HUGE NEWS: CISA's New RMM Cyber Defense Plan is RELEASED!

What's going on, friends? Hope you guys are all doing awesome today. Had some camera issues, that was a lot of fun, but we are live and we've got it going now. Let me turn this music down, it is rocking music, but, uh, and we don't have time for that. We got some big things to be talking about today, um, it's gonna be a lot of fun. Billy Turner checking in, what's going on? Good to see you. So as we get started today, I want to talk about something that no one is talking about. We are going to be covering the brand new guidance that came out from CISA or CISA, however it is you choose to say it, around the RMM. This specifically is a document called the Remote Monitoring and Management Cyber Defense Plan. And joining with me today is my friend Jason Slagle. I'm going to bring Jason up. What's going on? Jason, that's weird. If, uh, sorry about that. If you guys don't know Jason, um, he is the president of CNWR. More importantly than that, he's a friend of mine. And probably even more important than that for the discussion is that he is a contributor with CNWR to this document. So Jason, how's it going today?

It's going right on.

Well, it's good to have you on. Um, thanks for joining. So I guess you've known that this thing was coming out for quite some time. We're going to share this on screen in just a minute, but I don't think a lot of MSPs really had any idea. And I'm not I'm not going to lie, I stumbled across this. I knew that you were involved. You sent me pictures when you were in D.C., but I was going across and found a, like, a news article today on BlackCat ransomware, and it referenced this article. I'm like, wait, what? This thing's out? So I went and clicked on it, and there it was. I don't think a lot of MSPs know about this, right?

Yeah, I've seen a little bit. I've seen at least one or two LinkedIn posts, and then it came up in a couple of Slacks I'm in, but I don't know that it's gotten wide. Wide publishing. And honestly, I think part of that is the quality of some of the stuff that's come out of CISA in the past has probably been kind of sus and a little bit questionable. So I'm wondering if we've got some amount of the community kind of tuning them out because of that.

Yeah, that's fair. Um, I think that's actually really fair. My— I was looking— ironically, the last live stream I did before I've had a slew of months of travel was specifically on that topic of, you know, if there's some— um, I don't want to say shade to throw, but a critique for CISA is is that it typically has been in the past difficult to consume. If you're an MSP, you know, it's not being— sometimes it's the terminology that's used. Sometimes there's things a little over here, things a little over there. It's not in a consumable way. I did a livestream on that and actually had a CISA regional director message me and say, hey, can we jump on a call? And I had a great call with him around all of this. And I think there's a lot they can do to make things a little bit more consumable for sure. And I think they're on that journey, right?

They are. And so I will say that having been out there and met a bunch of the CISA, a bunch of the JC/DC people, I don't think it's their fault, right? So like, they are government people that do government things, but they are fed by a ton of advisors, and they just don't have good advising that will help them give information out in a way that MSPs can understand, right? So it's like Verizon and Google. Like, people at this meeting and GE, Honeywell, right? They're not— they, they don't have the ability to know how to talk to an MSP in a way an MSP can understand.

Yeah, I, I agree. And, you know, being at IT Nation Secure a few months ago, seeing CISA there, seeing them have a panel session, seeing them on the vendor floor talking to people, I just— I can't tell you how awesome that was to see because I'm like, here we are finally, 2023, and I love their participation. And I just told them both, I'm like, I am I'm so glad you're here. It means a lot to us. And, you know, she said back to me, she said, everyone's saying that to us. I'm like, you found a warm, welcoming environment. Like, it's not that, you know, it's not that we've been avoiding them. I think we've, we've, we've wanted to have CISA kind of get more involved in, in our ecosphere, um, because if for no other reason, I think MSPs are looking for relevance with clients on why security matters, and CISA can certainly help with that, don't you think?

Uh, I think they can, right? Uh, if nothing else, they're, they're a good boogeyman. Right, like, uh, uh, it much like insurance, right? Like, we need— when dealing with small businesses, we need people like CISA in our corner to show like, hey, you know, I'm not just trying to sell you this thing to make more money. I'm trying to sell it to you to solve this problem that, you know, even the government is saying you need to solve.

Yeah, yeah, well said, well said. Um, it's good to see, uh, Alex Farling checking in here. It's so unfortunate MSPs need resources that are distilled down further than what VZ. I don't know what VZ is in Google.

Verizon.

Verizon. Oh yeah. Okay. Just talking about their report. Yes. Yes. And you know, that's what folks like Jason and I and others are here for is to help you, you know, kind of get into this because I know it can be intimidating for sure. And I come out of a banking ecosystem and world where it's certainly there's a lot of vernacular that just makes it less approachable for people. So we're working on that. Yeah.

Yeah. And it's funny because dealing with like the CISO people internally, there is a lot of like her out of office mess— Abby's out of office message had like some three-letter acronym TDY, which apparently stands for temporary duty station. I don't know why S and Y are like— yeah, it doesn't make any sense, but apparently it's the government equivalent of out of office. Uh, yeah, so it's, it's pervasive. The three-letter acronyms are pervasive in the government.

It is, it is. So speaking of that, let's dive into the report. If anyone wants to see it, you can just go and download it right from CISA's website. I've got it here just in a PDF, so I'm going to bring this up right here. And you're going to notice, Jason, I've got a couple of things here. Let me zoom out just a tad bit. I've got a couple of things here as we get into this that I've highlighted for some, some things that I think would be healthy for us to dive in and talk to. But before we do too much, talk to me, Jason, just kind of about how this whole thing came down, how you found out about it, how you ended up traveling to D.C. Just give us a walkthrough on this.

