Adding Cybersecurity to Your QBR

Happy Friday afternoon, everyone. I'm Zach Keeney, joined by Matthew Fish. Welcome to another MSP Cyber Roundtable. Make sure you check out last week's webinar. We had Teddy and Michael from Shield for a discussion about the difference between vulnerability management and penetration testing. If you're new to the roundtable, make sure you check out our educational video library on YouTube and be sure to like us on LinkedIn. Today we have Wes Spencer and Alex Richey joining us from Empath Cyber. Excited to have you guys. We'll do full introductions in a moment, but first, how are you guys doing? How was your week? What's going on for the weekend?

Hoping to get on the bike for myself, I'll tell you that much. Um, but I'm doing good. The kids are with my parents, so we got a quiet house. Um, life is good.

Are you, are you the road bike or the, the, the like off-road bike type?

Yeah, no, I'm a road. Yeah, I've got, well, I've got a hybrid bike, but yeah, I like I like to do trails, so paved or gravel.

Yeah.

Are you excited to get on the bike because it's been a long week and you haven't been able to, or you usually are during the week, or it's just a weekend thing for it?

Just haven't got to it all week. Been way too much going on. So yeah.

Yeah.

That's awesome.

Well, I'm empathetically excited for you and your workout.

Good word.

Not planned.

I, I get on the bike for my 2-block commute, but it doesn't count as a workout.

I, you're better than me because I'd be counting that thing. I'd be telling everybody I'm biking all the time.

How about you, Alex? Have you left your house this week?

I would have to bike around the house to, uh, to use it as a commute, but, uh, no, I was down at DattoCon, so busy week.

Okay.

Yeah.

And I'm gonna nap this weekend. That is my plan.

It's definitely a busy week. How was DattoCon?

It's busy. We'll go with busy. Um, there's always a lot going on there. Uh, my liver needs a break, so, so here I am with you fine gentlemen.

Perfect. Awesome.

So they're going to keep— it's going to be— they're going to continue with the, the brand there, or DattoCon?

It's not, uh, well, I think I don't know what the name of it is. I'm old, so it'll be DattoCon for me as long as they hold that conference.

Awesome.

Well, shall we do— go ahead.

Yeah, let's— before we go into today's topic with the team here and intro— well, intros first, right?

Yeah, please.

Okay, full intro. So, and you guys are— it's not Empath Cyber anymore, right? Do you want to give us the download on the new brand and who you guys are and what you do?

Yeah, for sure. So yeah, we're just Empath and we decided— so Empath Cyber was something that I was building you know, as a sort of a lifestyle brand, as, you know, helping MSPs grow in their cyber journey. And Alex is the one that came alongside, said, Wes, you're thinking too small here. There's something here for MSPs in a much bigger way. You know, we all need help in growing and learning and building a better MSP. And one thing that Alex and I have been friends for years now. I remember when I first met him way back in maybe 2019, something like that. And we've always stayed close. And I think the stars really aligned to a much bigger vision of what we're doing, what we're building, helping MSPs grow in their journey across all things, not just cyber. So how to build finance and operations, revenue, technology, all of these things that are critical to MSP's growth. So we're sort of building a community of communities and a platform for folks to come in from across the board and come and learn and grow. Alex, what do you want to add to that? I know there's a lot more to it that I didn't, uh, I didn't put in there.

Yeah, I mean, it's just, it's the same problem that MSPs always have, right? And I think Eric Woodard said it to us best. Got 67 portals to log into, and I don't even know how to begin to onboard a new employee. So, you know, that's a problem that we've got to solve. How do you onboard? How do you upskill? How do you take an employee and really give them a career path at an MSP? Because right now, um, they feel like it's a, it's a tough slog, and all of them don't necessarily know what the rest of their, uh, what the rest of their life is going to be.

So look at that, and Alex is hot right now.

I am.

Yeah, I was gonna say something, but I didn't want to make him uncomfortable.

Hey, uh, that's awesome. I've never seen it do that.

When you—

Wes, when you said, um, Alex and I have been friends for a long time now, since 2019, I don't— there was like an earthquake in Toledo for a second. That's a long time, 2019.

Well, it's before, before COVID right?

From the before days.

Yeah, right, it was.

We've been friends for like 7 COVIDs now.

It was the BC era that I knew Alex. But yeah, it's funny when you start— when you, when you get into the startup startup world, you start thinking in terms of like, people will ask me sometimes, I had this, um, uh, a friend, a kid of my friend was in this entrepreneur class and my, his, my buddy reached out and said, hey, can my son interview you? And first question out of the gate was, where do you see your company in 5 years? And I looked at him, I said, hey, your teacher's not an entrepreneur, is he? And she, and he goes, no, how'd you know? I'm like, because you can't ask an entrepreneur anything about 5 years from now. That's literally impossible. So I think 3 years, I think, right?

Gone.

That's an exit plan for a lot of entrepreneurs, right?

I mean, if it's not an exit plan, it's at least like beyond the edge of the horizon, um, by any measure, right?

Very true, very true.

We've got some, some interesting folks joining us. We've got Amsterdam, Ghana. That's awesome.

Great.

Texas, also very exciting.

So, um, and I'll just do my quick intro. Matt Fish, founder of Fort Mesa. We help MSPs and other service providers own their client cybersecurity roadmap. Today's topic is one of my favorites, so I can't wait to get into it. But before we, before we jump into Control of the Day, Zach, you want to do quick, uh, yeah, sure.

Uh, Zach Keeney, um, Channel Sales Director, co-founder with Fort Mesa. Time prior, grew up in an executive development program and owned a small restaurant franchise for a few years after that. So I'm looking forward to having a people-based conversation with you guys because I definitely think that's a very key part to growing a business is your people. So awesome stuff.

