year, globally, loss ratios were 120%. What that means is for every $100 of premium, the insurers paid out $120 in claims.
The insurers need to at least break even. It's not sustainable for them to make losses, for a whole bunch of reasons I won't go into, but they need to survive. They've been absolutely smashed, and it's not just here. It's London, the US, everywhere. So what they've done is reduce their capacity, which means they reduce the amount of policies or exposure they can take. That's the first thing. The second thing is that a lot of the syndicates out of the London market have lost their security altogether. So basically, the supply of insurance is reduced, premiums have gone up, and the underwriters have become very, very picky about the risks that they choose to back.
So the ISO stuff that Jason does on the data security piece is awesome, because it helps paint the picture that that particular risk considers their data security as something very important. It's not something that we see insurers requesting, but it's part of the story that we put together to say, "Hey, this is a great risk, Mr Insurer. We think you should take it on."
Ben: Right, and interesting that you say that. I know not everyone on here will have cyber insurance, but I do know that the cost of cyber insurance has quadrupled in the last year, and to your point, a lot of insurers aren't even offering it now. So if we're talking about that one- to two-year path, and if that continues, certainly having ISO is going to be a benefit. Because at the end of the day, if the client can't get insurance, it could impact your ability to actually provide your services to that client as well, right? Swings and roundabouts in that sense. And I'm sure most people on the call, if they haven't filled out their own cyber insurance form, have had to help a client fill out a cyber insurance form.
Aaron: Yeah, and that's changed over the years. I used to do this fortnightly, at one point weekly. And Andrew, you're the expert in this field, but the questions they ask change. They ask questions about all the things that ISO is asking you to do, as Jason was saying, but then you get into other things, which are all related. It's all the same thing, whether it's the NIST framework or CIS or ISO. They're asking the questions: do you have EDR tools? Do you have 24/7 coverage, which is a security operations centre, a SOC? Do you comply with any other framework? All these questions make up that picture and, like you said, make the insurer more confident, and I'm sure that changes the insurance premiums as well. I don't know if they'll actually tell you as such, but I'm sure it does.
Andrew: Yeah, and it's actually more about whether you get insurance or you don't get it. The price is almost irrelevant.
Aaron: Yeah. Because we're global, we have plenty of customers sending us their insurance forms, asking how our MDR product fits and how it works, things like that, in the States. I don't know if you've seen these ones, Andrew. I haven't seen it in Australia yet, but in the States they're actually now asking what product you use. There's a drop-down and you literally have to pick the vendor, whether it's Sophos, CrowdStrike or whatever. You have to pick which EDR tool you use and say you're using it, so you call it out. And as you know, Andrew, and I think everyone would know, that means if you're not using that tool when you go to make a claim, that's going to be a problem, right? Very interesting.
Andrew: Absolutely. And individual insurers have been burnt by different things. With SolarWinds, I won't name the insurer, but they got absolutely smashed by SolarWinds claims and breaches, and now it's a key question on their proposal. So there you go.
One thing I'd just like to say for the MSPs: be careful about completing the proposals for your clients. I would make sure that the client has reviewed the proposal, signed and dated it, and is comfortable with it, rather than leaving you on the hook in case the proposal doesn't state something it should, or doesn't acknowledge claims or whatever. I just put that little caveat out there.
Aaron: That's an awesome point, Andrew. I was very strict about it. I would never fill out the form for them. I would always write a second document answering the questions separately, or I would just mark it up as comments in Adobe or whatever, but I would never ever write the answers in for them.
Andrew: Well, because the proposal forms a very key component of the insurance contract. Whatever you put in there is embedded with two other documents, and that's the insurance policy combined.
Ben: Changing topics again a little bit, back to ISO but also other certifications in general. MSPs are having to really skill up across the board, and we've got a question from Paul here: are there other certifications that MSPs can obtain to help build credibility when it comes to work within the cyber security space? Jason, I'll start with you. Beyond ISO, what have you seen that helps build an MSP's credibility?
Jason: Yes, so I would start with ISO as the main thing that you need to look for. If you're offering cyber security services and you're not certified yourself, it's going to look weird to your clients. It's the one certification that is global, that is recognised across the world, so it doesn't matter where your clients are located. It's an all-encompassing information security management system.
Every country is going to have their own individual certifications, if you like, or different avenues to go down. A lot of people always ask, "Oh, what if we just do the Essential Eight in Australia?" And it's like, well, yes, the Essential Eight is super important, but it's not either/or. It's both. If you're launching a cyber security practice, I would say at a bare minimum you need to be ISO certified, as a lot of the cyber security houses in the market are, and then obviously you have everything else from there as well. Like Aaron was saying before with NIST, there are others out there, and they are not necessarily global, but it depends on what you want to hone in on, I suppose, and what services you want to offer to build your credibility. But absolutely, at a bare minimum, if you're going to be offering cyber security services, you need to be certified yourself.