Wayne Selk is from CompTIA, is actually the genesis of all of this. So he got in touch with JCDC, I think via the IT SCC, which is like the IT Sector Coordinating Council that he sits on. He got involved with the JCDC because of this, because of this effort, and he wanted a couple— he wanted some MSP representation. And so he asked me if I was willing to, you know, join and help out. I ended up flying out to DC, and I think part of the problem with the MSP side is government doesn't pay for anything, right? So it's like, I traveled to DC on our dime. To attend to this thing and it just kind of went from there. That was back in March. So I mean, to give an idea of length of time, right? Like we started talking about, and this plan started being developed all the way back in March and, you know, we're just now to the release point. So it is a slow process, but it's been good.

Yeah, awesome. Well, I'm glad you went. I'm just gonna scroll to the bottom just 'cause I want to. Acknowledgments right here. Really cool to see that CNWR, your company, was there, right? And just shoutouts to NB Bank. I don't know who that is. Comptia, ConnectWise, you guys, um, CIT, CyberRx, Defense of the Department of the Treasury. That's kind of cool. Huntress, that's amazing. ISC2, Kaseya, Enable, The Open Group. I mean, some great folks there that contributed. I'd like to see more in the future, but great to see that, right?

Yeah, it's, it's awesome. I got to— I mean, that's where I got to finally meet, uh, Jason Maynor, right? The CISO of, uh, Kaseya. He was there, and Patrick Beggs was there, uh, and somebody from Dave McKinnon's team from Enable. You know, they were all three in the room when we were talking about this stuff, which was good to see.

Great to see. Really, really good to see that, that collaboration. So let's dive in. Right. So not a lot on the very front page, by the way. This is, this is TLP CLEAR. What that designation means for those of you that don't know, any time you see anyone in the federal government designate a TLP, it's Traffic Light Protocol. There's lots of different levels. CLEAR basically means this is open. You can share it, you can talk about it. It is as open as open can be. It is the freest, most open version. You may eventually come across other documents that are TLP GREEN, TLP TLP Amber, TLP Red, but we're not going to dive into that. I just wanted to make this known that this is a clear document anyone can share and talk about it. Anyone can, can download it. So let's start with a little bit about the JCDC. This is probably your first experience in kind of working with them. If anyone doesn't know, this is the public-private partnership sector in CISA themselves. So I've highlighted this part. The mission for this is to mature their their public-private partnerships into real-time public operational collaboration with focuses on planning and mitigation. So I think we'll see more and more come out with the JCDC over time. Anything you want to kind of mention about them in particular?

Yeah, I mean, I— my application is just sitting in legal review right now, right? So there's— most of us that are acknowledged as contributors were offered the ability to join JCDC as actual partners. So there will be more of this going forward. And she's actively looking for more people that are willing to help contribute. It is a non-zero amount of commitment. In an effort to do so, but I have been putting her in touch with other people. Like, even just this morning, I introduced her to Ninja because they're like, hey, we want to talk about RMMs too. Great. Yeah.

And that's, that's exactly what we need. So let's jump into this. You know, I know originally there was some, a lot of discussion among, you know, the thought leaders that are in the MSP space and the federal government around what the heck an RMM is, what an RMM isn't. So they talk about this a little bit here, and I think they really do kick off with some really good data, right? They do kind of present, hey, RMMs do present a systemic risk across all organizations and sectors. This is something, Jason, you know, you and I and many others have talked about for quite some time since maybe even 2018 and before of bad guys leveraging the RMM. In my Perch days, which I'm actually wearing an old Perch shirt today, we talked about this as a buffalo jump attack, leveraging the MSP to pull push all their clients off the cliff. And so they talk about that. It's good to see them recognize that. And by extension, they show this right here into thousands of small and medium-sized business, SMB customers. So it's kind of good, isn't it, to see them recognize the, not just the threat landscape, but the volume of, of danger that MSPs pose to the national economy, don't you think?

Oh yeah, it's huge. And they very much seem to understand that there is risk there. I mean, there were some things vernacular and terminology-wise that, you know, we went through when we discussed this. But yeah, they understand the risk very much so.

Yeah. Yeah. Okay. So, so that's good, right? And so, you know, not good the risk, but good to see them understand that, right? I think that was literally step one for many of us. I remember talking to my friend Harry Purper at MITRE, and he's associated in working alongside CISA. And I remember a few years ago, he's like, man, I just really want them to understand that MSPs stand here in the middle of a colossal supply chain. And I love seeing this, right? Mission accomplished in that regard, right? So they talk about how the RMM can be exploited by bad guys. We know this. Nothing special there. And hear us as Jason and I are jumping into this. No one's bashing on RMMs. No one's bashing on MSPs. Jason himself is an MSP. This is no different than talking about any type of software that can be leveraged by a bad guy for nefarious purposes. I mean, we could have the same conversation about PowerShell, right?

Yeah, I think so. Right. And I think MSPs get a bad name, especially in security circles, because they are a force multiplier. Fire, right? You can take over one and do the buffalo jump to a bunch of them. But I promise the world without them— and actually, Matt Lee and I are giving a talk at Gherkon about it— I promise the world without MSPs is worse than the world with them.

That, that's it right there. I think you nailed it, right? Like, what's the alternative? There is no better alternative. So I, I like seeing what Sys's approach is, is not only are we— we're not anti-MSP, we're pro-MSP. Let's recognize there's differences between good MSPs and bad MSPs. Let's recognize there's no barrier to entry. Let's recognize that we are a young industry growing up. Let's see all those things as they are and let's work on it. Right. And I applaud that. One of the things I thought was pretty interesting in the same highlighted remark here, they talk about— I thought this is pretty interesting. They talk about cascading effects and it collectively makes up more than the RMM and those services make up more than 40% of all private sector payroll in the United States. Just as an example. I mean, that's kind of shocking, isn't it?

A little bit. Okay, came back. I got a connection warning. Yeah, it is. So small business is— it's critical infrastructure, right? Like, and, and you have to realize that a good portion of our GDP is for small businesses, so we have to do something for them.