All right, guys, we're going to jump into Control the Day. So, uh, today's control is in, I think, 12, 12 subparts. Um, CIS Controls version 8, control domain 4, secure configuration of enterprise assets and software. You know, when we talk about secure configurations, there's the technical, I guess, meaning of secure configuration, and then there's the, you know, security jargon meaning of secure configuration. And in the security world, when we talk about secure configurations, what we mean is that someone has made a thoughtful decision about what would be a secure configuration anywhere where there's a choice to configure something, really, what is the security preference? And that we have implemented it everywhere we can and that we are enforcing it everywhere we can in some way, making it stay turned on. Maybe we're reporting on it. In CIS Controls, they've prioritized the configurations that they think stop most cyberattacks. So I'm just gonna fire on through as fast as I can, but before I do that, let me just explain that in CIS there's 3 implementation groups: IG1, IG2, and IG3. IG1's for small businesses. They're probably using off-the-shelf software. They're probably not regulated. IG2 is for businesses that are perhaps a little bit larger. They may have dedicated IT staff. They probably have some type of business application. If they're very small, they may have regulated data that's not very sensitive. IG3 is reserved for organizations with the most to lose, complex organizations, organizations that have highly regulated data, and definitely any organization where a security or technology failure could impact human safety. So there's different— and I'll just page forward for a second here to show you at the top end of this list, you'll see that there are controls that are not required in IG1, and there's only a single control that's considered, I guess, low value or maybe high value, but only for the most complex situations if you're trying to block the most risk. You know, it's the further down this list you go, the more expensive these things get. So at the very top, though, is starting a some type of configuration process. We used to refer in the IT industry to something called change control. We still use that term, but the idea here is to create a process where you decide the way things should be, how should things be configured, and then have some way of updating it, managing it, reconfiguring it, making sure that it's accurate, up to date, reportable. This might be a one-page document with a human process description of Joe goes and looks at the things. Joe checks and makes sure they're still configured. That's fine. 4.2, establish the same processes, but for network infrastructure. So we wanna dig down into things like switches, firewalls, routers, access points, things like that. We wanna also make sure that automatic session locking is turned on. This is something that a lot of users, you know, it's a resistance area for some users. They don't want their screens to automatically lock. But just about any organization should have automatic screen locking if they expect to stop the types of in-person physical attacks that can happen casually in a public setting.

I'd love to get opinions from everybody here. Matt, if you don't mind, what's an appropriate amount? I mean, I'm sure it varies.

CAS has guidance on this, but yeah, let's do hot takes. Wes, what do you think is like reasonable?

For what part was it?

Session locking. What is like a good guidance there?

I mean, I hate to use the lawyer definition of it depends, right? But I do think it depends. It does depend on the asset and the information you're protecting, right? So if you're in a SCIF in the military, second you walk away from that thing, it's everything's locked, everything's out, right? I think it's fair to say in many systems that are low, low, lower priority, 30 days even if it's got sessions that have been validated through multifactor, you know. So I think you can even, you can even. So I think what you have to do with a lot of these things is you really have to say what's the value of the assets that we're protecting and what does that device have access to and then make a reasonable decision based upon it. But I do think if you load multifactor on top of it, you can certainly make the argument that, you know, it could certainly be, you know, 1, 2 weeks or more for a regular system priority. But I do think it needs to be documented and created in policy first and accepted by the board before you start making those decisions. Because where you get yourself in trouble is if you make it too short, you frustrate and anger users. You make it so long that it never expires, and then you all of a sudden have a real issue at your hands.

Alex, you gotta— what's your take?

I think the only thing I would add to that— I mean, Wes knocks it out of the park, so we'll, uh, he made my job easy. But the only thing I would add to that is like, where does this device sit, right? If it sits on the front counter where somebody could spin a screen around, That's way different than something that sits behind a controlled access door, you know, and in a place where the public isn't walking regularly. You know, that machine in your doctor's office that's never appropriately secured, that needs to be locked way before, you know, the device that's secured behind two locked doors and somebody has to walk past a receptionist and be in a place where they don't really belong.

So I think, I think CIS has guidelines for mobile devices and for like laptop desktop. They don't go into all those scenarios, right? For mobile phones, I believe it's 2 minutes, which isn't an option in most mobile devices. A lot of mobile devices go from 1 minute straight to 5 minutes, so you have to then back it down to a minute or 30 seconds or something, which can be frustrating for some people. The desktop's 5 minutes, but you're right, Wes Spencer Spencer Spencer, you know, if you're in a highly sensitive situation, you have a CAC or a PIV card, right, that goes into the machine and it's like literally attached to your person. And if you stand up, you pull the card out and the machine just— yeah, locks.

Interesting. I was going to ask about that. Like, what is there, like a sensor in the seat? And as soon as the butt's out— I haven't—

I haven't seen that, but I— it might exist someplace. It's usually the cards are attached to your person and also the machine.

Yeah, because it's a little bit of a dual situation there. You got to have the card and have it on.

Yeah. Anyway, um, I'm going to run through some of these pretty quick. Yeah, 4.4, um, implement and manage a firewall on the servers. So just make sure you have firewalls turned on on servers by default. Don't leave them open. Don't leave all services open. Only open the services you need for that server. Same thing for end-user devices, have the firewall on by default. Securely manage assets and software. This label is a little nebulous. What they mean is if you're connecting to it over a network, you're using encrypted authenticated protocols, right? So as an example, and I don't think it's as popular as it used to be, VNC, which is a screen buffering protocol, is typically not encrypted, and even when it is encrypted, it's is not typically encrypted to the point where we would consider it to be secure. So you want to make sure your remote access to things is secure using, you know, standard encryption or secure encryption. I'm gonna run through these last few. So 4.7, manage default accounts on enterprise assets and software. That's really just making sure that, You know, if there is a default account that ships on something that you buy, like a database server or a piece of hardware, that someone's gone in there and they've changed the default password. Um, I, uh, I can think of a lot of high-profile vendors that still to this day, um, ship very sensitive, uh, pieces of software or hardware that have default passwords on them, and that should not be allowed to go into production. Now, everything I just named, 1 through 7, Center for Internet Security says should be for every type of business. But let's go into some of those more advanced or higher complexity controls. 4.8, uninstall or disable unnecessary services on enterprise assets and software. If you're on a Windows computer, there's tons of software that gets shipped onto that machine that you're never gonna use. If you're using a— a machine for office collaboration, you probably don't need like the gaming services enabled on that system. They should just be turned off. So that's an example. But someone should make a decision about what serves a business function and what can be turned off.

