Why Security Must Be on the Menu in 2022 (No Matter Who Does the Cooking)
The simmering cybersecurity space erupted into a boil over the last two years. Since the pandemic, cybersecurity incidents have been on the rise, and the transition to hybrid working environments is one of the primary causes. Implementing the technology to enable a hybrid workplace does come with added risk, and businesses need to identify, understand, and mitigate that risk. Easier said than done, however, especially in smaller businesses where you’re less likely to find tech-savvy decision-makers and dedicated security professionals.
That’s what makes having an MSP provider that offers cybersecurity services so important. Not only can they help you deploy and manage the tools that can help your business grow, but they can also make sure you are protected from cybercriminals. SMBs are going to need help with that. Cybercriminals have been more active — and more successful — than ever over the past few years, and the conditions that enable their success are only proliferating. More digitization. More vulnerabilities. More unchecked risk. Dwell time, the amount of time the threat actor is in your system is down to under 30 days and the average cost of a breach is up to $1.8M. The recipe for disaster now cooks faster and does more damage.
So, let’s explore some of the latest cybersecurity trends, talk about what that means for businesses that are navigating their own digital transformation journey and discuss how MSPs can help them achieve their goals.
Get ready for a wave of SMB spending
SMBs are ready to spend on IT. A lot of this spending will be fueled by the need to support remote work. But implementing this type of technology is difficult for SMBs, so they are turning to MSPs to leverage that vital technology. According to research conducted with Analysys Mason and Hanover Research on SMB and MSP technology needs and insights and presented in “The SMB Opportunity for MSPs: 2021-2026,” 48% of SMBs plan to prioritize IT modernization as a key business goal, with 30% looking to move more systems to the cloud, and a whopping 58% looking to boost security. We forecast SMB IT spending will reach $90 billion by 2026.
Besides keeping their data secure, SMBs also struggle to deal with regulatory compliance. According to “SMB Opportunities for MSPs,” over 40% percent of SMBs don’t understand how to navigate the frequently changing compliance regulations related to IT. As a result, they will turn to managed IT providers and cybersecurity experts — not just for their technical capabilities, but also for their knowledge of regulations and how to adhere to them.
Here are the top six reasons SMBs are making investments in cybersecurity, according to the survey:
1. Safeguarding company data, communications, and intellectual property
2. Guaranteeing customers’ privacy and legal requirements
3. Compliance with regulatory and legal requirements
4. Growth of mobile users and connectivity to the corporate network
5. Protecting physical assets and infrastructure
6. Digitization of company business processes
The rise of the triple ransom and other improvements from hackers
Ransomware gangs are improving their methods to target more businesses, increase the number of victims who actually pay up, and maximize the value of each attack. Last year, we saw the rise of double ransom: encrypting data and holding it hostage for one fee, and promising not to release the data for another. The genius of the double ransom is, even if a victim could restore the data from backup — and thus not have to pay the ransom — the ransomware gang can still demand payment to ensure the data that was stolen doesn’t see the light of day.
Ever the tinkerers, cybercriminals continue to innovate their extortion schemes. This year we can expect the triple ransom to come into vogue. The triple ransom builds on the double by adding DDoS attacks and threats of contacting clients or partners of the victim to coerce victims into paying. This can have a devastating impact on businesses, as it can further disrupt operations and tarnish the victim’s reputation.
But after a few high-profile attacks last year, hackers are starting to attract a lot of heat, and they’re changing their methods to continue their operations without detection. One way they will do that is by avoiding targets that will generate a lot of buzz, steering clear of critical infrastructure like a pipeline operator or a large hospital network. Instead, they will focus on smaller businesses in mundane spaces — a victim that can actually pay a ransom, but doesn’t serve some overly important function in society that would attract a lot of heat as a result of a breach.
