Evolution of the MSP

After almost three years, ACS returned to the University of Northampton for their ‘Evolution of the MSP’ event. Guest speakers included Steve Horobin of Arrow, Greg Bayliss of Cymulate and Stephen Harley of ACS. Arrow is a global supply chain partner to a huge number of customers across a growing breadth of markets, including transportation, medicine, industrial, telecommunication and consumer. Cymulate is a business committed to empowering organisations worldwide against threats as well as making advanced cybersecurity as simple and familiar as sending an email. As for ACS, they strive to help their clients perform at their best with a combination of tailored IT, telephony solutions, and workplace innovation through the latest office furniture and interior design.

After the initial presentations, the floor was opened for a round table discussion where attendees debated some of the biggest real-life changes in the world of technology during the past 10 years. One issue considered was that companies without a Managed Service Provider (MSP) could be at high risk, or potentially be missing out on supporting services and knowledge. Stephen Harley remarked that an MSP is important for having “that second perspective” to support the IT team. As technology becomes more advanced, it can be difficult to ensure that systems are both protected and supported. Therefore, an MSP is vital for keeping up with innovation. An argument can even be made that MSPs are in fact more important post Coronavirus, which has resulted in businesses allowing more employees to work from home. While this sudden and quick change is not necessarily a negative one, it has unfortunately left the potential for unsecure connections and actions to create security breaches.

As asked by host Connor Slasberg, “how does a business decide if they want their MSP delivering their security services?”. Some companies may want to have a level of separation and according to Stephen Harley there is a “very good case for having some of that split”. He also argued the importance of having a mechanism to validate what the business is already doing. Harley recommended using Cymulate for this, as it gives you a measurable score across many different aspects of your security. Greg Bayliss stated that it is paramount to “have access to that information yourself, so that you can undergo that conversation with your Board Members or Managers” addressing the potential dangers sooner. A positive of this “hybrid model” is that it is a “systems testing systems” model giving you continuous validation and removes the potential for human error.

An MSP is said to be brilliant for helping data protection. Immutable snapshots, for example, protect you from many hours’ worth of data loss. On the other hand, a backup (which can be daily or monthly) helps collect a larger amount of data and archive it. In addition to this, MSPs can help a company with aspects of data protection that are often missed, such as what has happened to any compromised information. Steven Harley commented that you “have to have the mechanisms to detect that risk” as any exported data has the potential to leave some exposure. An MSP can help with “patching up” that breach and providing those important layers of security.

One spectator asked, “what tools can we give people to help them be better at identifying cyber risk?”. Greg Bayliss remarked that “security took a back seat” during Coronavirus to make sure that people could do their jobs, while the host mentioned that we have to appreciate people aren’t always “techy” and information has to be provided in a consumable manner. He said that ACS has the responsibility to give “the honest advice on solutions that best fit that particular business”.

Another question from the floor, “is there a HR issue in forcing an employee to follow regulations such as Multi factor Authentication (MFA) on their personal devices?”. The answer from Greg Bayliss was that you cannot force someone to have their device managed; however, you can ask them to install an app on it. The alternative to this is asking the employee to be in the office every day in order to provide a secure environment. “IT should be there as a tool to make things easier for you, as opposed to blocking you from doing your day-to-day activities.”

The next topic covered, “what exactly does a Managed Security Service Provider (MSSP) look like practically?”. Stephen Harley mentioned that MSSPs “are usually embraced in security services” or they are a small group of pure play services that just offer a singular security service. It was remarked by the host, it is important to remember that MSSPs are a validation tool for the customer, which allows flexibility and obtainability. “It’s not a one size fits all” said Stephen Harley, “not every organisation needs the same set of technology”. However, according to Greg Baylis, “As soon as that implementation has been complete you will see value from day one”.

The round table discussion closed with each guest providing one piece of advice they would give to a Small and Medium sized Enterprise in the current climate. The answers included the “realisation that it is a post password world” from Steven Harley as it would help solve many breaches. “I think my single piece of advice would be if your car breaks you aren’t going to attempt to fix it yourselves” said Greg Bayliss “It makes it easier to bring someone in who knows what they’re doing” and the same goes for security. Steve Horobin ended the discussion with the importance of data protection, “In any industry, your IP is your data, if you’re not protecting it you’ve lost”