As unlikely as that call may have been just a few short years ago, sadly, more and more CEOs and executive teams are facing that horrifying reality today.
Largely gone are the days when a small team of IT network administrators managed the IT resources, security and access for companies and organizations. With the proliferation of cloud services, cloud-based software and “technology-as-a-service” capabilities, scores of corporations and nonprofit organizations have embraced outsourcing their IT networks and infrastructure.
Today, those responsibilities largely fall to MSPs — companies that deliver critical network management services to dozens, hundreds, or in some cases, thousands of other companies, simultaneously and largely remotely.
For the most part, this has been a positive development for organizations as they can now outsource their IT support needs to a company dedicated to that endeavor, rather than focusing on an area of their business in which they don’t specialize.
These migrations, however, have not been without their hiccups. The quality and technical sophistication of MSPs varies greatly, as does the pricing of their services. Not all MSPs are created equally, which corporate and nonprofit executives alike have discovered in their searches for a provider that is the right fit for their needs.
Just when the business world has grown comfortable with this approach to managing critical data, access and systems, MSPs are facing a new threat.
Cyber threats and ransomware attacks, cyber targeting that infiltrates a computer network then denies access until a ransom has been paid or systems are recovered otherwise, have plagued companies large and small for years, as the business world struggles to stay at least a half step ahead (or behind, depending on your perspective) of the bad guys.
And now they’ve found a new target. Cyber criminals are infiltrating MSPs directly with ransomware attacks, leaving thousands of companies locked out of their critical data for days and weeks at a time, while helpless and powerless to do anything about it.
In one instance that was well documented in the news, a California company, Synoptec, was impacted by a ransomware incident that brought thousands of its clients to their collective knees for several days. More recently, during the height of the COVID-19 crisis, an MSP that serves mostly healthcare organizations experienced an attack that impacted hundreds of its health services clients, who were already struggling to provide services through these difficult times.
The threat is real, and the enterprise-wide risk to CEOs and business owners is significant. The solution isn’t to bring IT services or cloud-hosted platforms back in-house. Outsourcing network administration is still the right answer, and there are hundreds of outstanding service providers throughout the country who provide reliable services to organizations and create much needed flexibility and nimbleness.
That said, there are a few steps that all business leaders can take to provide reasonable assurances that their MSP is utilizing best practices to ensure their systems won’t be infiltrated, and that if they are, they can recover without issue. Depending on how an organization utilizes MSP services, actual risk may vary greatly. The steps are as follows:
The bottom line is that your MSP relationship can’t be a ‘set it and forget it’ endeavor. These relationships, like all critical vendor relationships, need consistent and effective management in order to ensure continued effectiveness. For these relationships, this has never been more critical.