Yep, exactly. Um, Eddie checking in here saying, exactly, let's focus on making the current situation better than scrapping the whole idea of an MSP. That's right, because I think we're seeing more and more of us all come together on that mission and that mantra. And that's what security is all about. I mean, we all, we all say this over and over is that we're all doing this together. You know, rising tides, all boats. You know, there's no— we compete for sure, but not when it comes to security. You know, those are the mantras that we all preach. And I think we all welcome any vendor and any MSP that wants to enter in with that, that mindset. Right. And for sure. So let's get into this a little bit more. So they reference a 2022 report, 90%, and I felt like it's probably higher than 90, but 90% of US-based SMBs, including critical infrastructure, rely on MSPs to supplement their IT, their OT, meaning their operational technology, and their factory control systems. Um, I feel like it's probably higher, don't you think?

I, I actually don't. Uh, well, it depends on how—

oh, I think I lost you. We'll see if Jason comes back. Here in just a second. Oh, there you are. I think I got you back now.

Yeah, I wonder if Spectrum's having issues again today. So that number to me seems potentially a little high unless you include like break-fix, right? If you include what I would consider the traditional MSP business model, which is more proactive, I think that number is probably 70%, right? 60%. But if you include all IT service providers that service small business, yeah, the 90% is probably a little low.

Okay. Yeah. And again, we've said it before, we're not going anywhere like that. This is the way it is because small business is never going to be able to manage their IT, especially the more complex it gets, the more need we have for automation, the more need we have for cloud, the more need we have for cybersecurity. All we're doing is we're making the MSP more relevant and more sticky, not less. So they talk about, you know, living off the land attacks and bad guys leveraging this. We've talked for years about living off the land attacks, but I don't want to assume anyone listening today understands that. Can you kind of give me a high level of what CISA means by live off the land attacks and why they're so dangerous?

Yeah, I mean, a living off the land attack is using what you already have in place to do your attack, right? So instead of installing, you know, a set of tooling and some other things to do like network monitoring, scanning, it's using the tools that already live there. We see it a lot. You can very easily abuse the Teams installer, for instance, to run run other things. Uh, you— there's a ton, an entire huge class of law bins, you know, living on the land, binaries that you can use to do this stuff. And your RMM tool is one, right? Because I've said it multiple times, uh, the only difference between command and control and RMM is RMM has a marketing budget.

Yeah, so it's funny you mentioned that because I did a workshop with Huntress this, this week in Chicago and Orlando, and I mentioned that, that, you know, at the end of the day you know, what an RMM is, is an exploit kit ready to go. And people kind of think about it and they chuckle and like, yeah, that's true. And no one's hating on RMMs, right? It's the only way that MSPs are going to survive. But we do have to recognize there are certain things that we have resident in our systems that can do very powerful things. It's not just RMMs. We mentioned PowerShell a minute ago, PSEXE. Like, there's so many things that exist that if we can use those tools and leverage those against you from a bad guy's perspective, why wouldn't we? It just makes it all the more difficult. I mean, maybe quickly, just let's chase this rabbit trail just a bit more. What should MSPs be doing about that? So if they hear that live-off-the-land attacks are difficult because they're harder to detect using native tools, then what do we do as a defensive mechanism against that?

You really have to harden the tools that you control that can do that, right? There's no excuse at this point to not have MFA on your entire MSP toolkit. You should be doing SSO if you can, but not if you're not doing conditional access. I would argue, if you're putting it back to Office 365. You should be limiting blast radius. So don't do AV exclusions for your RMM tool, right? If your vendor tells you you need to do AV exclusions, you need to push back on that hard, right? Because the second that threat actor drops malware via LabTech or Automate or Kaseya or VSA, whatever your RMM tool is, right? You do not want AV ignoring it just because it came from the trusted source that is your RMM tool. So it's things like that, right? It's, it's securing the tools that you use to not allow them to be abused.

Okay, yeah, that, that's great. That, um, that's helpful, right? And I think those are things that, as an MSP, if you haven't really kind of game planned through those, encourage you to talk to your security vendors. Any security vendor that you're working with that has detection capabilities that's worth their salt is going to have answers for you on what they're doing to help you around live-off-the-land attacks, but it's not just them. It's you as the MSP understanding, if I were to get some alerts from them, what would I do about that, and how would I take action, and how do I understand and know the difference between normal usage, abnormal usage, and malicious, malicious usage between each of those, right?

Yeah, I mean, we have monitors in place on our RMM so that if scripts are bulk executed, for instance, it pops an alert, right? Like, it— if, uh, new commands or scripts are written, it pops an alert, and those things are, uh, they're, they're necessary at this point because we don't often push scripts out to run across our entire base, right? And when we do, I would rather take those couple of alerts— oh, oh, Matt pushed that thing out and it's running across the entire base— and, and chase that down and spend that little bit of time to confirm that it actually was a positive and somebody actually did it, rather than not monitor on that stuff and have somebody use the RMM to push malware out.

Yeah, well said. So if you guys are just joining us today, really glad that you're here. One of the things that we're talking about, actually the main thing that we're talking about is this is new RMM Cyber Defense Plan. Jason, President Jason Slagle, who's joining me today, president of CNWR, was on that committee, is working on it. And so brought him on to talk about this. You're seeing us share our screen. We're diving into that specifically. So let's jump in a little bit deeper. Let's go past this. And Jason, you and I had some discussions around this.

So we did.

Yeah, one of the things that they wanted to kind of really, um, I think document in detail— I think let's talk about the spirit of it more than anything. The spirit of it is to really help. Now, I think we understand this as MSPs, but the larger industry doesn't understand this is a triangle that's deeper than any pyramid scheme that's out there, right? In the sense that we have bajillions of endpoints by lots and lots of small businesses that they mentioned up there earlier, that 90% of small businesses that are then managed by a small group of service providers who then on top of that leverage an even smaller group of RMM. So I think there's laden in this some risk that we should, we should outline. Can you kind of talk to me about this pyramid here and the implications?