Ben: I do wonder how many MSPs have an absolutely amazing tech stack, because I know how much MSPs love their tech stack, but don't tick that box. Aaron, from your side, you're in vendor land now, and I'm sure Sophos is an absolutely amazing part of every MSP's tech stack, but what else from a certification perspective do you see your partners doing?
Aaron: Well, you've got to remember there are frameworks and then there are certifications, right? Just like Jason was saying, ISO 27001 is the standard. You can align to it, but you can also be certified in it, and it requires recertification and everything around that. The cyber security frameworks are a little bit different. I personally love NIST. It can get quite complex if you dig in too far, but I like the concept of the top level, the five pillars of it, and I think that is an easy way to help start conversations. The CIS framework is really good. That's a more technical framework. So for MSPs out there looking to get started, look at the CIS framework, pick level one and start there. That's a good one to go with.
The good news story out of all these different frameworks is there are a lot of overlapping things, because they're all good. If you do a lot of things from CIS, there's a lot of overlap to NIST. Do a lot of things from NIST, there's a lot of overlap to ISO 27001. They probably all copied things off each other at some point. NIST came from a joint combination between the public and private sector in the US. And with a lot of the insurance forms, if you notice, you can see the questions are actually straight from NIST or from ISO. So there's a lot of overlap.
With ISO, I think it's really important, Jason, to say that ISO 27001 is not just about technical stuff. If you're an MSP technical person saying, "Let's go for ISO 27001," and you've never looked into it, you're about to find out it's a huge, all-encompassing business information thing. It's pretty big, and Jason's the one to help you get through that. I definitely wouldn't say take it on yourself. But the more technical ones are the ones you can take to your customers, in terms of, "Right, we can make some checklists and do some things," in that regard.
Jason: That's right. Summing up, Aaron, ISO 27001 is largely about protecting the information that's coming in and out of your business: all of your information assets, where you're storing information, all of your clients' personally identifiable information, all of that kind of stuff. So it's largely around securing information, whereas some of those other standards are highly technical and more on the technical control side. They are very different.
Aaron: Yeah, and like I said, they all have similar things. We talk about controls a lot. You just said the word then, and that's what triggered it for me. Andrew, you spoke about having training every 14 days. That's awesome, but it still doesn't stop someone clicking on something. It definitely minimises the risk a bit. In all these frameworks, when you go into them, they'll talk about all the controls you need to have, but then the detection and then the response, and all these things are really, really important.
That's why, if you've never done any of this, I love looking at NIST and the five top pillars, and just starting to get your head around that, because I think it's a really good starting point. The first is identify, which is identifying your assets and understanding what you have. Then protect, and that's generally where MSPs and IT people go. You think of protection such as backups and your antivirus and all those types of things. Detection is the next one, and that's really that 24/7 security operations centre stuff. That probably gets a bit scary for a lot of the smaller MSPs out there. There are very easy ways to do it now, but that's where the MSSP world comes in for detection.
Response is obviously how you actually respond when something goes wrong, and that's in my opinion almost the most critical part. You can do everything else right, but if you don't actually have a plan for when something goes wrong, then what do you do? Close your eyes and run around while the house is on fire? So that's important. And then recover, and that's how you recover after the event. That's why I really like those five pillars, because they get your head into a really good framework to then help with your insurance, your ISO and everything else that comes along the way. And to touch on Jason's point earlier, I think it's important that it's not just the top-down person. It's the whole organisation understanding those, making sure it's clear and concise.
Ben: Staying with the ISO piece of it: if we're going to go down that certification path, and it sounds like many MSPs are going to need to build that maturity within their business, what are the first steps?
Jason: Generally it's to get in there and see what you've got already. A lot of MSPs are running really successful, great businesses, and that doesn't happen by accident. It's because you've already invested so much time creating certain policies and making sure that when a new user starts at your MSP, you're not just copying the last person that started and giving them their permissions. If that's how you're running your MSP, you're going to be in for a rude awakening very, very soon, unfortunately. But I'd like to think in my heart that everyone on this call isn't doing those sorts of things.
So as far as where you start, you need to figure out what you've got already and then figure out what your gaps are. There are always gaps, because, like Aaron was saying, ISO 27001 is all-encompassing. It is quite a large standard. Gaps might be in the form of: you might see a lot of your risks, but you're not documenting those risks, and you're not actually mitigating or treating them where you can, and you're not actually having discussions with your leadership team and management about what you're doing about X, Y, Z that's happening in the market. So it actually does increase your posture over time, once you get used to operating within the standard itself. But going back to starting points, you'll have a lot of stuff already, and you just need to figure out what your gaps are.