Matt, the chat's exploding with people that disagree with you about the gaming situation. I don't know what that's about.

Unless you're on the help desk, right? Um, so 4.9, configure trusted DNS servers. Um, you know, what we're talking about here is not relying on your ISP. You know, ideally you're running your own DNS infrastructure, or you're relying on DNS infrastructure that you pay for, like, um, Amazon's or Cloudflare's, right? Make sure that that's a trusted infrastructure. Don't use like a consumer, a consumer like Wi-Fi access point for your DNS because those are routinely hacked. 4.10, automatic device lockout on portable end-user devices. So what we're talking about here is if you enter the wrong password n number of times, disable the device so someone can't just try all the passwords and get in.

Um, and that one's a respond instead of a protect because it's assuming that if— it's assuming something's up at that point, I guess.

Yeah, the device should react to like an attack basically, right? Which is if you lose your device on a bus, someone can't guess the password. But also if you lose your device and you leave it someplace and someone takes it home and they plug it into an attack box, they can't keep trying passwords forever because eventually the machine you know, after 10, it'll wipe itself. And then, of course, remote wipe capabilities, 4.11. That's usually something where someone says, "Hey, I lost my device." And, you know, you say, "Are you sure you can't find it?" And the user says, "Yeah, I definitely lost this thing or it got stolen." And you see just a little click in the admin console, make sure that all the work-related data gets erased off of it. And, 4.12, and let me just point out, 4.12 is only recommended for those highly secure environments, high-risk environments, high-regulated environments, separate enterprise workspaces on mobile and user devices. This one's actually difficult. So if you're using like a Samsung phone, they have this thing called Knox. Google has a similar functionality where they can isolate work-related data. You can accomplish some of this on an iOS device, but basically what they're saying is if the device can be taken into a field and the user may be using this for personal use, that the work stuff and the personal stuff is really separated. So, phew, 12 parts there on that one.

It flew by. Honestly, I enjoyed it.

I really enjoyed that one. I tried to do— I literally covered all of CIS yesterday on a webinar, all 150-something controls, and this one just killed me.

Did you do like a 24-hour stream or something? It was—

I had a 30-minute slot.

We basically just did this one control in a 30-minute slot, so that's amazing.

Yeah, and Bob makes a really good point here. If you really need to do this, you're probably better off having separate devices. That's the easy way for sure.

That's a good point.

All right, so I'm done with controls. So let's— topic of the day, guys, um, adding cybersecurity to QBRs. Um, this is like at the core of what we do is, you know, we work with service providers to introduce these cybersecurity, um, right-sizing practices, right? The cybersecurity value messaging right into that account management conversation. And it's hard, right? You know, some end customers, you know, when they're in that conversation with their service provider, you know, they feel confused. They don't engage in the conversation. So, How have you seen these conversations lead to success? I don't— I don't know if who we want to start with here, but I've certainly seen a lot of ways those conversations can go badly. We could start with the ways they can go wrong if you want.

Well, I thought we just did that. We just finished all the nerd words, right?

Right. If that's what your sales conversation sounds like, you've done something wrong.

Don't do that. Rewind 5 minutes. Don't do that.

Fair, very fair.

Yeah, yeah, I was just gonna say quickly, um, when the question comes up of who should go first, we literally have the king of QBR with us on the call, Alex. So if you notice me continue to be like, Alex, why don't you take that first so I can look smart later, um, that's what I'll do because I don't know what I'm talking about anywhere near as much as he does when it comes to this.

Yeah, so Alex, um, your, your last, your last ride on the motorcycle, you were, you were like deep in QBR land, but was that like Is that where you learned this practice?

I mean, you know, I think we were good at it at my MSP. We weren't great. And yeah, I'm going to be that vendor who admits it, like I do it better now than I did when I had an MSP. But, but, and you know, it's easy for vendors and it's so frustrating when they come out and go, oh, I was wonderful at my MSP. No, you weren't. You were just like all the rest of us. But I spent the last 4 years and that was all I did. And I worked with 1,100 partners and every single one of them said something smart. And I went, oh, that's— we should build that into the platform. And so, you know, by building a platform that our partners helped us build, we got it right. And, you know, I think that's the, the magic to, to that, is not that like Alex was some magical QBR genius or, you know, whatever. It was that we opened up and built a community around it. We had a bunch of really smart people each contribute their one little nugget, and now we have, you know, a nugget of, of what that knowledge should look like. So from the really high end of it, it's strip out the nerd words and have a real conversation, right? Talk to the customer in the language of their business about their business and relate cybersecurity back to that. And because if we lead in with, let's go look at CIS controls, they're glazed over and taking a nap. And then we call them again for the next QBR, they're going to go, I attended one of those, can we never do that again? And that was the number one piece of feedback we got from customers was My partners don't want to come to a QBR, so they literally tell me everything's fine, we don't need to talk.

Daniel dropped this question in our chat and I just want to bring it up because this is like literally the textbook QBR scenario, right? You're having the business conversation with this, with this customer. You're trying to figure out how do we right-size the security, right? So would I consider them IG1 or IG2? Well, my answer to that is, well, I'd have to have a conversation first. So what, what would that conversation look like?