Yeah. So I mean, the intention of this was like, if something at that level, at a given level is compromised, then everything below it is vulnerable, right? And so we were trying to show the sphere of influence that if you can compromise the entire fleet or even just the entire hosted fleet of one of these RMM tools, then you have access to all of the MSSPs or all of the MSPs using them underneath it. Then you have access to all of the businesses they support and all the employees and then all of the endpoints, right? So the, the intention of this graphic and the debate I think we kind of had was, you know, it doesn't seem right to me, but if you consider it from that endpoint, from the sphere of influence endpoint, The only argument I think we have is where MSSP and MSP belong on there. But that's the intention of this is just to show that like, hey, if you can compromise the very tip of that pyramid, then everything below it is vulnerable.

And we've come close before, haven't we?

Very close. A couple of times, at least twice that I can immediately think of.

Yeah, me too. And, you know, we're not here to throw, you know, any shade or open wounds by any means, but we've come close. You know, one thing that's interesting, we've seen this in my Fifth Wall days. Um, you know, still an advisor for them. They're awesome folks. Is we've talked about this often, is that we've never seen a national systemic cyber event ever. Not like a Category 5 hurricane that wipes out a big section of Florida. Not like major wildfires that we've seen, for example, in, in Hawaii. Not like big earthquakes that just, you know, turn a city to rubble. We've never seen the equivalent in cyber. I don't think any of us believe that it's not going to happen. It's probably a question of if. But this could be one of those things here when you kind of look at that graphic to say if there cause, it certainly would be a supply chain type of incident like this, right?

Yeah, I agree with that. I would argue that even the one that everyone talks about, which is the July 4th attack from a couple years back, I would call that a Cat 1 hurricane, Cat 2. And I'm sure to the people that impacted, right, they consider it a Cat 5 because it was very destructive to them. And I don't want to minimize the problems that it caused for them, but it was limited to what, 160, 100 MSPs? Right? It could have been a lot worse, and eventually the big one will come.

Yeah, yeah. So maybe another way to say that too is that's a maybe an F5 tornado. Yeah, but not a Cat 5 hurricane. So certainly impactful to those that were involved, right? So yeah, we want to avoid that. We're all in agreement. Everybody in the US is in agreement. That's bad. We don't want to see that happen. So they kind of give an overview. I'm going to skip by this. I want to get down into the mission and the sort of the vision, mission, and goals. So, you know, they talk about— and by the way, this kind of comes full circle back to the National Cybersecurity Strategy itself. At IMPACT Cyber, we did a deep dive into that. I had John Hammond join me and I had Matt Lee join me, and we had a lot of fun diving deep into the National Cybersecurity Strategy. And what's interesting to me, before we, we jump into the vision, mission, goals here of this document, is I think one of the arguments a lot of people made about the National Cybersecurity Strategy is, oh, it's just fluff. It's just, um, it's just sort of like, uh, postulating that the, the president, you know, is, is sort of giving out to everybody without any meat behind it. But I think actually what it is, and this is a good example of it. It sets the tone, it sets the vision, it sets sort of the, the thinking, and then it's referred to later on down, down, down the lane. It's almost like maybe, Jason, I don't know if this works as an analogy, but you know, when JFK said, we're going to the moon, darn it, that's what we're going to do, set the vision, said that's, that's where we're going. Now the rest of the few years out of that played out into getting that accomplished. It's almost like what you see in the National Cybersecurity Strategy. So I was glad to see it even quoted here for that reason. Any thoughts you had on that?

Yeah, I agree with that. It's— this is— it, it's really easy to look at a document like this and go, well, that's a whole lot of fluff and it doesn't really say anything that they're going to do, right? But there's a couple things. If you say exactly what you're going to do, then the people that are doing bad things can see it. I, I promise you that there is a much more detailed version of this document that is TLP Amber, uh, that specifically calls out the, the lines of effort there, right, and what they plan to do with that. They just can't share that publicly. Okay. Uh, it— and so the this is the, you know, the high level. This is— these are the general ideas that we're pushing towards.

Okay, yeah, that's good. Um, one thing I realized I meant to cover a little bit and I skipped by it is another thing you and I talked about quite a bit, which is, you know, we see managed providers and managed service providers, so MSPs and MSSPs, kind of called out here. And originally there was a little confusion. I'm going to turn chat overlay on because there's a whole bunch of you fine folks on, and I want to hear from, from you all as well. Can you talk to me about— originally I had confusion here, Jason, because I'm like, well, this arrow key doesn't make sense because there's a lot of MSPs that don't use MSSPs. And then you're like, well, no, that's not, that's not the purpose of what this thing was trying to kind of communicate. So it brings up questions for us around MSP versus MSSP. Should MSPs be MSSPs? Why are they separated between the two? Can you kind of unpack some of this for us here?

Yeah. So I believe the intention of this graphic, right, because there was a meeting where we talked about this graphic before it went on, the intention was just to show the sphere of influence. And basically, from a database high-level perspective, it's what are the one-to-many relationships, right? So one RMM tool supports, you know, one or more MSSPs, which may not even be in the equation, right? So that is like an optional tier there, right? Those MSSPs support one or more MSPs, right? MSPs support one or more businesses with employees, which support one or more endpoints. We can make the argument— and, and this was— there were two really big points of contention that happened in meeting, and the first one had to do with the definition of an RMM, right? Because the original document they put out was calling like ScreenConnect an RMM tool, and we fixed that. Now they call out in this document remote access tools because they just didn't understand. But the second big one was, you know, what is an MSP versus MSSP? And, ah man, that is a really tough point of contention to me. And I make the argument that MSSPs generally are not providing end-user help desk support, right? They focus only on security tools. So there are, there are MSPs that also provide MSSP functionality, but to me they're still an MSP, right? Uh, and that, that's where I draw the line.