Then you essentially go through a two-stage auditing process. Stage one is effectively an external auditor coming into your organisation and making sure that every policy and procedure exists, so that the management system is complete. Stage one is just about the writing. It's all documentation. Then shortly after that, if you pass stage one with flying colours and there are no non-conformances, you do your stage two, which is effectively external auditors checking for evidence within your organisation that you're actually doing what you say you're doing in those policies.
So if you say that you're training every team member when they come on board, then you want to have a record of that. You want to show that when this person started in July of 2023, they went through an ISO onboarding session and were told about the information security requirements for them as an employee, and how seriously you take it, things like that. Once you pass stage two from an evidence perspective, you get awarded your certificate, and from there it's basically 12-monthly external audits, which are called surveillance audits, and you dive into that each year. It's not as hard as the market has led everyone to believe. It is difficult, but like everything, as long as you've got the right help, guidance or resources, you'll be able to achieve it. There's no doubt.
Ben: Okay, I think that's really valuable. I know when we first started looking into ISO, it was kind of like, where do you start? One thing I thought was interesting, which Aaron touched on before, is the difference between aligning to an ISO standard and actually being certified. Can you run us through what the differences are?
Jason: Yeah. On an insurance form or a supplier form, you can tick that you are aligned to ISO 27001, and that basically means you've done all of the hard work. You've got your policies, and you believe you're running the system the way it should be run, but you haven't had an external authority or external auditor come in and give you that ultimate stamp of approval. So aligned, compared to being certified, means you're saying, "Yes, we have it," but it's not certified.
The risk with being aligned rather than certified is that some MSPs in the past have found it might be an easy way to save some auditing fees and just say that they are. But if you're saying that you are and you haven't been certified, it's a red flag in itself, because if you're truly aligned, you would be absolutely mad not to go ahead and complete that process and get your certification. So alignment is a little bit of a red flag from a 27001 perspective.
Ben: And Andrew, Jason touched on it, but from an insurance perspective, is that a red flag as well?
Andrew: You know what it is? You've got all these different insurers with different requirements. Cyber insurance is a relatively new insurance. It's not very mature. It's like a teenager: a bit pimply, does its own thing, looks like an adult, but inside it's just a five-year-old child. So there's lots of variation. This is unlike, say, professional indemnity or public liability insurance, which are very mature and have been around for 100, 150, 200 years.
So there's lots of variation, and each insurer takes a different view. But it's back to the insurance that you now can't get. You use the ISO stuff as part of it, and you say, "Hey, we're ISO certified, and there's a whole bunch of other things that we do to mitigate the risk." Because keep in mind there's no one silver bullet. Insurance is not a silver bullet. ISO is not a silver bullet. The detection stuff that Aaron has is not either. But the combination reduces your risk of taking a hit. That's what it's all about. That's the key to it. And for us as an insurance specialist, we have to paint the picture to make your risk look good, to be able to get offers from markets and get it placed.
What we're seeing become more important, particularly at the big end of town, is that they're requiring you as an MSP to carry cyber insurance to be on their panel. So whether you like it or not, if you want to play with a Qantas or a Rio or others, you need that. And then you need your insurance specialist, whoever it is, to help you paint that picture to secure a policy to enable you to do business.
Ben: That's interesting, because I think everyone on here, if they've gone for credit terms or whatever it might be, has had to put down their PI or however much they're insured for. So it sounds like that's going to be one of those extra questions where you've actually got to list your cyber coverage as well, eventually.
Andrew: Absolutely. It's only going one way, and that's up. Insurance is just becoming the normal.
Ben: It's getting worse. And look, I encourage everyone on the call: don't try and figure it out yourselves. That's why we wanted to present you with a couple of different experts here, and there are plenty of them out there. There are risks, but there's also margin to be made as well, wherever there is a risk.
But with that, that brings us to time, guys. I just wanted to say a huge thank you. It's been an absolute pleasure having you on the call. It was very, very engaging, and we had plenty of questions today, which is always good to see. If you do have any other questions from the audience, feel free to shoot them through. We will be sending around everyone's details, and we've got some assets that we'll be sharing as well, so make sure you check those out, and if you have any questions, let us know.
Just quickly, our next MSPs in Conversation is on April 18th: Streamlining Your MSP Operations, best practice tools for increased profitability. Very exciting. The other ones are subject to change, but April 18th is 100% locked in. As always, if you've got a topic that you would like us to bring to you, please let us know. Our marketing manager is always excited to have that chat, so feel free to reach out. Again, guys, thank you so much. It's been a pleasure.
Andrew: Thanks, everyone.
Ben: Thanks, Aaron. Thanks, Jason. Thanks, Andrew. Cheers, see you guys.
