Author: taylor

All Two-Factor Authentication (2FA) is Multi-Factor Authentication (MFA), but not all MFA is 2FA. Multi-Factor Authentication works on the principle of using multiple pieces of secret information in order to verify identity. Standard usernames and passwords can be brute forced but using a separate piece (or more) of information makes this more and more impractical. Some MFA schemes will use secret questions (effectively extra passwords), or a onetime key from an authentication application.

It used to take days to guess an 8-character password, now it takes literally minutes on a $35 Raspberry Pi. Everything requires a password, and people can be lazy and recycle passwords. If a user’s password is compromised for one site, who knows what other accounts are now compromised? Even the most trivial 2FA or MFA solution can reduce the impact substantially.

How Does MFA Work?

MFA (and by extension 2FA) add a protection scheme based on knowledge, possession, or biometrics.

Knowledge

This form of authentication relies on a knowledge-based challenge. This can be an extra password, a security question, or some other type of challenge. The goal here is to buy time without inconveniencing the user. By adding a separate password, an attacker must gain access to both passwords, and avoid locking themselves out trying to do so. Some challenges will have multiple potential knowledge tests to make this more complex.

Some of the first MFA I ever worked with was through a bank. The bank had a list of 20 images which you picked from and added a description. Each time you logged in, it would give you a subset of the images, you picked the one you had, and then it prompted you for the description. If you got it wrong 3 times, it locked the account for some period. My password got hacked plenty of times, but my account never did. Even something this low-tech ended up stopping dozens of potential breaches.

By having you pick the specific image first, it tested your knowledge. The prompt would then pop up no matter what was picked. This method is somewhat safe, but not foolproof by any stretch of the imagination. A single incident with a keylogger could get everything.

Possession

Possession challenges rely on the physical possession of a device or some other item. This can be a USB key or a device which generates a code. Most things people think of as 2FA are generally going to be password based on possession of an application which generates a one-time key.

Almost everyone has something like Microsoft Authenticator or Google Authenticator on their phone for work or just general security. If someone manages to compromise your computer, they don’t necessarily get your account outside of the current session. Using a separate device to authenticate mitigates the effectiveness of a keylogger or of a very coordinated attack to gather information on a target.

Biometrics

Fingerprint readers, retina scanners, facial recognition, etc. are all forms of biometrics. Biometrics rely on inherent properties of the user. This works for and against security though. A mask can fool facial recognition, while a carefully crafted gloves can trick the fingerprint reader. Biometrics are inherent properties, so the entire method needs to be changed if they’re compromised. Collecting biometrics for work and similar also presents privacy issues for their storage and usage.

Which Method Works Best?

Most standard 2FA solutions use the principle of possession, but this doesn’t mean it’s objectively the best method. Each of these methods perform a balancing act between convenience and security. Knowledge is the easiest to get and easiest to track without extra equipment. Biometrics are the hardest to copy (at present, deep fakes and technology aren’t helping here), but they’re also impossible to (practically) change. You can’t just grow new fingerprints. Possession strikes a balance. An item or a device can be revoked, but users must account for an extra device. If you forget your phone, you’re out of luck.

Possession is the most practical at present. Having a physical device means that stealing a one-time key or password is near useless (unless the algorithm can be cracked), and the device can be revoked if it is physically misplaced or stolen. We use the principle of possession (and a degree of knowledge for an added challenge) for ID 20/20, our in-house MFA solution. The trick is using a device someone will (almost) always have a way to authenticate without inconveniencing the user.

Why Is MFA So Important?

Phishing and social engineering are some of the biggest security threats to businesses. MFA helps neuter phishing and social engineering attacks by adding a layer that an end user will struggle to give away. It’s easy to type your password into the wrong box, but how do you give your phone or a USB key out too? You also know almost instantly when one of these devices is missing.

You can try and train end users, but people don’t always listen and don’t always want to learn. It’s hard to tell the difference between l and I, or why it matters if a site is .com or .org. What does it mean if a certificate is invalid? Most users don’t know, and more importantly, they don’t really care. They see an email saying they must “act now” to prevent a catastrophe and they act. Attackers prey on ignorance and emotion.