Well, my answer to this is real easy. Who cares if I care more than they do? Doesn't matter, right? It's never going to happen. If they actually care about security, then we can continue the conversation. And then the conversation looks something like, this is where you are today. This is where we want you to go. This is how much money we'd have to spend to get from one spot to the other. If I give you a number like that, are you going to throw me out of here on my ass, or can we still be friends? And if the answer is we can still be friends but I can't spend it all today, then maybe that can be an IG2 customer where we really build them a strategic roadmap that gets them from where they are today to where they're going. But one of the things MSPs fail at is they go in and go, look, you're IG0 and I need you to be at IG1.75, and that's going to cost you $100,000. $1,000,000. And the accounting firm goes, get out of my office, please go away, don't ever come back. And the conversation's over, right?

And then you're done, guy.

Go ahead, Wes, please.

Well, I was just going to say, the other thing I'll add to that is what we're talking about is two different things. We're talking about a floor and we're talking about a ceiling, right? So, so when we talk about— I think they said IRS, but it's FTC safeguards. So we're talking about FTC safeguards. That's the floor. That's like, what do I have to do to make sure that I am not going to be fined when we ultimately have some kind of incident and we have to report it to FTC and then we— it's shown that we're not meeting the requirements, the minimums. Right. And so there are going to be some things in FTC safeguards. I just did a big long workshop on this a few— a couple of months ago. There are some things in FTC safeguards that are IG2, but there's a lot of other things that are not in IG1 or IG2. For example, things like who owns cybersecurity, who's been the designated person that actually owns all of cyber risk reporting. CIS doesn't really talk about that. They assume that you have that role in place. So there's a floor, which is FTC safeguards. And then I think it's fine if you want to say IG2 is going to be the ceiling. That's the objective we're going to strive to. We're not going to get there right away. It's going to take us a couple of years to build towards that. And that goes right into what Alex was just saying, where you've got to set the expectations of the client, make sure that they're willing to go down that journey and understand it.

So I would— go ahead, Matt.

Well, Steve just brought up this point about the government only mandates minimums. And so yes, there's parts of the government where, where they mandate minimums, um, particularly in the DoD, right? Um, and, and in other places maybe it depends on contract, but in, in large parts of the government actually, they, they want you to bring, um, your security posture to the table. They say, here's all the security things you could do. What are you doing? And part of that story you're telling the government is here where I am now, here's where I'm going to be in 12 months. I'm on a journey with my MSP and here are the dates we're going to do all those things and here's the committed project plan. And the government does accept that. It does depend on the contract. They, you know, sometimes they'll have some minimums, but they do like to see you're going someplace. There's a journey. They understand this is a journey. They understand this is going to this is going to take a while.

Yeah, 100%.

And there is— there, I think— I'm not sure whether he was talking about FTC safeguards or that IRS 4557, because there is one that mandates accountants do some really, really simple basics, um, but that one's terrible. Like, that is literally the bottom of the barrel basics, um. And, you know, at the end of the day, it doesn't matter if you're a 1-person office or if you're a 10-person office. If compliance requirements the same, 10-person office finds it a whole lot easier, right? There's, there's less, less issue with the cost of compliance. And 100-person office, it's even easier, right? So per person, this gets harder and harder with a really small business, and you really have to digest and dissect, to Bob's point, the, um, the stomach that your customer has for spending that money and whether or not they're on the same journey. You can't care about their network and security more than they do.

Right?

And that, that builds that place where everybody on Reddit runs out and says, fire the client. And if we fired every client who disagreed with us, we wouldn't have any. So instead, we have to find a way to navigate that journey and figure out what the acceptable minimum is and make sure that I'm okay carrying the risk that they're unwilling to pay for.

Well, and I think you, you pointed out a really valuable point, um, kind of in the beginning of this conversation, which was the client that you're dealing with may have had an experience where somebody didn't do a great job of communicating, you're at 0 and you need to get to 2, or, you know, 1.75. And maybe they're extremely averse to even the conversation itself. So if, if you haven't taken the time to understand, well, what has their experience been in the space already, and you're just diving into, this is what you have to do. I mean, you don't know what kind of resistance points are, are on the other side of that human being who's had infinite experiences up into this experience that they're having with you now.

Well, so, you know, one of the things that, that I tell service providers, and this is what I experienced when I was a service provider, was that, you know, part of that, part of that conversation you're having, whether it, whether you call it an alignment call or a review call, a QBR, um, it's not necessarily to sell today's plan, right? Sometimes it's painting people's options for directions they might move into the future. Sometimes it's Hey, end business, we are comfortable with where you're at with security. You're comfortable where you're at with security. Some of the businesses that look just like you are actually up here on security because they're very worried about this or that. They're very worried about confidentiality. They tried to get cyber insurance and they needed to be here. You're okay where you're at. But if you want better security, you know, think about it. And, you know, if you're trying to get cybersecurity insurance or one of your customers is asking you for third-party due diligence, Or, you know, you know, you're very concerned about an incident or you really can't tolerate losses, you know, come back to us. We have this upgrade. So you're not always going to get like, okay, I'm ready to upgrade, right? During that review, right? Like you might have that conversation how many times? Like, and then, oh, you're right. I've been thinking about it since last time we talked. Or you have the conversation and then like 2 Thursdays from now they're like, oh, this thing happened. That you discussed, right? And that I think it's preparing the customer is, is, is the goal, right? Not necessarily selling the customer.

