Cyber for Hire (Video)

Jugglers! Magicians! Freebies! You can find plenty of commotion and distractions on the show floor at the RSA conference or any major cyber convention for that matter. If you're a managed security services provider trying to sell your wares, it can be a challenge to distinguish yourself amid all the noise and chaos of events like these. This segment will offer tips and recommendations for making y...

It's a tough call for MSSPs: Be really good at a small subset of services, which potentially limits your customer base? Or become a jack of all trades, but potentially stretch your resources thin and risk the possibility that you won't be able to truly master any of your specializations? This session will hopefully help cyber service providers find a happy medium between these two outcomes, by exa...

Who won the Super Bowl this year? Everyone did, in the sense that there were no major cyberattacks that disrupted the flow of the "Big Game" -- unlike, for instance the Pyeongchang Olympics, where ticket distribution was affected on the night of the Opening Ceremonies. For contracted cybersecurity services providers, protecting a prestigious one-off event like a sports championship or political co...

Creating a zero-trust architecture is a gradual process that starts with understanding precisely what you need to implement a "never trust, always verify" approach within your extended organization. Rather than materializing all at once, organizations often develop a ZTA in phases over time. However, during this maturation process, gaps in zero-trust processes can form – creating potential weak sp...

Having a clear and cogent taxonomy that classifies your managed cyber services into distinct buckets or categories is an important step for MSSPs looking to define and differentiate their market offerings to clients. Customers can refer to your taxonomy to better understand your scope of services and ensure they don't leave gaps in their security plans, while you as a service provider can leverage...

What are the market trends that are driving growth and changes in the managed security service provider market? MSSPAlert.com, an affiliate of Cyber for Hire, does an annual survey of MSSPs to find out about growth trends, technology providers, different types of incidents they see in their work with small and mid-sized businesses, and other information and insights. In this edition of Cyber for H...

ChatGPT and all of its competitors are not just text generators, they are also powerful tools that can be used for good or for evil in the realm of cybersecurity. • What are the implications for MSSPs in the scope of their own services as well as the threat vectors for clients?  • What are the applications of generative AI for hackers and threat actors? • What tools are available or in development...

It's a tough call for MSSPs to make, but sometimes when a client relationship isn't working out, it may be time to cut your losses. Perhaps the customer isn't honoring its commitments to security hygiene; or maybe you're at odds over strategy; or it could be that they are a drain on your resources. This session will examine when to know it's the right time to go separate ways -- and what's the mos...

Now in its eighth iteration, the Center for Internet Security's Critical Security Controls (CIS Controls) framework provides organizations with 18 categories of high-priority best practices that they can follow in order to improve their cyber hygiene, while remaining in step with key regulations. In this segment, we'll look at what MSSPs and their client base need to know if they opt to follow CIS...

To what extent should compliance with privacy and security frameworks -- whether imposed by government bodies or industry standard organizations -- be the decisive factor when MSSPs choose their tech stacks and craft their threat defense strategies? Meanwhile, are would-be MSSP customers deciding which managed services provider to hire largely based on their compliance needs, or are they more infl...

Security is a shared responsibility between MSSPs and their clients. Yes, the provider was hired to do a job -- be it SOC operations, threat intelligence or offensive security -- but part of the job is also to consult and communicate with the client to help them gain some degree of cyber self-sufficiency. This discussion will reveal how providers can teach their clients how to develop a secure cor...

In the cybersecurity job market, it's "Advantage Worker," as the demand for talent has opened up a world of possibilities for security professionals to seek out greener pastures. Meanwhile, other infosec pros are so stressed and burned out that they're looking to quit the daily grind altogether. These factors have combined to create a cyber talent turnover crisis, which can result in organizationa...

In late 2022, the MITRE Engenuity foundation revealed the findings from its first-ever ATT&CK Evaluations for managed security service providers. The report measured various MSSPs' ability to recognize, analyze and report the TTPs of the OilRig Advanced Persistent Threat group. This session will dig into the findings to help MSSPs better understand where they can stand to improve when it comes to...

Once upon a time, organizations that relied on Macs or Linux machines could rest easy knowing that they were too few in number for cybercriminals to bother targeting them. This is no longer the case. As adoption of non-Windows operating systems has increased, so has the number of incidents victimizing devices running on these OSes. In this segment, we'll identify some of the latest non-Windows cyb...

For managed services providers looking to build their market strategy around XDR and MDR -- or a hybrid of the two solutions -- it's important to understand how this approach will shape future priorities for their tech stacks and toolsets, their clients and their vendor partners. What kinds of next-generation services can they build from an XDR/MDR foundation? How does this differ from a more trad...

Network difficulties can crop up at any time, as can possible attacks. And companies like having the reassurance that at a moment's notice they can reach out to their MSSP for help. This segment will look at how managed security services providers can operate a top-notch, responsive support desk that meets or exceeds their clients' needs through best practices and policies, optimal workflows and a...

In late January, CISA, the NSA and the MS-ISAC released an advisory warning about the malicious the use of legitimate remote monitoring and management software, after uncovering illegal hacking activity on two federal civilian executive branch networks. Whether compromised via social engineering or through exploits, RMM tools can grant unauthorized users potentially unfettered access to your MSP c...

The developer of a commonly used software issues an urgent out-of-band update for a coding vulnerability that is discovered to be under attack. Immediate patching is imperative. Under such circumstances, what can MSSPs do to quickly identify which of their clients are running this vulnerable software version? And then what are the best practices for managing and collaborating with these exposed or...

Security Operations Center services are in demand, as many organizations are unable to stand up their own full-fledged SOC. For MSSPs looking to add, grow or mature their own outsourced SOC services offering, a key early question is: Do we build from scratch, partner with third parties or buy these capabilities through a merger or acquisition? This session will look at the various pros and cons of...

In late January, law enforcement officials disrupted the operations of the Hive cybercriminal group, which has profited off of a ransomware-as-a-service (RaaS) business model. And though the takedown was an inspiring victory, there's plenty more ransomware where that came from. Indeed, Microsoft just reported that at the conclusion of 2022 it was tracking more than 100 threat actors using over 50...

The life of a Cybersecurity professional is not for the faint of heart. The job can be stressful, sometimes thankless. And when an attack transpires, you can work long hours knowing the fate of your employer is on the line. Or in the case of an MSSP, the fate of your client. You might even argue that being a managed security services provider magnifies the stress and burnout factor because you mus...

The advancement of artificial intelligence and machine learning has for years been both touted and feared in IT and cybersecurity circles. Still, the sudden emergence of the generative AI tool ChatGPT seems to have sneaked up on a lot of people. While ChatGPT can be leveraged as a tool for good to help write Yara rules or uncover vulnerabilities, it can also be misused by malicious actors to creat...

Some MSSPs have a hard time leaving their comfort zone when it comes to their toolsets. They prefer to stick to their own tried-and-true suite of tools and are reluctant to add new ones, even though it might be beneficial to do so. After all, not every client has the exact same needs and challenges. This session will look at how MSSPs can potentially boost their revenues, increase their subscripti...

No matter how well constructed an MSSP's security architecture is, or how tight its security controls are -- all that good work can be wasted or sabotaged far too easily when the client organization fails to follow standard cyber security hygiene practices. Just because a company uses a managed security provider to bolster its cyber preparedness doesn't mean they still don't have a responsibility...

Sometimes it feels like security professionals and business leaders are speaking different languages. That's why it's critical for managed security providers to communicate with their clients' financial decision-makers in a business-aligned manner that conveys how cybersecurity can help advance and protect the company's corporate interests. This featured topic will identify strategies for translat...