MFA throws a wrench in the gears for this. The username and password are only two of the three parts to the key. Without the third part, the whole exercise doesn’t accomplish much for its direct target. If 2FA or MFA in general is available, enable it. If a product doesn’t offer MFA and it’s going to have personal information or other sensitive data, ditch it as soon as possible.

Using More Factors

The more factors in use for authentication, the harder it is for an attacker to get in. The more important information is, the more factors should be in play. Ideally, use multiple challenges. Have a secondary knowledge test on top of a possession-based challenge. Stack the odds in your favor.

A targeted enough attack might get the username and password, but it’s harder to get MFA information. Harder, but not impossible. Your user might tell someone their mother’s maiden name, or it might even get breached from a targeted attack elsewhere. The more unrelated pieces of information and unrelated challenges there are, the harder it is to breach an account even if the credentials are leaked. Your mother’s maiden name doesn’t help much when it’s necessary in conjunction with a one-time password.

Using MFA

MFA is often seen as a hindrance and an inconvenience, but it’s more important now than ever to use it. Apply MFA where you can to reduce the attack surface for a given product

You don’t want your bank giving away your money to the wrong person, and you don’t want users doing the same to their employer either.  MFA implementation as a protection for business rather than just a plain “security measure” with cryptic “future risks” is the attitude to have here.

The tug-of-war of security versus cybercrime is an ongoing battle. Even an extra password or some other knowledge-based challenge is going to be better than nothing. It doesn’t have to be over the most efficient solution, it just needs to work and provide security.

For more information about applying healthy MFA practices and keeping your business safe, schedule a FREE consult with us and we’ll be happy to help you!

We’ve already had ample warning that Windows 7 and derivatives are reaching the end of life, but what is actually going to happen on January 15th? Previously, Microsoft was content to just let the devices fall off on their own, but devices with XP hung on for years past what anyone expected. Many of us still deal with the odd Server 2003 machine. Microsoft has also been receiving a bit of ire for their forced upgrades on Windows 10, so it should come as no surprise that they’re going to do the same with Windows 7.

Upgrade Popups

Microsoft has stated that the December 10th rollup KB4530734 will show a full screen popup telling users that Windows 7 has reached the end of life and there will be no further updates without purchasing extended support. The popup will require user interaction. The good news is that Microsoft has stated that this will not affect machines in kiosk mode or machines joined to a domain. This patch also applies to Windows Server 2008 R2.

Compliance Risk

Since Windows 7 and Server 2008 (R2) are all going out of support, they will also be going out of compliance (e.g. PCI compliance). Most compliance specifications have something touching on updated software or operating systems. To make it even worse, usually just a single agent at the site is enough to blow the compliance status of the entire site.

PCI compliance, HIPAA compliance, ISO 27001, etc. all require operating systems to be supported and up to date. Out of date OSes create massive issues and can be a huge security vulnerability. The compliance headache of a violation alone should be enough to move most businesses, but unfortunately, it’s not unless it’s explained correctly. Your business should know that a compliance violation can be grounds for a fine or lawsuit if you don’t act.

Security Risks

Windows 7 and Server 2008 (R2) going out of support are one of the many security concerns for 2020. It’s also one of the easiest to stop at least, but many organizations want to hold out like they did for XP. The popup won’t be showing up for domain joined machines though, so the people who need it the most probably won’t see it.

There are some serious security risks to consider with Windows 7 and derivatives. First, there aren’t going to be anymore updates. That means the next Specter or SWAPGS are probably going to be there to stay. Microsoft may have relented with XP, but the nagware and push towards Windows 10 and its inability to avoid patching is a direct action to force upgrades this time around.

Microsoft isn’t the only one planning to drop support for Windows 7, it gives third-party software developers a reason to drop it as well. From advanced security software to basic accounting software, all of them will drop support sooner than later. It only makes sense to drop a platform without vendor support since it means less testing and less support for something which should be gone already.

Holding Out for Windows 7

Microsoft doesn’t have to worry about too many holdouts. Windows 7 will have been supported for almost a decade, and they stopped selling licenses in 2016. Modern hardware doesn’t support it, and come January 15, 2020, new hardware will begin to work less and less with Windows 7.

