3 Top Hurdles for Emerging MSSPs

Himanshu Verma

By Himanshu Verma, Director of Product Management, WatchGuard Technologies

We’re seeing tremendous growth in the number of partners calling themselves MSSPs — not surprising, since analysts project the managed security services market will surpass $40 billion by 2022. If you’re among the MSPs looking to earn that extra “S” in 2019, here are three things that could trip you up.

A threat landscape that gets more treacherous by the day. Cryptomining, ransomware and “ransomworms,” Russians infiltrating the U.S. power grid — this past year has seen advanced malware compromise millions of computers and mobile devices. From crippling attacks on private organizations across the globe to halting public services throughout entire counties, ransomware is a striking example of the type of havoc we see. In response, most of our partners offer business continuity services that include cloud backup and recovery and manual incident response. The concept — wipe out ransomed files and start new — is solid. But challenges with this approach include handling sensitive customer data and the costs involved in hiring incident responders.

As threats get more advanced, you need a layered approach to security that includes prevention and detection as well as response. When crafting such a managed service, include prevention against zero-day threats via dynamic, deep analysis as well as automated detection and response capabilities. Look to intelligent services that tap both internal and external threat indicators. In other words, don’t be reactive.

Lack of investment — and willingness — to change behavior: End-user education is one of the most critical components of an effective security program. But a recent study by MIT around health care security showed a lack of buy-in and understanding on the part of medical staff members. The MIT researchers said that arguably no one has a lower opinion of computer security controls than health care professionals.

Maybe, but active resistance by employees to security controls is a problem we see over and over, and it won’t be overcome with the perfunctory education that is often all customers will pay for. That creates a problem for MSSPs: Do you cramp your margins to provide extra training or to clean up after breaches caused by careless users?

Security sentiment and engagement among the end-user workforce play a critical role in a customer’s risk posture. Without an understanding of how attacks happen and a commitment to behaviors and processes that reduce their likelihood, customers are exposed.

My advice for MSSPs is, don’t skimp on in-depth end-user security awareness training. Build those costs into managed security offerings. Save by automating as much as possible — there’s a wide range of interactive, computer-based programs.

And don’t stop there. Engage with executives who can influence employee behavior. Without a culture of respect for security, your job becomes much more difficult.

One-offs, snowflakes and specialization. To make their services profitable, partners often templatize repeatable tasks, such as software deployment, customer onboarding and remote management and monitoring. They use cloud-based tools where possible to cut onboarding and infrastructure costs. Remember: MSSPs also make money by repeatability. Although customer security needs vary depending on size, industry and other factors, and melding multiple vendor solutions is key to …

… offering an effective and comprehensive security service, limit customization as much as possible. It’s the only way to keep total cost of ownership in check when it comes time to scale.

A complete packaged managed security offering must include protection for networks, endpoints and more (see diagram, left).  Whenever possible, look to consolidate by favoring vendors that offer integrated solutions that cover a few of these bases. Again, this can reduce costs and simplify management as you scale.

This is not a complete list. You’ll want to add your “special sauce,” possibly including your own IP, and plug in innovative solutions to meet new, advanced and vertical-specific threats. But conquering these challenges can help MSPs establish a strong managed-security services offering that creates new business opportunities and recurring revenue streams.

Himanshu Verma is director of product management for WatchGuard Technologies.