It's a fuzzy line, right? I mean, there's some fuzz there because what if I'm, I'm literally marketing that I offer security services? Most MSPs have a tab at the top, cybersecurity, and then they say I'm offering managed security, and maybe it's Huntress it's doing it. Maybe it's someone else that's doing it, but they may not disclose that. So the perception is there that I'm doing MSSP work as well, and that really muddies those waters, right?

Yeah, I think that there's some weird stuff going on in the industry right now where everyone aspires to be an MSSP, and I don't realize it is— I, I don't know. I, I wish I could tell you, like, do you get some sort of like plaque with that second S? Because I mean, we do the things MSSP does. We don't have in-house SOC. I outsource that right now, right? But even once I do have in-house SOC, unless I decide that I'm going to spin it off into a separate company, which is a discussion we can have here in a minute, uh, I'm still just going to call myself an MSP, right? Because that's the, that's the service I'm providing. Whether or not I outsource or insource some of those supplementary security services doesn't matter. I am an MSP because I'm providing end-user support to those customers. Maybe there's a case where sometimes I sell MSSP-like services, but that doesn't make me an MSSP to me because I'm still selling helpdesk.

Yeah, it's great thoughts. I've got the chat open. It's always open, but I've got it to where we can all see it. So a whole bunch of you guys on, would you give us some thoughts around this commentary? Should MSPs be MSSPs? Should there be a dividing line? Is it good to have a separation of duty between the two? Another question while we're waiting for some comments to come in from the, from, from the folks around us, or even some questions, is, is at what point does an MSP decide to become an MSSP? Let's say Jason, I grow into $25 million in revenue. Kyle Christiansen has a really cool sort of like MSP financial journey map. We actually did this on a webinar with him a while back. And you know what happens when we get to 25, 30, 40 employees? We're getting closer to that, you know, $10 million to $20 million threshold. And we, we really do decide it's time to, to focus. Like, do I just spin up a new company? Do I— what's the best way to do it in your thoughts?

So we're close to there, right? Uh, within maybe, if, if all goes well, within the next year, I'll probably hire some SOC analysts to try to bring that stuff in-house. I believe at that time I will likely move those security services to a separate organization, and I will contract them back to CNWR. There's a couple reasons that— there's some liability protections that I don't necessarily want, uh, to happen there. And the other thing is, if I intend to sell this service to other MSPs, which I think most MSSPs try to do, it makes sense for that to be a separate company. So there's no like, oh, why would I buy something from my competitor thing going on there.

Fair point. And this gets into what Farhan just said here on chat is, you know, it's— there's— there should be a separation of duty. There should be, uh, there should be no pretense of a fox in a hen house. And, and let me just chase this even a little further because I think it's valuable. What things go into the MSSP versus the spun-off, you know, Slagle MSSP? Where do you put the dividing line? Because at some point, you know, the MSP from IT services still has to have some prevention tools at a minimum, probably even some vulnerability scanning management tools. So like, where do you put the dividing line between the two?

I think it can vary. Where I would put it is the MSP would still be in charge of, you know, deploying and running antivirus, right, those vulnerability management tools. And then the MSSP collects the intel and threat feed and log feed from those tools, and they action on alerts that the security tools pop. Okay, right. To me, that's a pretty— that's where the line lives in my line. But again, these are marketing terms and the thing I've learned, nothing against, I have a ton of friends in marketing, but one thing I've learned is that as soon as marketing gets involved, the lines get really blurry really quick.

Yeah, fair point. This comes back to even some of this right here from Cyber Defense Matrix. I've always got it handy on my desk next to me is, you know, maybe at some point you sort of start to say, looking at that matrix, maybe this is where that dividing line of detection sort of serves as a big piece of where the separation and the demarcation line exists. I'm curious to know from you guys in chat, That. Tell me where you think the demarc line, you know, exists. Like Farhan, I mean, I agree with what you're saying. Incentives can be misaligned. That's not wrong at all. So how do we design that and where does that dividing line exist? Because I think we're right. We don't want to have dividing lines. We don't want to have a situation in which, you know, it is fox in the henhouse and a salesperson may be misaligned and really wanting to push something, you know, that's not the best thing from a security perspective, may want to hide something because it's not best for them. Maybe where the revenue comes from is much more opinion on one side or the other, and they're not treating the client the way they should. We don't want that to happen.

It can— it cuts both ways though, because I'm involved with an organization where the IT security function rolls up through finance, and they suffer from a different problem, which is that everything lives in theory and nothing lives in practice. So they, they push down all these giant edicts that in practice you can't actually implement, right? So there's— I think there's a— there's definitely a middle ground there somewhere where I agree that there should be separate oversight and governance. I think auditing is supposed to be the thing that does that, uh, but it, it's really hard to get those lines 100% right because they can swing in both directions too far.

Fair, super fair. Okay, so that was, that was a good— I wanted to chase that like I said before because I think that's a healthy discussion. So getting back into this, you know, vision a secure and hardened RMM ecosystem, let me just ask you a hard question right now: are we there? And if not, how far away are We are not there.

We are not even close to there. It— we are not going to be anywhere near that until installation of these tools is secure by default and can either not be lessened in security or requires positive action from the deployment— deploying user to make them less secure.

It—

I'm gonna pick on the one that I know, right? Like, there's still one of the big RMM tools out of the box still doesn't enforce like certificate checking on agent check-in, right? So it's vulnerable to man-in-the-middle attacks. And there's— sure, there's, there's hardening guides with best practices on how to do that, but I shouldn't have to follow a hardening guide. I— it should just come out of the box in a secure fashion.

Okay, agree. So you mentioned— I, I don't want to talk about that and, and leave, leave off any other obvious things because people are going to hear that and say, well, what are those other things? So you mentioned certificates, but just at a high level, anything else you'd point to that are like no-brainers that every MSP should be thinking about when it comes to RMM hardening?

