Cybersecurity Masterclass with Chris Cochran and Wes Spencer

Oh, Chris, I don't have you on audio, my brother. I don't know.

There we go. What is going on, everyone? I'm, uh, Chris Cochran. I am the Chief Evangelist and Advisory CISO at Huntress, and we are here today to talk about something really, really cool that we have going on in August. We are doing a road show specifically for managed service providers, MSPs, about cybersecurity. There are a lot of folks that are in the MSP space, cybersecurity isn't their first language. Most of those folks come from IT backgrounds and have had to learn along the way for cybersecurity. So we thought, what is one of the best ways to show up for the rest of those MSPs out there than to go on a road show with my good friend Wes Spencer? Wes, go ahead and introduce yourself real quick.

Well, first of all, can I just say I am super excited for two huge reasons. One, I'm on a livestream with the one and only Chris Cochran, which is the coolest thing ever. It's been so good to get to know you, Chris, and I'm really excited about this whole thing. And then Huntress, I mean, you guys are just amazing people. So thank you for having me. So yeah, a little bit about me if you don't know me, I love MSPs and I've been in the MSP ecosystem since the days of Perch Security that we started way back in 2016. And man, I do all kinds of stuff. I'm in cyber insurance, I'm VP of security strategy at CyberFox, and I'm the founder of Empath Cyber. And really the heart and soul of my being is helping MSPs in their journey in security. So Chris, it's so good to be with you and thanks for having me.

Yeah, I would say you're like a brother from another mother because you feel much like I do. It's all about giving back to the community. High tide raises all boats. And so just from that philosophy alone, it's about giving folks education, knowledge, confidence. Confidence goes a long way when it comes to providing service for other people. If you don't feel confident in yourself, it's hard for others to feel confident in you. So with that, I know we're going to have a bundle of joy. One of the things that we kind of batted back and forth was, how is this format going to work for this particular roadshow? How do we, you know, architect it in a way that's going to be not only impactful for them and their practice, but also memorable? So we came up with this process, which is prepare, promise, deliver, and defend. If we could go ahead and pull up that first slide real quick. So yeah, it's all about prepare, promise, deliver, and defend, right? We always talk about how do you prepare, right? We don't want to prepare for a crisis during a crisis. We want to prepare on the front end. Promise, right? When we're having conversations with our customers, with our clients, our partners, we want to be able to make the promises that we're going to be able to keep, right? Because it's all about integrity. It's all about empathy. It's all about following through on your commitments. Delivery is the delivery of those promises. And then in this particular case, and we're going to talk about it more in a second, but it's about delivering in the middle of a crisis, right? There are a lot of people that have been a part of incident response, but how do you help lead an incident response, especially if you're dealing with a partner or customer that hasn't really dealt with an incident before? And then ultimately, Defend, we're going to talk a little bit about how we can look at people, processes, and technology. Maybe even specifically on the Hunter side of the house to help defend yourself and your clients. When we came up with this, it just kind of formulated in our minds. What stood out to you about this format?

So, you know, for me, Chris, I'm such a big fan of putting your ducks in a row in the right order, right? And to use one of my favorite quotes, George Washington said many, many years ago, the best way to prevent a war is to be prepared for it. What an insightful What an insightful statement. And I think really, I think for a lot of us as MSPs, we've done some, but we've not done enough in the preparation. So I love how one follows another here, right? When we correctly prepare, it gives us the confidence not to promise what's impossible, which is, oh, you know, you'll be 100% secure with me, but to give the promises of resilience, to give the promises of preparedness, to give the promises of, this is what mature looks like, that we know we've done the right things, and then we can get to our favorite parts, which is deliver and defend, right? And so I just love this approach because it's the right approach to think through getting the house in order, stacking things up correctly. And it really does come with some of those prerequisites, Chris, that I think are not always native and simple for MSPs or really anybody to really start to begin. Where do I start? How do I begin that journey? What's the first few steps, right? And we hear a lot of people talk about, oh, do this, do this, do this. But what we really want to do through this roadshow is really kind of put the right ducks in the right order first. That's what I love about this approach.

I couldn't agree more. This approach is perfect. I mean, you could really leverage this in any service-centric thing that you have cooking in your practice, even at home. Let's talk a little bit about prepare, because that's something that you have practiced in spades, right? You have Empath Cyber. Which is really focused on educating MSPs about how do you stay prepared? How do you have the right documentation, the right processes to do some of these things? And I think you're going to be the main speaker on this specific point. Talk to us a little bit about being prepared as an MSP.

