MSPs Welcome Proposals for New Cybersecurity Framework

The UK government is mulling a new cybersecurity framework for MSPs to prevent third-party attacks.

MSPs have become an increasingly common target for cybercriminals. That’s because hackers increasingly use MSPs as a single point of access to their clients’ sensitive data.

In 2020, the U.S,. Secret Service warned of an increase in such attacks. It noted that criminals are leveraging compromised MSPs to conduct a variety of attacks. These include point-of-sale intrusions, business email compromise (BEC) and ransomware attacks.

Elsewhere, Perch Security from ConnectWise recently predicted “the first moves by government and insurance providers to regulate the MSP industry.” The company warned that MSPs pointed to an increase in “Buffalo Jumps.” This is a new tactic that cybercriminals use to ransom a service provider and many of their customers at once.

Now the UK government is testing the suitability of a proposed cybersecurity framework for MSPs.

The proposals could require MSPs to adhere to a set of 14 cyber security principles called the Cyber Assessment Framework. The framework sets out measures organisations should take, such as having policies to protect devices and prevent unauthorised access. It would also require them to ensure data is protected at rest and in transit. Furthermore, it advocates for keeping secure and accessible backups of data and training staff, and pursuing a positive cybersecurity culture.

MSPs Welcome the Move

The proposal for the cybersecurity framework has been welcomed by UK MSPs.

Rick Gray is sales director at MSSP Cyberfit. The company acts as an adviser for MSPs that don’t have security expertise. This involves putting a security wrap around any offering the MSP is hosting for its end-customers.

Gray strongly believes that the government should implement the new framework, as “too many of these MSPs are doing the bare minimum. They think offering antivirus is enough — it’s just a tick box exercise. They say it’s secure when it’s not.

Cyberfit’s Rick Gray

“We had a client that hosted an exchange service for one of their customers and didn’t do the correct level of patching. So the customer got hit by the recent Exchange attacks. It’s a great thing that the government is bringing out these parameters for MSPs. There are too many out there getting away with it,” he said.

Ballard, Joanne_Maintel

Joanne Ballard, customer experience director at Maintel, believes a central regulation will benefit both suppliers and customers. She said it would provide “peace of mind to the end user that they are working with a trusted provider.”

Re-inventing the Wheel?

Mark Herridge, CISO at Calligo, says the Cyber Assessment Framework “is clearly a step in the right direction.”

However, he notes that “there is little if anything new … that is not already covered by established certifications.

“These are well recognised not only by industry, but also by end-user organisations. We are seeing an increasing number of potential customers openly favour MSPs that have these accreditations.”

Calligo’s Mark Herridge

He also said some customers even require their MSP to adhere to their own data security agreements. This is typically built off the principles of ISO, SOC and others.

Rather than re-inventing the wheel, Herridge said the government may be better off taking another route. It could do this by “simply stipulating that MSPs must attain and maintain these globally recognised certifications. If I were a potential customer, I wouldn’t contract with [an MSP] that did not have ISO 27001 as a minimum.”

Claudio Stahnke is senior research analyst, European Security at IDC. He said the UK “is certainly moving in the right direction.” He pointed out that the recent Colonial Pipeline hack has shown how vulnerable supply chains can be to cybersecurity breaches.

IDC’s Claudio Stahnke

Stahnke said the rapid growth of IT security means MSPs often provide cybersecurity even though they are not specialists. Regardless, he said “creating a framework that IT suppliers will have to follow will certainly help improve and level the field.”

He said this is required “in a world where the race between hackers and defenders keeps ramping up.”