The machines from early in Windows 7’s life cycle have ancient dual core processors and some even have 2GB or 4GB, which is almost unusable with the modern internet. They’re littered with old spinning rust drives which have long passed the 3-year reliability mark, and early generation SSDs, some of which didn’t even have TRIM. Microsoft is just going to let attrition take out the few holdouts where they can. After all, how long are these machines going to be usable?

Avoid Security Ramifications of Windows 7

Microsoft has “forgotten” to close a loophole which can be used to upgrade from Windows 7 or 8.1 to Windows 10 for free. Upgrading is the easiest way to avoid security issues. This method also wholesale avoids the compliance issue if you can do this at the entire organization.

Obviously, upgrading everything isn’t always possible. Some legacy programs require Windows 7 or older, and there can be other compelling reasons a client doesn’t want to upgrade. Even though they may have good enough reasons, their decision or limitation is still going to present security issues.

We previously went over how to circumvent some of these limitations. Airgap the environment with legacy bits as much as possible and use virtualization where possible. This won’t necessarily solve your compliance woes entirely, but it does reduce them.

Capitalizing on the End of Windows 7 and Server 2008 (R2)

You can bet hardware manufacturers and technical companies are going to take the chance to cash in on the end of Windows 7 and Server 2008 (R2).

A new computer shouldn’t have issues with Windows 10, but that Windows 7 machine may just simply not be compatible. How old is it by the way? Can you get parts if it dies? How business essential is that machine?

If you decide to keep some Windows 7 or Server 2008 (R2) servers, you need to have the uncomfortable talk about security. It’s not going to be supported, so who ends up supporting it? You do! The networks with legacy OSes need to be schemed off as much as possible and made as secure as possible. This can require new networking equipment if the old stuff just doesn’t cut it.

Countless service, software, and hardware companies are all looking to cash in on the mass exodus from Windows 7. Make your life easier and spend less now than when things can get ugly like the brakes of a car. It’s cheaper to change your brake pads than ignoring them and having to repair a multitude of issues later because quite frankly you ignored the red flags. Become secure and compliant again without wasting any more time.

Moving Forward

KB4530734 probably won’t affect your enterprise, but it shows what Microsoft is planning. They learned from the inertia against moving away from Windows XP. The same tricks forcing people between upgrades of Windows 10 are going to be used against Windows 7 holdouts.

Don’t expect KB4530734 to be the last move to push people from Windows 7. Expect more nagware and inconvenience to force upgrades to either extended support or Windows 10.

The popup is going to be the least of your worries if you don’t act now. With modern security threats and the growing interconnects of every device, you need to be on top of security or risk the destruction of your business. Your livelihood is on the line if you don’t act, and Microsoft has no qualms doing what is necessary to ensure upgrades. Move now or risk compliance and security issues.

by Joseph Landes

Businesses of all sizes are looking to move their IT infrastructure to the cloud and the most important choice to make when doing so is finding a great IT provider who will have your best interests in mind on this journey. Promises will be made about capabilities and expertise, but it is important to keep your eye on three important things to ensure your Managed Services Provider is committed to helping you transform your IT infrastructure to the cloud.

Recommending Best in Class Products

Nothing else matters if a vendor’s product is not best-in-class and it is why so many vendors lose business in the competitive cloud ecosystem. There are too many other competitive solutions combined with somewhat low switching costs to settle for something that is not phenomenal and brings massive value to your business. When moving to the cloud, does the technology provider have a strong track record of performance? Do they have the infrastructure to scale with you as your company grows? A good sign that it is time to look elsewhere is if the product your partner is offering can’t pass a basic Proof of Concept or is just feature-poor relative to other comparable solutions. This is why I strongly recommend Microsoft Office 365 and Microsoft Azure as the core building blocks for any company’s initial foray into the cloud. No other company has invested so much into empowering businesses of all sizes to do more than Microsoft.