Yeah, absolutely right. So, you know, one of the things I think every MSP wants to know is, as I begin to go down this journey of security, you know, how do I know, I'm doing is right? How do I know that I'm putting my resources, which are precious few, into the right buckets? How do I know that I'm not missing things? How do I know that there's not gaps as I'm going down this journey, right? So these are things when we start to think— and by the way, this idea of preparation does not just exist when, oh, I'm beginning my security practice, and now I'm— versus, oh, I'm 3 years in, so now I don't have to worry about it because I've been doing this for years. No, This idea of preparation exists all the time. It is cyclical. Just like security is not a destination, it's not a process that I begin, I, I, and then I complete. It's a cycle that doesn't end. The same idea of preparation really comes into this, right? So we all do begin into this preparation journey, but I think much more than that, what we're gonna be talking about is like what goes into constant preparation for us and how do we build that into the practice of security that doesn't actually end, that actually is built to be resilient according to the inputs that are coming in, which are the threats that are coming in, which are the compliance and regulatory things that are coming in, which are client needs, the growth and goals and objectives of the company. All of that filters in to this idea of how do I go through a preparatory journey in my security stack and in my security approach? So I hope that gets you excited, right? Because— But a lot of times we talk about the technicalities of security, which are vitally important, but let's talk about the business strategy. You know, one of the things I've been saying lately, and I'll just repeat it 'cause I just, it really resonates to my heart is, you know, as a CISO, my job is not to protect the company. My job is to help the company grow and accomplish its objectives while doing so in the most secure manner, right? And so it's incorporating in the strategy and the goals of the business as we move forward. And so that idea of preparation is baked into every single word of that approach. And Chris, that's what I love about starting here is that's what we're gonna be talking quite a bit about.

I love it. And I love the fact that you were talking about the journey, right? It's iterative, it's cyclical. I think of the word mastery. Mastery is one of my favorite words in the world. And a lot of people think of mastery as a destination, like, oh, I have become, the master, but it's a process that's ongoing. If you look at fighters, right, you could be a heavyweight champion one day and you'll lose that next week. If you lose that next week, you may not be the champion, but maybe you're still on that path to mastery, or you think you're the master and you just stop growing and developing. You're off that path of mastery and you'll lose anyways. So really thinking about how do you prepare, how do you iterate, how do you constantly improve your services? And show up even better for your clients. Let's talk a little bit about the next one. Once you get past that prepare stage, I mean, which is ongoing, you start to promise, right? And you and I, we have this love of storytelling. Storytelling is one of those seemingly lost arts in humanity, right? We tend to forget to tell stories. We forget to create sometimes. And sometimes all it takes is for someone to say, hey, remember that you can be creative. You are creative. You just have to rework those muscles. And so when we're talking about promising, we're talking about having those conversations with customers, right? Because number one, you want them to be the star of the show. The star of the show isn't necessarily MSP. You always want your customer to be that star of the show. And so when you're saying, hey, we're gonna be able to do X, Y, and Z for your business so that you can continue to operate to the best of your ability, that's storytelling. At the end of the day, you're telling the story of why cybersecurity is important. You're not over-leveraging fear, uncertainty, and doubt, or FUD, how a lot of people tend to use that type of storytelling. But you might be giving that context for, hey, this is the threats that we're dealing with on a day-to-day basis, but this is how we can show up for you so that you can continue to operate. So when you think about making promises, is there a particular situation— you definitely don't have to attribute it to someone else— but is there a story where you've seen an MSP make a promise that they couldn't deliver on?

Yeah, yeah. So, you know, we all see those cringe Reddit posts, you know, where let's pick on the vendors first, but you see sometimes MSPs will parrot the same thing of like, you know, use us and you get 100% security, right? You get 100% prevention. And I'm like, you know, I wish that that were the case. If it were the case, then you would see that same vendor putting out threat report after threat report of all the unknown thready threats they put out, that they're the ones that saw it, no one else did, because they prevent all the known and unknown. So like, we know that that world doesn't exist, right? And let's take that empathetic role for a minute. Like, even where the ethos of empath cyber came from is when a client comes to you, and Chris, you know this as well as anybody, and they have the arms crossed, they're like, well, I'm not paying for that. I'm not a threat. No one cares about me. My data doesn't matter. I've never done this before. Why should I do this now? Those are the things that every MSP, when they hear those words, if you're not prepared, you're going to panic because you're not— you're all of a sudden like, I don't know how to— and those are the horror questions that keep me up late at night. And so I think what we're going to do in this is what we're going to do is we're going to trace the journey. One thing I've learned is, Chris, you said it so well, Storytelling. The reason storytelling is so powerful in analogies is it crosses the bridge from where they're at and their expertise and their concerns and the things that they need to accomplish, which is how do I keep the lights on for my business? How do I grow? How do I scale? How do I succeed? And how do I stop the threats that could cause that to end, which could be cyber, it could be other things. And us who come at it from We know cyber, we've been in it. We know the requirements, we know the goals, we know what good looks like, and we know the client hasn't done enough over the past few years. We gotta get 'em there. So how do we cross the bridge? It's our job to cross that bridge, not them. And so the way that we cross the bridge is we begin to use stories as that bridge that lets us walk across. I'll just give you one simple example of this is sometimes when clients, you know, they don't wanna put the work required into this because they just view it as a red line cost. And here I'll just give you one example. You know, that makes sense, Miss Client. I totally understand that. You know, no one wants to spend more money than they need to. But let me tell you something. You know, I— one thing I hate in life, it's going to the dentist. And the reason I hate going to the dentist is it's not fun having my teeth cleaned. It's not fun having all that stuff happening. You know, I just— I hate it. But you know what I hate more? I hate more is a root canal. That is one of the worst things. It's both expensive and extremely extremely painful, and it's never guaranteed to be a complete cleanup and clean out. I would rather go to the dentist a few times a year to keep away the root canals and do the necessary than go through that type of event. And it's the same thing in cyber, Miss Client. What we want to do is we want to do some small things that are iterative that'll take you down this journey that'll really get you to the position where you don't need that cyber root canal. Can we go through that journey? What we're going to do is we're not asking you to bite all of this this elephant off at once. Let's, let's, we're going to create for you a strategy, we're going to create for you a budget that we'll work with, and we'll give you an implementation plan to get there. You see how much better that sounds as I kind of approach and step into their pathway? And so we're going to talk about that. It's not salesy. Chris and I are not going to be talking about the 3 sales techniques that you need to hear to convince your clients. No, we're just going to talk about the tried and true analogies and storytelling that can get a client to understand why this matters so very much.