Well, I, I want to— if I— if, if you don't mind, I would love to just like asterisk one of those words. You said preparing the customer. It's not, it's not preparing the customer, it's educating the customer. They have to know what the hell you're talking about. They have to understand the scope of The industry is here. This is what security looks like. This is what I have. Before you can even begin to have a conversation that sounds like, and you should spend— because if you ask somebody to spend before they feel like they understand what they're going to put their money on, they're either spending because they're scared or they're spending because they don't care about how much they spend. And we all hope to be in that situation. But if you're in the first, as soon as they're not scared anymore and they realize that either you haven't solved a necessary problem, or you have but they hadn't thought it through all the way, or now they're looking at their, their bill and they realize, well, well, wait a minute, what is all this for? You're setting yourself up for an uncomfortable next experience. So, well, it's, it's—

we used to, we used to kind of joke about this at Lifecycle Insights, like The typical MSP enters every QBR the same way. Knock knock, I need money, right? $2 widget, $4 widget, whatever it is. Like, I'm just coming in here to ask you for it. And the point about, about education and preparation, those two go side by side, right? The education comes in doing a small risk assessment and saying, hey, Mr. Customer, this is where you live today, and this is the risk and the exposure that you carry with you into tomorrow and the next day and the next day. Until you choose to behave differently. Now, behaving differently has a cost, right? Breaking up with the status quo has a cost, and the status quo has a cost too, right? We stay here, we probably get breached, and we probably have a, a really expensive incident. But if we talk about that and somebody said, you know, do you think we should be putting a dollar value on risk? Um, I don't think so. I think it comes across very, you know, very fuddy. It's very much that, that fear selling. I'd rather put a dollar value on education and sit down with the customer and say, I'm willing to spend the time to show you where you are today and what it costs to do something better.

Yeah.

And this is where budgeting is key. If every MSP on this call— think about your favorite client, your best client, the one that does almost everything you tell them to do. Who in that organization— and they're a good organization because you like them, um, you know, they're obviously good folks— who in that organization is qualified to budget for all of their technology spend? Any of you put— were able to put somebody's face with a, or a name on that title, I'll be stunned because the answer is nobody. Nobody in that organization can tell them how much money it costs even to replace all their technology and buy the next license for Adobe and the next line of business. Nobody can even put all that together, much less tell them what security looks like. That's your job as the MSP. You literally have one job and it's to not show up and go, knock knock, I need more money. It's to say 12, 18, 24 months from now, we're going to be looking for you to make some difference, Ben. We're going to be looking for you to do that server project. And that, you know, it's 20— 2012 is dead. If we haven't replaced it by now, we've got a problem, right? We should have been talking about that a year and a half ago. And so if we're setting it up, instead of the customer going, well, maybe I'm willing to spend some money today, instead you come in for the third, fourth, fifth QBR, you go, remember that thing we talked about the last 4 times? Today's the day, the money's due. I'll take the check when I leave, right? And that way they're prepared for it. They know it's coming. And Service Leadership just, just released their annual profitability report, and they showed that MSPs who do that, who have a regular strategic cadence with their customer and who provide budgeting as part of that, make double the margin on hardware. Double. Because the customer doesn't bitch about it. They're not out there looking on, on, on Amazon to see what you sold them because they knew it was coming. They had a chance to prepare for it, and it's not as much of a shock. Your customer hates the way you sell them because you're selling them instead of coaching them and informing them and educating them and helping them.

And they're probably okay paying a little bit more, right? Not having to feel like they're looking over your shoulder at all times to, is this a reasonable quote? Is this like, do I really need to spend this? Like, if they just trust you, right?

Well, think about it like this, Matt. If I said 12 months from now, I'm going to need $5,000 from you, you can plan for that. You can You can live your life a little differently. If today I said tomorrow I need $5,000, you're going, shit, there goes my vacation to Disneyland. I gotta go home and tell my wife. Crap, right? Those are completely different situations.

Yeah. So we got a pile of questions here that are maybe the types of questions that come up during these types of security conversations with clients. So CMM asks, Do you agree with putting a dollar value amount on risk? Um, this is actually a polarizing issue in the security industry. Um, I'm just going to declare I'm on this side of the table that thinks that, um, putting dollar values on risk is a bit of a fool's errand. I don't think that the dollar values are ever accurate. However, the process that you go through into putting dollar values on, um, on risk can sometimes expose risk that you wouldn't expose in other ways, right? If you're forced to actually put dollar values on, sometimes the conversation will lead to places where you're exposing areas of risk that otherwise you wouldn't have discovered. The other thing is, if you have a really large organization and you're having many different risk conversations, you have to in some way balance the boat to figure out, well, which part of the organization has higher risk, which has you know, higher security, you need to be able to level set everything. But it, it is really basically impossible. And the insurance industry tries, but they're, they're certainly not winning here. It's really hard to put real dollar values on, on risk.

Yeah, I love Jeffrey's response to that. It's not a question of what it will cost. It's a question of what you can lose. And yeah, and I heard Wes Spencer do a bit and I'm going to steal it from him. But Wes does a little bit where he says, if we took that little piece of your business over there, that little thing that rings the cash register for you, if we took that and it was gone tomorrow, what would it cost you?

Yeah, Jeff asked this question. Now this isn't the way a client would ask it, right? But this is actually a thing that people are whispering about now. If you're out, if you're in Europe, it's a little scarier. But here in the US, even, we're hearing that perhaps public companies, people that are servicing public companies, people that are serving the financial services industry will have to report on nonconforming clients. Unless you can put up a legal shield, right? You know, and there's security providers and even MSPs that work through attorney-client privilege. But, you know, clients that are willing to put up with that kind of separation, right, typically are not the ones that are nonconforming, right? I don't know where we're going to go there. I don't know if you guys— what you guys are hearing, but I'm certainly hearing there's many people that are lobbying in Washington for that right now, that MSPs should have a responsibility to report on nonconforming.