I mean, I mentioned the one earlier, AV exclusions, right? Like we should not be requiring AV exclusions out of the box. MFA, all of these tools should require MFA on all users and we shouldn't have to do weird shenanigans for like integration users to like exempt them from that. And no, just set a really long password, no one will ever guess it, right? Like we, we shouldn't have to do any of those things for our— uh, was that thunder? Yeah, wow, that was cool.

It's Florida afternoons for you, man. It's gonna be bad for another 10 minutes, then it goes away and sunshine again.

Uh, uh, we shouldn't have to do those sorts of things. And they're— and I called it out in that meeting out there. Like, the, the lady from JCDC was trying to be nice, and she's like, I don't want to call anyone out here, but I feel like this stuff is not secure by default. And I raised my hand and I said, if you're not going to call them out, I will. Will, like the default security of every single one of these tools I've ever looked at out of the box is absolute garbage, right? It needs to be better.

Well, and what is it that Director Easterly said, you know, not just in the cybersecurity strategy, but she even said this leading up to this strategy being released, is sort of this idea of maybe we need to push the larger vendors to have a little bit more responsibility. And whether that's a Microsoft or that's an RMM vendor, you know, I think that mantra makes a little sense. The bigger guys have to stand up for the smaller guys. I mean, that's the reality. Quality.

Yep. I mean, we saw that, some of that, right? Like, we saw the Microsoft thing where it's like they were gating access to, you know, basic security logs. And, you know, now finally there's an incident where they would have potentially saved something, and now suddenly there's a big push to, to provide that stuff. We should stop gating, uh, features to protect you around bigger licenses. Okay. You know, just things like that.

Yep. Okay, so that's, that's the The mission is to get cyber defense leaders, as you see here, to be collaborative. I think we all agree collaboration is always good. Let's play well on the playground together. I would say let me brag on the RMM vendors to see the CISOs and maybe a deputy come in as well, kind of join together. We've seen them do that before. I think I'm proud of our industry to say, you know, at the, at the top end of the larger vendors kind of being willing to work together, we not only do we demand that, that. I think we enjoy being able to speak to that and say, you know, there's collaboration here, and I think that's good. And I think, by the way, a lot of these CISOs coming in from outside the industry is helpful in that regard, just to give some commentary, because they've probably been in other sectors where that's the way to the future. So good to see that. Um, and then we get down into kind of two big overall pillars. The first pillar being operational collaboration, which, oof, there's a lot in that. And then end-user education. So let's start with the first pillar, this, this operational collaboration. I highlighted this part here: major RMM vendors have highlighted their willingness to and desire to work with the, the group. However, partnerships or forms for sustained collaboration may not always be available to leverage. I'll go so far as to say I don't even think that exists at this point. Like, should it go through the CompTIA's, um, uh, MSP ISAO? Or is there like— how do we actually functionally begin this collaboration in terms of some more formality here?

Yeah, I think that's what they're trying to decide, right? They're— we, we had a lot of discussions around the best way to do that, and it comes down to meeting people where they're at, right? And, and so I think that what you'll see, or what I would like to see, and I can't speak to if this will actually happen, would be some methodology where some of these communities can join at some level and receive, you know, non-classified operational threat data that they can share with their members, right? And I think that that's the collaboration that they're looking for, but they're also looking for that stuff to flow upstream, right? And you have to get people that are willing to say like, hey, I'm seeing this thing. And you and I had a really good conversation in the back of an Uber on the way to a helicopter about this and the FS-ISAC with how even just silly little data from a number of small sources can be correlated and turned into, oh, there's something big coming, somebody's doing probing, stuff, and you would never have seen that in a vacuum looking at one individual endpoint.

Yeah, exactly. I'd love to elaborate more on this. Um, I will say, I think I can say this with a fair amount of confidence, that the financial sector probably does, at least in the private sector, does a better job of threat intelligence and sharing and collaboration than any other industry. And one of the reasons for that is they've sort of been mandated into it, and they also have enormous resources to pour into to it and they have challenges all in of their own, right? So if you're a small bank and you come into the Financial Services ISAC, you are overwhelmed with a deluge of information and threat intelligence sharing. You join into any of their intel mailing lists. Yes, they still use those. You're getting 20 emails a day, if not more, with threaded discussions. You just can't keep up. But if you're a full-time threat analyst, well, sure. I mean, that's your job. That's your mission. So we have to solve for that because zero MSPs are going to be able to dedicate a full-time threat analyst role And not only that, it's also, as you mentioned, there are certain— there are responsibilities everyone has when it comes to threat intel. At the minimum level, it's a see something, say something. Yeah, it's a, hey, I'm seeing this, I'm not sure about it. Hey, I saw a phishing email. We actually had it blocked, but here's some intelligence that we had around it. Whoa, this one looks interesting because it had a— some kind of maldoc attached to it. And I don't know anything about the malicious document, but I'm going to share it out for others to see, right? I saw a URL that was really— looked strange. I want to share this out. And then you have people that are existing a little higher up the chain that are looking over everything in the aggregate and saying, what are the trends? What are the bigger things we're seeing? How are we correlating this from a fusion perspective with other industries and the federal government? Hey, CISA, hey, DHS, are you seeing what we're seeing? Does this look familiar as well? Is this starting to bubble up? Hey, yeah, we're actually seeing that over here too. And then it's almost like you have— those are the chess piece operators at the top that are then coming back down the food chain telling us operationally what to do with it. So the bottom of the food chain looks up saying, "This is what we're seeing." The top of the food chain looks down and says, "This is what you should be doing operational." And it really turns into a cycle that's healthy. I'd say we're probably 5% there.