Exactly. Analogies. I mean, analogies is exactly what you said, that way to bridge that gap. You're talking to business owners that are focused on their business. They might not have time to research the greatest and latest threats. They might not even know some of the basic attacks that are going on in the world today. So being able to say, "Hey, do you know what ransomware is?" "No, I've never heard of it." Well, I want you to imagine for a minute that you come home late after work and you walk up to your door and you try to open it, but your key doesn't work. And you realize that there is a note on your door that says, "If you don't give me 3 Bitcoin, you are not gonna get access to your house." People can understand that. They can empathize with that. "Oh yeah, no, that's terrible." And you say, "Well, that's what exactly what ransomware is, but for your data and for your files in your network." And they're like, "Okay." Light bulb went off. Now they're gonna be able to remember that forever. Once you tie information to an emotion, that's when things are solidified and people understand just that much more. Now we go from promise to that deliver side of the house, and deliver is one of my favorite things in the world because now we're going to be talking about incident response. I remember I was just at IT Nation Secure and we did a talk on being ready for incident response. We talked about being an incident commander, and I asked the audience, there was probably 160 or so people in the room. I said, hey, raise your hand if you've been a part of an incident. And I would say about 60% of folks' hands went up. And I said, who feels confident in dealing with incidents? And there was no hands that went up. And that's because I think that a lot of folks get wrapped around the axle when it comes to incident response. Even I did it before I really did incident response. I thought, oh, there's no way I could be an incident responder. Because I don't know all the technologies. I don't know all the, you know, ways that things could be architected. I don't know all infrastructure. But what I realized is that really good incident response, being an incident responder isn't so much about having all of the necessary context. It's about getting to that closure. It's about asking the questions and taking the right actions to get to incident closure. And once I realized that, I'm like, oh, wow, incident response makes sense to me. But I think people are afraid to kind of step into that leadership role when it comes to incidents because they think, oh, I have to know everything. I have to know all the vulnerabilities. I have to know all the attacks, all the ABTs out there in the world, how my clients are architected. But if you can help guide folks through that, that process, asking the right questions, bringing in the right context, bringing in the right people and making decisions, that's how you can help guide a client through something like an incident.

Yep, yep, that, that is well said. And, and I love just hearing from you on this, Chris, because your experience knows no bounds here, especially compared to me, right? And so I, I think what you're— a lot of what you're drilling into is like, not only can— I think we want to encourage you that not only can you do this, there's probably the realist mentality of there's going to be a time you have to I'm gonna do this. And it's never gonna be the time that you expect. It's never gonna be the time you wanna set it up for. I'll brag, I won't use his name, but I'll brag on one of my friends. We just did an event in Tampa last week, and I was texting an MSB friend that I knew was gonna be there, and I'm like, hey, where are you? I'm not seeing you. And he texts back about 5 minutes later, and he said, hey, I'm actually dealing with a BEC event right now. And he goes, I'm gonna be a couple hours out of this, maybe more. And so he got out of it, and I pulled him aside. I'm like, hey man, how you guys doing? How's it? He's like, it's okay. We've been working with this client for quite some time. Explained what happened, explained how, you know, this is an issue. And by the way, he explained why they need to get some O365 monitoring. I'm like, I know a company that can help with that. And, but he, you know, he walked through how he handled it. He said, I was extremely nervous at the beginning, but then, you know, things kind of set in place. And I remembered that I was coming in as the expert. This is not like, we've been talking about this with the client before it all hit the fan. You know, they were coming to it from a, oh no, how do we fix this? We know that you've been telling us to do something we didn't. And they got through the event, right? We'll find out kind of how much money they're able to recover at the end of it. But, you know, I just am so encouraged by him going from like extremely nervous, even shaky on the call, into like really becoming that incident commander and helping the client get through this nightmare of a journey, right? This just happened literally last week. And so I think my point to this is that it's going to happen to you and it's never going to be the time that you want it to. And so I love that, Chris, you're just going to walk us through, you know, the things that you need to know to kind of begin that journey, be ready for it, because it's going to happen at some point.

It is going to happen, and it's almost like you read my mind. You teed us up for that