Yeah, it's—

that means— yeah, I'll just—

I'll say I think it's really backwards. And I, you know, I know regulators. I come out of banking. I've dealt with them. My strong— and I, I would publicly say this, I'll publicly say it now— how dare you as a regulator try to push the nanny state upon MSPs to make them do the work they're pushing forward. If you push to me as a bank, X, I must do X, Y, and Z, and then you say, but we don't really—

not gonna—

we're not going to put any teeth in that, and we're going to rely on someone else to have to report when someone else is not doing it, you've turned this into a nanny state, and you've totally broken the whole purpose of why regulations exist, right? So I, I don't— I dislike regulations without teeth, and I dislike regulations that occur without the regulator themselves being able to have some mechanism to enforce enforce and, and actually check to make sure those things are in place. I mean, sure, we have whistleblowing laws, right? But that's a totally different— that's for like legal kinds of stuff, like I saw something unethical happening, I need to report it. This is totally different. So I really hope we don't go that way. And let's be honest, look at some of the industries that do have regulations but don't actually have a mechanism to go and check and make sure that they're being followed. They're weak and they don't have respect.

The bad actors get, get an advantage in that scenario, I think, is what happens.

So that's— yeah, Matt, you're absolutely right. And I want to equate it to something that I think that probably everybody is experiencing, because if you're an MSP, you have employees. And, and I mean, we all regulate what's happening in our own environments, right? So if you want to equate it to to regulations without teeth, to rules in your business that you don't enforce. I mean, a regulation without teeth is, hey, you know, I want you to use the company laptop, but the guy that doesn't use the company laptop never gets in trouble. You're never gonna have everybody using the company laptops. It's always gonna be the, the people that want to do things the right way are going to frustrated at the, the, uh, lovely folks that can't seem to be willing to do things the right way. And it never changes.

You know, there may be people in Washington, um, you know, rallying for this or whatever. Um, it's a fool's errand. It is, it is the worst possible thing that could happen to this industry. MSPs already have crappy relationships with their clients.

Sorry, guys.

No, it's like what Bob said. All of a sudden now you've introduced a rat on the ship, right?

I love it. Who in the world— who in the world is going to have an open, honest conversation with somebody who they're worried about them reporting them to a regulator for? You cannot have a business relationship where the person who's responsible for keeping you secure and helping you spend within your budget is that person who also is responsible for reporting you to the police. It just— it cannot be a thing. It would destroy the industry. And what are— what's everybody going to do about it? They're just going to bring all that stuff in-house. And they're going to go, oh, well, you work here and you signed a document that says you won't report anything unless you're subpoenaed. So now you can't do it. Go to hell. Like, it's not a thing. Well, your paycheck's on the line for it. And put the thumb down.

No, they're also threatening. They're also threatening right now, the same, the same people are whispering. And I— this one's a different issue, right? But should MSPs be held accountable for a minimum level of best practice.

And until, until the MSP gets signing authority on the bank account, how can they? Right? A lot of these things cost money. And as an MSP, I can't make my customer pay for it. And imagine the disservice we do if we say the MSP is responsible for a minimum standard and the minimum standard is way up here. Now every MSP has to double, triple, quadruple their price to meet this minimum standard. What just happened to the small business who's already struggling. Now they can't afford IT of any kind because the MSP is held to a standard. And what are they now? They're just fricking winging it and they're all going to get breached.

This is what we see in the price inflation in government contract, right? Where you have these requirements that then, you know, they're not even all security requirements, right? There's just papering requirements that, you know, they can increase the cost of the contract, right? A lot of it's built up around the idea of making a level playing field or putting accountability into government spending, but it actually, it creates a substantial cost burden, right?

And there absolutely should be best practices, and that's where CIS is headed, and they do such a good job because not only do they say these are the best practices, but this is how we tier them, right? It'd be like Greg mentioned, the MSP equivalent of GAAP accounting processes, which is absolutely fantastic, right? But imagine if you couldn't afford to do all the GAAP accounting processes, but You could say debits on the left and credits on the right, right? Okay, we can do that much. That's easy, that's cheap. We can start there. What's the next thing and the next thing and the next thing? How many MSPs are out there taking their, you know, their big prepaid project that's gonna take a year to perform and moving money around on the balance sheet and doing all of that? Well, that's generally accepted banking process or generally accepted accounting processes, but a small MSP is not moving money around on the balance sheet holding money in deferment until they pay for that portion of the project. It's just not happening, right? So we have to accept that this is a growth phase. This is a, this is a thing that every business has to grow into. And as somebody who's launching a brand new company, you're not flush with cash to go out and buy hundreds of thousands of dollars in security, right? You're starting over, you're starting from zero, and you've got to build that into your process where it makes sense.

Yeah, I want to come into one thing Tim said way below. Tim Golden, he mentioned SROs, self-regulating organizations. I mean, that's the ultimate, I think, ideal happy place on where we should land as an industry. Um, for those who don't know, you actually know what these are, right? If I say the Bar Association, you know what that means. Those are— that, that is a state-accepted— every state in the union says the Bar Association is who says who's a lawyer and who's not. They have an entire process, they have the authority to do so, and they are self-regulating. We have those in many different industries. We have those as a doctor. Well, who isn't— who is a doctor? How do we know that they're a We don't have that as MSP. The reality is we are not going to have that anytime soon. That is not something that's going to happen tomorrow, next year, maybe not even the next 5 years. I mean, I think there's some things that could drive it, you know, like another, like, mass-level, like, you know, MSP-driven incident of some kind that's far more damaging than anything we've ever seen. But short of that happening, it's going to take a long time because you have to have every state— basically, each state has to say, yep, we're going to sign up to— who is that regulating body?

How—

what defines an MSP? What are the standards that we need to have in place for that? If I had to wave a flag for it right now, I'd say Trustmark from CompTIA, right? Because at least they are starting to plant a flag in the sand of what good looks like, and it's aligned to CIS, right? I'm a huge fan of CIS, but I think the reality is we're just a long way from that happening. And unfortunately, there is no barrier to entry to being an MSP, and there is a difference in the service quality that's given from from MSP A to MSP B to a client. We've gotta get that standardized. We gotta get better, but we're just in the infancy of this. We're very, very early into this.