Yeah, if that. It's, and I think that's what JCDC attempts to do. Like one of the things you can do as a member is you can share threat data and they will enrich it with other sources of data they have that you have access to. And then you can get that data back enriched with like what other people have been seeing. And that's a huge benefit. I think one of the things that we have to do to get this started is we have to convince the vendors, the stakeholders, not just vendors, everybody, the stakeholders of the entire ecosystem that this threat intelligence data, it's not competitive data. It's not like data that you need to protect because it's gonna give you competitive advantage or a marketing advantage or being the first one out there to publish it, or there's a giant race to Reddit or whatever the case is. Sharing that data and collaborating, you probably get a better picture of the entirety of the scope of that. And there are certain vendors in our space that are better at that than others, uh, because there are certainly vendors in the space that treat it that way. And we, we have to kill that. And I think that that is basically what LOE-1 is trying to do, is like, let's encourage people to stop treating this as intellectual property or something they can capitalize on and share it around to everybody so we can enrich it and help everyone out. Yep.

And it's funny you say that because going back to that, when I say 5%, the reason I said 5% and not 0% is because we do have a few vendors that are actually really good at this. And you know, one of those we'll just call out by name is Huntress, right? They're always, they're always there talking about what they're seeing. And there's a number of others. I've seen Black Point do the same thing. I've seen a number of others too. And some are just going to be operationally better at that than others. And that's okay. I would tell vendors that are listening today that say, well, I want to be involved in those things. It's not about me being an ambulance chaser so that everyone looks at me and how great I am. It's about me genuinely trying to help. And so if that's the case, then recognize even if you're seeing a 1% collaboration and someone else is doing 99%, you're still doing your mission, you're doing your role. You may be in a situation that flips one day and you're in the 99%, maybe because you're more directly involved. And so I think when you establish that mantra of we're here to help, we're here to share, care, um, that comes back to you. You'll, you'll recognize that other vendors and MSPs say thank you. I don't even use your software, but thank you, um, and I'm willing to work with you when the tables are reversed. And I think that's the way.

Yeah, I think it is too. And it's good to see, uh, like the— and you called out BlackPoint, Huntress— I've seen both of them do it. I've seen them collaborate. I've seen, uh, Huntress collaborate with ConnectWise, which is something I never ever in a million years thought I would see So I think we're starting to see the beginnings of a more collaborative ecosystem. We just need to get the rest of the players to the table.

Yep. Yeah, very much agree. So if you're watching today, come to the table. And the cool thing is there is no— no one owns the table yet. That will formalize one day, formulate one day, but not yet. So come to the table, make your own table, make your own seat for sure. So the second pillar is cyber defense guidance. And there's some interesting things here, right? SMBs account for 6.5 million businesses, 40% of GDP. So we know it's major. You know, they've talked about and I like this, this is sort of it. They admit this. We've kind of been top down for the longest time working the large side. But I think they've recognized according to the 2021 US Telecom Cyber Survey, only 13% of SMBs even are aware and follow CISA guidance. So if the vast majority are not even aware, let alone following, and we've also been focused on the top down, Whoops, maybe we should rethink some of these things. Now, here's my deal, and I don't— I think you agree with this, but I don't want to put any words in your mouth. We don't accomplish this by going to SMBs and saying, hey, you know, CISA matters. Why don't you go read these documents? Because zero of them are going to say, I'm like, well, that's why I have an MSP. They do it for me. So the trick of it is, if we focus on the MSP, that's part of the solution. The other problem, the other part of the solution is to get the SMB to even care about CISA and why they're MSP should be following it. What do you think?

Yeah, I think that the second half is what CISA can do, right? Is like they have the, you know, the ability to run like public service announcements and things like that where they can try to raise awareness of this so that when their MSP comes to them with CISA guidance, they don't just get, ah, I pay you to do that, right? They actually, uh, they may actually be willing to have a conversation about it, right? And that kind of goes back to the conversation that you and I had at ChannelCon about, you know, business outcomes, right? Like you at some point or another, you need somebody else to lend some credibility to this so it doesn't just seem like a sales tactic and we're actually having— this is actually a business-related conversation even though it seems like it's not. Uh, and them pushing that awareness I think helps all of us.

Agree, very much agree. And so, you know, maybe some points back for CISA, you know, is what about even inserting yourself collaboratively with even other, um, other, other— like, uh, for example, FTC Cybersecurity Safeguards has just come out, right? It has this wide-reaching effect into a lot of different industries. I'd love to see some clarification there to say, you know, one of the things we want to see in the future is your, your CPA firms should have a mechanism in place according to their size and complexity to work with, to receive, and to react upon CISA guidance. Even just a small note like that gives them the freedom to say, well, how do I do that? Well, I have an MSP. Hey, MSP, can I just— all I need to do is make sure that you're doing, you're following CISA of guidance. That's all I need. If we can just push them to say, again, business outcomes, that's one of my requirements, but I can outsource that, but I'm still responsible for it. Yeah, I think that gives some more teeth and some more, hey, this MSP is actually doing something for me for that reason.

Yeah, I 100% agree.

All right. So last thing we're going to talk about, if anyone has questions here, you're talking to Jason, one of the— Jason Slagle from CNWR, one of the folks that was a collaborator operator in this document. So you got a source of knowledge here. So, so please ask if you have questions. One of the things they also kind of close on is kind of what's happened and where things are going. So expanding the partnership, we've talked about that quite a bit, the what they call whole of nation cyber defense planning efforts. So they say, you know, no one has all the information for sure. So I like this. I, I highlighted the second part. You know, one of the big things is identifying priority areas to address systemic risk across the RMM ecosystem, develop well-informed, impactful cyber defense plans. Can you play that out for me? What's that going to look like? I mean, that's 1% down the road, right? We've got a lot to do there. What's it going to look like?

Yeah, I mean, I think it's getting the, the vendors initially, the vendors in the ecosystem to talk to each other and agree on a common set of rules around how we secure these things, right? Like, and, and then, you know, we start taking downstream from that.