People will exacerbate the hybrid working cybersecurity problems
The inherent risk that comes with a hybrid working environment is exacerbated by workers themselves, particularly the younger workers aged 18-24. According to the HP Wolf Security Rebellions and Rejections Report, about 30% of workers across the globe are “unclear about security policies or unaware of them altogether,” and 34% said that they see security tools as “more of a hindrance than a help.” Only 36% said that they “received additional training on how to protect their home network.” Users aside, management can also be a hindrance to good security practices. According to HP, 76% of IT professionals “felt security had been forced to take a backseat to business continuity during the pandemic.”
This doesn’t sit well with IT professionals. Eighty-three percent of IT teams surveyed by HP said that home working has become a “ticking time bomb” for a network breach. And this trend will continue until businesses implement passive, less invasive security tools and do a better job communicating dangers to and training their employees.
If the trends aren’t changing, then why would we expect the course to change?
At the onset of the pandemic, roughly two-thirds of all workers were trapped at home because of COVID-19. The moment restrictions were put into place, virtually every business — no matter how far along the digital transformation journey they were — had the same goal: digitize processes and implement remote working solutions as fast as possible.
Hackers saw the decentralization of the workplace as an opportunity, and they took their shot. According to the FBI’s 2020 Internet Crime Report, cybercriminal activity exploded at the onset of the pandemic. The FBI received over 790,000 complaints in 2020 — nearly twice as many as the year prior — costing victims $4.2 billion in losses. Notably, ransomware attacks nearly doubled, while identity theft nearly tripled from 2019 and 2020.
Not much has changed since then. Today, lockdowns and restrictions are mostly over, but more workers are working from home than ever before. According to the HP Wolf Security Blurred Lines and Blindspots Report, 23% of office workers globally expect to predominantly work from home post-pandemic. Another 16% said they want to spend half their time working remotely, and the other half in-person. In other words, only a hair over 60% of the workforce expects to be in the office full time.
The crime spree has gained momentum in the last two years, and is likely to continue. In the FBI’s 2021 Internet Crime Report, nearly 850,000 complaints were filed, totaling $6.9 billion in losses. The surge of activity accelerated as the year moved on. According to ConnectWise’s 2022 MSP Threat Report, there were more attacks in Q3 of FY 2021 than in Q1 and Q2 combined. The study also found that over 60% of businesses have experienced a financially damaging cyberattack in the past 12 months. Considering that none of the underlying conditions have changed and hackers are getting better, more elusive, and coming up with new ways to maximize payouts, we don’t anticipate the momentum to slow down.
MSP growth will be driven by cybersecurity spending by SMBs
As SMBs rely more on MSPs to digitize and secure their business, MSPs will not be able to survive without some sort of cybersecurity solution in their portfolio. Customers are going to expect security. You don’t have to manage it yourself — there are many options, including partnering and acting as an agent. It doesn’t matter who does the cooking, but security has to be on the menu.
Cybersecurity is a worthy investment for MSPs, especially for those with a taste for growth. MSPs that offer cybersecurity and compliance solutions are expected to grow to 70% to 80% this year, and MSPs using outsourced SOCs and NOCs are expected to grow by 80% percent, while those that provide outsourced help desks are expected to grow between 30% to 50%. Forty percent of MSPs attribute their cybersecurity success to the certifications earned by their SOC and NOC staff.
Conclusion
The red-hot cybersecurity space doesn’t appear as if it will cool off anytime soon. Hackers are more active than ever, and they’re cultivating new and innovative ways to steal data, especially after businesses were forced to digitize their business and enable remote working. SMBs are the prime target, especially now that attackers have attracted a lot of unwanted attention.
But MSPs can certainly play a big role in slowing it down. As SMBs digitize their business in tandem with an MSP partner, they can rest assured that solutions are being put in place with cybersecurity in mind. After all, fully automated, 100% efficient processes mean nothing if someone can use those tools to rob you blind.
John Schweizer is Vice President — Channels and Business Development, Connectwise. John has had tenured runs in key executive positions at office equipment giants like Alco Standard-IKON, Ricoh and most recently as the CEO of a Xerox owned company. He also had principal ownership in a dealership in San Diego. John currently serves as a member of the advisory board for the cybersecurity firm, Fhoosh.