Yep.

And I love Trustmark. I think it's a great place to start. You know, it's actually advanced, but it also comes with some, you know, some auditing, someone coming along and saying, "Yes, you're doing what you told me you're doing." Yeah, that's a good point. To Daniel's point, he says there should be some kind of a standard of accountability for the MSP. How about we start with a standard of accountability for software, right? Why, why when you buy 365 is it in the most insecure configuration possible with a dashboard that says we sold it to you out of the box with a 12% security configuration, right? It has a security dashboard in it. It tells you how poorly it's configured the day you buy it. Why isn't it 100% secure the day I buy it and I have to turn things off and I have to click on a box that says I I accept all the risk.

I have it. So it's been—

it's always been Microsoft's configuration, right?

That's secure by default is where we start, is where we should start, right? Because then every time you turn off a security configuration, you get to— yeah, you know, what is your MSP? I can't even do this for you. You need to come in here and I certify that this is what I want as a customer.

But you're right that I think, I think that, yeah, this is going to have to be a little bit grassroots, right? The industry has to has to put it together themselves. But I would not, I would not argue that it won't be done for us if we don't do it, right? Because if we spread the timeline long enough and we just sit here and we don't self-regulate, right, that, that big event you're talking about that's worse than it has ever happened before, it will definitely happen, right?

If we don't—

Seguramente. Increasingly more likely. So, you know, most industries, you're right, it's been happening at the local level, right? Or at least, you know, regional, state level here in the US. But there are some industries that couldn't get it together, right? And it— like, like, for example, financial securities, right? The federal government stepped in and said, you know, as a regulator, they were like, look, people who are selling this stuff have to be licensed at the federal level because we don't trust you.

But think about what you just said. You said people who are selling this stuff. That is Microsoft. That's Google, right? We're asking the mechanic— we're asking the mechanic to be responsible for installing the seat belt. That's how backwards we are, right? The mechanic changes the oil, rotates the tires, gets the car after the customer already wrecked it, right? We walk into a totally unregulated environment that somebody set up themselves, and then we're saying the MSP has to be responsible for all that. What is an untenable conversation in a QBR? What the conversations that we're having with our customers are already hard enough for us to go back and say, yeah, you bought it that way, but I have to totally re-engineer it. That's going to cost you hundreds or thousands of dollars and more money every month. It's an untenable conversation for the MSP, and this is why it's such an uphill battle.

I think when we see regulations tend to— as they begin to come, um, or as the, the industry leaders begin to set the, the, the stake in the ground. And Wes, you mentioned Trustmark. I think that's a great point. I also think you'll see other larger organizations put, you know, stakes in the ground, whether it be big MSPs that are like, hey, we stand for this, or whether it be, you know, organizations like CompTIA, or whether it be actual regulations. I think that we would rather it not be actual regulation, and you'd rather see those big— the giants in the industry, so to speak— react to the movements of the mechanic and say, yeah, you're right, let's work together better so that somebody doesn't come and make it hard for all of us. Because I And I mean, I think it's up for debate, but from my opinion, my stance is that we would prefer to not see sweeping regulation.

Well, I, I would prefer that too. I'm not going to say that it would be totally unwelcome for the federal government to do something like what they did for critical infrastructure, where they said, you critical infrastructure providers all over the country, have to be working with some kind of cyber information sharing organization. You figure it out. And then the industry self-regulated because they were told by the government to figure it out.

Figure it out.

Well, but that's what happens. And that's why, that's why the prevailing thought right now at least is that insurance will get to it faster than the government does.

Right.

But to carry that, that analogy just a little further, imagine if you went to the, to the mechanic and said, remove the airbags and seatbelts.

Right?

I like that guy.

And imagine a mechanic does it. Now, is he liable? Probably, right?

So, well, it's the same argument as like an assisted suicide, right? Is the doctor who, you know, is that person liable?

I mean, it's, it's, I mean, so that I know is secure, that is actually configured to the minimum standard, and then I start to take all that off, should I be liable? Probably. But I can't make my customer do MFA if they don't I don't own that Microsoft instance and I'm borrowing it and playing along with my customer who owns it.

Alex, you're on to something here because this is the precedent that is being desired to be set by the White House. If you go look at the National White House Cybersecurity Strategy that came out this summer, not that it's a legally binding document, it is not, but it does set forward some of the big objective— objection— objectives and sort of like the ways that CISA is thinking, passing this towards the White House of where we should set. And I think what you will see at some point point is, is some type of legislation enacted that's pushing upward. And it basically says we need to see those that are creating the software be the ones that we need to push the liability upwards to them. Because if we push the liability upwards to them, then what's Microsoft going to say? And I'm just picking on Microsoft, but you could pick on ConnectWise or Kaseya in our space or Intuit or whoever.

If we push it—

You're being very fair with your picking on. I'm sure they all appreciate it.

Yes, I just mean, I mean, that's— it's predicated on that. Because if we push the liability upwards and they say, well, we better push downward a better secure configuration, because otherwise they say I can hide behind a EULA and I have no liability.

Like, that's— you check the checkbox.

So Apple's sort of like, they've already adopted this mantle, right? Because they decided there's a market differentiator there, whether it's a perception or other otherwise, right? They do have this mark. They've succeeded in the market perception, right? Particularly for their iPhones that, and there's some truth to this, right? That those devices are out of the box secure by default. You know, they were the first vendor that when you booted up a laptop, you know, a macOS laptop, the first thing it did was encrypt, right? They were the first vendor to do that. Same thing on the mobile devices. They're now working actively to stop about the types of advanced attacks that people can, can use with hacking tools that plug into the phones, right? And they're trying to block those attacks. These are things that some of those other vendors aren't doing, but, but it's because of their market position, right? So how do we, how do we take that type of, uh, position differentiator that they're saying, this is our place in the market, right? How do we take that mentality and say, well, this is, this should be the general, this shouldn't be a market position, right? This should be a market requirement.