Okay, that's good. Um, and I'd love to see what that looks like. They also mentioned the CISA Ransomware Vulnerability Warning Pilot and the Pre-Ransomware Notification Initiative. I don't think anyone's talking about either of these. Are you familiar enough to talk with either of these? Got links for both of them.

Uh, I, I kind of am, but not from this. Uh, we had— I, I have a small hosting environment, and we had a web hosting customer customer that I got alerted from the pre-ransomware thing that somebody had compromised the box and we were able to get it offline before they were able to do anything with it. Uh, it, it is something inside of it where if they get threat intel that, uh, say they own a command and control server, which does happen, they get control of it or monitoring into it, they can see that a customer is infected or impacted and it hasn't— they haven't yet executed the payload. Upload, they will reach out and warn if they have a contact. And that's actually really cool.

It is. They even mention if you receive a notification, you can verify the identity of the CISA personnel through— this is the email address and this is the phone, which I— so it is pretty— I mean, I, I think that's wonderful. Sometimes they do have to get in front of this. So yep, this right here is the Ransomware Vulnerability Warning Pilot. I encourage everyone to go and see it. And then as you mentioned as well, the pre-ransomware notification capability. And then here's the information here on this as well. So I think that's good, and I, I think we should rely on CISA to kind of be our hurricane warning system, so to speak, for some of these things, because naturally they are going to see some things that the rest of us just might not.

Yep, they 100% will. They have a lot more, a lot more visibility.

Yeah, agree, agree. So there you have it, there's how we end. And in case you didn't see it, acknowledgments. I mentioned this at the very beginning, but there is I think it's kind of awesome. Did you ever see— did you ever think of a day, Jason, that one day you yourself and CNWR, your company, would ever be listed in an assisted document? I mean, that's kind of cool, right?

Yeah. If you had told me 5 years ago I was going to fly to D.C. and sit in a government office to talk about cybersecurity, I wouldn't have believed you.

That's awesome. So close us out here as we finish. I'm going to bring the chat back up. This is good for the industry, right? But what do you want to see happen next? We're going to give you the dictator's wand to wave. What do you want to see happen next? Out of this?

I want to see in our industry solidification around some sort of benchmark that can push this stuff forward. My, my money right now is on probably the CompTIA Cybersecurity Trustmark, right? Some sort of thing to, you know, start to show, uh, that individual MSPs have, you know, security chops with them, and then we can start to bring vendors into it too, so vendors can have their best practices and all those things. I think that sort of collaborative effort led by some sort of non-vendor-led, right? So a neutral third party is what I think we need to start making this happen.

I can get behind that, right? Because, you know, there's always been discussion around should MSPs be regulated? Should there be a— how do we know that an MSP is an MSP? Why don't we pause that discussion for now and say a much easier next step pathway is let's all get behind Trustmark, um, and let's say, hey, because they don't have an evil horse in the in the sense of, you know, that's some vendor conniving or something. Um, yeah, let's all say this is the standard that we're going to adhere to, and as long as it is reflective of a one-person MSP all the way up to the largest, I don't understand why that wouldn't be our next step. And then, you know, I think we could even see potentially some agreements between some of the carriers, the insurance carriers, to say, well, we'll take a bite out of this risk given that, you know, there's some, um, there's some, some delineating differences between those those MSPs that have it and those that don't, and we can go from there. So I think that's really good advice.

Yep, I, I 100% agree with that. Where—

just as an aside, where is Trustmark in its journey right now?

Uh, I think the first 60, 30 MSPs are in pilot, or at least been asked if they want to go through pilot. Uh, I think the first, the farthest along are right— is sitting about right at the 60% mark. So the controls are— the controls are solidified. Our next step I'm on the working group of that. Uh, so our next step right now is providing auditor guidelines so that we can have the audited piece of it.

Okay, awesome. Um, I, I'm excited to see that come about. I think that'll be great. Um, as we close, maybe just two more things I wanted to point everyone over to, just so you are aware of a couple things I think are going to be great. One of those— let me share my screen back out if I can get this browser tab to do what I'm trying to get it to do.

There we go.

One of them is, don't forget, we are doing the Cybersecurity Masterclass for MSPs. This is done in concert with, with Huntress, my friends over there. It's really awesome. So we just got done with one yesterday, Chris Cochran and I. And if you guys don't know Chris, he's just an incredible person. And so we have two coming up, one in Dallas, one in LA. You can actually sign into that for free right here. So just huntress.com/masterclass. .com/cybersecurity-masterclass, or just search Cyber Hunter's Cybersecurity Masterclass. Really good. We do some really great discussion on building your security program, how to use analogies and stories to communicate the value of security. And then the other thing I wanted to share as well is this right here.

We're doing—

Alex Farling and I are doing a webinar on onboarding from a CISO's perspective. What should you be doing, thinking about as we onboard a new client? What security minimums and security requirements should go into that. So check that out. You can see that on my LinkedIn page if you want to get over to that as well, and you can register right in, or just DM me and I'll give you a link in. So I wanted to share both of those. Um, Jason, thank you so much for joining today. This has been super fun. Thank you for kind of illuminating where we've been going with this. And if anyone has any final questions, ask them now because we're about to drop. Other than that, um, Jason, hope you have an awesome weekend. Anything you got in particular to get on the bike or anything? What are you gonna be doing?

I might try to get on the bike Weekend. I've been not feeling a little under the weather all week, so getting back in the gym. Uh, I think it's gonna be warm. We're gonna swim. We got a new pool, so we got friends coming over to swim tomorrow.

Nice. New pool is the way to go. Um, cool. I appreciate that. Uh, Glenn checking in saying thank you, great breakdown, have a good weekend. Appreciate that. Share this out to your friends. All you got to do is hit the share button or the repost button, and that'll go out to your links as well. Um, Jason, thanks for joining me. Hope you have an awesome weekend. Everyone that's with us still today, thank you guys joining as well. And until next time, we will see you later, my friends. Thank you so very much.

Cool. See ya.