We’re in This Together: Cybersecurity Tips to Keep You and Your Clients Safe

No doubt, the COVID-19 pandemic has us all in a state of bewilderment as nobody really predicted that in 2020 we would all be dealing with such a problem. Yet, here we are adapting to it. As an MSP, you are the first responder to business IT survival, and have surely been working tirelessly over the last few weeks to keep businesses online and functional. During this disorienting time, hackers and malicious actors have cut us no slack and are actively preying upon SMBs, hoping to catch them vulnerable for attack and/or exploitation. Both the U.S. Dept. Homeland Security CISA Division and the U.K. National Cybersecurity Centre are reporting elevated levels of cybercrime during the pandemic. At Sophos, our experts have also seen a substantial rise in COVID related domain registrations, some of which aim to prey on unsuspecting users looking for information.

As you prepare your clients’ remote work strategy, it is vital that you reinforce the importance of cybersecurity and provide services and cybersecurity tips that offer the utmost protection. From an unsecured VPN to a COVID-19-inspired phishing email, the threats are real and the war is on.

The following list of cybersecurity tips from Sophos experts combined with Sophos Central, the unified console for managing your next-gen cloud based solution, will help you to easily manage and secure both your clients and your MSP business. We are here to support you during these crucial times, so please contact us if you should have any questions with Sophos products/solutions.

While Sophos highlights the benefits of having a strong password, we also highly recommend pairing strong passwords with MFA. This ensures that only authorized users and administrators are able to gain access to mission-critical accounts, computers and other sensitive resources, even in the event where an attacker gains access to a password.

When providing cybersecurity tips, be sure to stress the importance of ensuring that all client devices, operating systems and software applications are protected with next-gen cybersecurity solutions.  Also make sure that the devices are updated with the latest patches.

Make sure the RDP solutions you are using to remotely connect to machines use 2FA authentication. An open port with RDP leaves you and your clients absolutely vulnerable to cyberattack. A recent Sophos test to gauge the vulnerability of open RDP revealed how easy it is for hackers to gain access. If you use open RDP you will be a target!

Cybercriminals are looking to exploit the inexperience of traditional office workers who are now working remotely. When it comes to cybersecurity tips, the importance of having security-aware users cannot be understated, especially as workers find themselves more distracted by news reports and daily life that is now askew. Regular training will better condition your clients’ end users to avoid phishing emails and other attempts for malicious actors to gain access.

Top of mind for every MSP setting up remote work for clients should be a secure VPN. Using a Virtual Private Network (VPN) ensures that all the data transferred between the home user and the office network is encrypted and protected in transit. Check out this community post for details on setting up a secure VPN with Sophos XG Firewall.

Home working will likely lead to a big increase in email as people can no longer speak to colleagues in person. As stated previously, cybercriminals are wise to this and are already using COVID-19-inspired phishing emails as a way to entice users to click on malicious links. Ensure your clients’ email protection is up-to-date, and raise awareness of phishing.

In the last few months, there have been over 136,000 new COVID-19 themed domains–some good and some bad. The malicious ones are serving up malware, phishing pages or other scams. Apply web filtering rules on devices to ensure that users can only access content appropriate for “work” while protecting them from the malicious websites.

Working from home may increase the chance of clients connecting unsecure devices to their work computer—for example, to copy data from a USB stick or to charge another device. Considering that 14% of cyberthreats get in via USBs/external devices, it’s a good idea to enable device control within your endpoint protection to manage this risk.

The rise of iPhone and Android malicious apps exploiting the pandemic should also raise concern for clients. Implement application installation restrictions and a Unified Endpoint Management solution to manage and protect mobile devices.

Times such as these can prove difficult for some organizations to adequately deliver the level of services that are needed due to the strain that the pandemic has placed. With Managed Threat Response from Sophos your MSP is backed by an elite team of threat hunters and response experts who take targeted actions on your behalf to neutralize even the most sophisticated threats. Sophos MTR not only hunts for threats, it eliminates them.

Most likely you have a communication system setup to stay in contact with your clients, whether it’s automated ticketing systems or a more informal process. Keep lines of communication open and give clients a quick and easy way to report security issues. The use of collaboration tools such as Microsoft Teams will enhance your client engagements and lead to better understanding of security plans and opportunities.

With large numbers of people working from home, shadow IT–where non-IT staff find their own ways of solving issues–will likely increase. Sophos recently discovered “public” Trello boards containing names, emails, dates of birth, ID numbers and bank account information. Ensure users report use of such tools.

As this article is titled, we are all in this together–MSPs, SMBs, enterprises, vendors, everyone, globally. Some of the best forms of advice that I have witnessed over the last few weeks have come from MSPs sharing what they are going through and what they are learning. There are many peer groups and social media groups for MSPs to get together virtually, and I urge you to search for those groups if you are not part of them already.

This guest blog is part of a Channel Futures sponsorship.