Isn't it crazy that like houses locks on the front door as a market differentiator. Like, that's what— right, we're back to seat belts, like cars with seat belts. But that's where I think, you know, you don't go to the, the consumer and say you're responsible for putting a seat belt in your car once you buy it.

But I want to make an argument of that, because when you were describing, um, pushing it up, I was having memories— and people are going to laugh at me, and that's okay— I was having memories of the movie Fight Club, where he's describing his job. And maybe this is going fall on, on, on missed, uh, missed, missed ears. But the, the character's describing his job. He works for an organization that's insurance-based, and it's around like, they know there's levels of risk, they know there's failure, and there's decisions on that that get made at a high level. And I think you're right that those people making those decisions at the high level first should be where the conversation is taken. Not when, when is enough enough. It should be, you know, we should get it right the first time.

Yeah, who's responsible for making that decision, right, to not secure something? Yeah, I, I guess, is it a choice is the question. Did anyone make a choice?

And, and I mean, just look at MFA. We know for a fact Microsoft published the number: MFA stops 99.8% of account takeovers.

Over.

Seems like the day they found that statistic, they should have flipped a switch. Well, we got really far off the QBR conversation. Sorry for my—

okay, but these are, these are the types of conversations— not that you want to blame your vendor stack, like blaming your stack, right? These are the types of conversations that are informative with the, uh, the end customer, right?

To say, look, and that's why I love secure by default.

Like, you, you actually, if you want to be secure, we have to do something. We have to actively do something.

And I think that's where the, where that car analogy comes back, right? Mr. Customer, imagine if you bought a car and it had no roll bar, no roll cage, like no, no, uh, you know, no, no seat belts, no, no airbags, maybe not even doors.

And it had the ashtray though, right?

But you could pay extra for all those things. And it had the ashtray, right? It had the sharp stick you could poke your eye out if you wanted to. And that's, that's how you buy email today. And so we have to go secure your email. And that's how you buy line of business apps. So we have to go secure them. We have to have that conversation with our customer. We have to make sure that they understand most technology, when you— when it gets handed to you, is default insecure. It's, it's wide open. And that's to make it easy for you to pick it up and consume it, right? Because the, the vendor only wins when you consume it. So I want you to consume it and I'm going to have a logical conversation with you around at what point we keep securing, securing, securing, securing to the point at which security gets in the way of you doing your job. And that's the point at which we need you to raise your hand and say, this just doesn't work. Like we locked it down too much. I can't even send an email anymore. The banners were okay. Blocking some zip files was all right, but now you've checked enough checkboxes that I can't send email. Everything's getting blocked.

I can't play TFT and we're going to have problems.

All right, so, um, we probably could have spent more time on QBRs, but like there's books on this, right? Research reports, products, um, cybersecurity should be part of the QBR. The conversation should be about what makes sense for that customer, right? Um, what, what's their risk threshold? But, um, yeah, I think that's, that's it for QBRs today, guys. You want, you want to, uh, you want to give us like a longer empath? Elevator here?

Go for it, Alex. Oh boy, you on the spot, man.

Am I on the spot? Okay, so yeah, I mean, at the end of the day, we understand the position that MSPs are in. I ran one for 17 years. Wes has been hanging around this industry for quite a while since his perch days. And, um, you know, both of us are kind of passionate educators. So when we got talking about Empath, the conversation really turned to, um, And I'm going to use another— what I thought was a brilliant analogy when somebody said it to me the other day. I don't remember who I'm stealing this from, so I'm giving some anonymous person credit, but MSPs are like college— are like college sports teams. And if you think about a college sports team, they're always building because at some point, 4 or 5 years down the road, everyone graduates and leaves. They have to bring up a fresh batch of recruits. You guys are not hiring from Facebook. You're not hiring from LinkedIn, or you're not hiring from Google, you're not hiring from Microsoft. If you were, you might even be less secure, but that's a whole other story. But we know that you're hiring the kid from the AT&T store or the Starbucks or whatever, and you need to onboard that person quickly, get them up to speed in helping you ring the cash register. We know you need to continue their education while they're there. Something that always stood out to me was that there's no such thing as a career pathing tool in the MSP space. So what we're aiming to build is the education that helps you take that entry-level person and say, what do you want to be when you grow up? And let us help you build the career path for that person with education, with content, uh, and with a desired goal in mind. And a little bit of accountability for the employee and for the employer to make sure we give them the time to upskill, to become something better than the kid that we hired and stuck in a corner and said, just go close tickets all day. That's what we're going for at Empath.

Solid pitch. Makes me want to grow an MSP.

I know we have credit card, you know, we'll have credit card, we'll MSP, right?

And we're in, we're in cyber compliance management and vulnerability management. Our mission is really to be the chief coach and cheerleader for service providers that are building that cybersecurity services unit or service delivery and formalizing it and really, you know, building that MSSP function inside your service provider. Um, with that, I think, uh, I think that's all the time we have for today. Uh, Zach, you want to dial us out?

Let's do the thing. All right, everybody, thanks for, uh, thanks for joining us. Um, another great Friday at the MSP Cyber Roundtable. Be sure to like us on LinkedIn, subscribe to our YouTube for more educational content. Wes and Alex, this was awesome. You guys Great. Thank you so much for joining us. Be sure to come back next week. We're going to have two returning guests. Uh, we're going to be having Michael Bakayak from Iceberg Cyber, um, and Brian Gillette from Feel Good MSP. We can't wait to have those guys. We're gonna have a great conversation, um, around whether or not you're charging the right prices to your customers. So should be fun. Thank you guys again. This was awesome.

Have a good one, everyone. Thanks, guys.