Adding Value to Your Business

My former CEO of Microsoft, Satya Nadella, often says that a company’s past success does not define or predict their future. That each day your partner needs to come in and continue to win your business anew. This lesson holds great relevance in the burgeoning cloud ecosystem with so many vendors, replacement options, and new technologies emerging daily. The day your partner started working with you is the day the clock started ticking on their need to constantly create value that accrues to your business. The technologies they choose must help position you as a thought leader in front of your customers. They need a clear Conditions of Satisfaction that defines their relationship with you and there needs to be regular check-ins to make sure your business is growing as result of the relationship.

Driving Down Your Cost

The cloud ecosystem is a competitive space. New technologies continue to emerge with even more powerful functionality than in months prior. Startups are being born by the hundred and thousands in the cloud and the need to maintain on-premises hardware in your office is a thing of the past. One would think that while the technology gets better, it would be more expensive to move the cloud. But it is quite the opposite! Business have increasingly been able to take advantage of economies of scale the large cloud providers like Microsoft has achieved in order to drive their costs down dramatically. In the past, a company would have to shell out many thousands of dollars to buy a server and amortize that cost over time. Now the model is consumption-based, and you only need to pay for what you use just like the electricity in your home. Moving to the cloud has a number of benefits for your business—and one significant one is driving down the cost of IT.

Moving one’s IT infrastructure to the cloud should be a near-term goal of every business. Putting off the decision to digitally transform your business could be costing you customers and making you less competitive. The time to move is now and we look forward to partnering with you on this exciting journey.

 

Joseph Landes is the Chief Revenue Officer of Nerdio — an exciting cloud startup in Chicago that helps Managed Service Providers build cloud practices in Microsoft Azure. Prior to joining Nerdio, he spent 23 years at Microsoft leading high-performing international sales and marketing teams and helping businesses of all sizes move to the cloud. He has travelled to 108 countries and is attempting to read every NY Times Notable Book ever published.

The end of life for Windows 7 and Windows Server 2008 and 2008 R2 is coming January 15, 2020. This means that support, is coming to an end. On this date, these OS’s no longer check certain compliance checkboxes for safe usage.

The biggest impact is going to be on security for the OS itself, but this impacts the whole site. Once these reach end of life, there will be no support whatsoever for critical bugs or massive security holes. That newest zero-day? There’s nothing that can be done about it most likely.

What Should You Do?

You need to be ready so your clients can stay safe. You and your client are sitting on a ticking time bomb if you haven’t started preparing to move already, but at least you have plenty of time to research and get ready, but only if you start as soon as possible. Moving from Windows 7 and Server 2008 (R2) can be difficult, but not with a little bit of planning.

Workstations are easy to get away from for most cases, but servers are a bit harder. This is a great opportunity to also sell the client on newer hardware if you can to get out of the predicament and to outpace the natural inflation of hardware requirements for software. Naturally, this isn’t always possible depending on the client and depending on how new the hardware they’re running is. If the machines have been sitting around since much earlier in the support cycle for Windows 7, your users will probably welcome an upgrade.

What’s Involved?

Licensing and software compatibility are two factors to look into heavily for migrating. A great server from a few years ago can be a huge expense to license a newer version of Windows Server on, but an okay server with a cheaper license (OEM discount, fewer cores, etc.) can even end up cheaper than what you get back selling the old server. SQL Server and Exchange can further convolute the licensing situation however.

Software compatibility is another huge factor in the migration process. Some specialty software just plain doesn’t run on newer OS versions. There are complex ecosystems which are centered on a specific OS version and require an almost complete repurchase of every piece of the ecosystem to upgrade to a new OS in the first place.

These limitations can impact budgets pretty heavily depending on the size and scope of upgrades required. This is something which should be planned from day one of deploying a server (specifically, how to plan a budget around the next jump and when it should be), but is often overlooked. Computers, despite their relative upgradability, are not one time purchases.

Making a Plan

If you or your clients care about security. You will move or at least limit the damage an older box can do. If you haven’t built upgrade cycle budgets into hardware budgets, you need to start as soon as possible. A server or workstation should have a planned lifespan, and the money should be allocated for the replacement as soon as it hits end of life. “If it ain’t broke, don’t fix it,” doesn’t quite cut it for security or future-proofing.

Staging upgrades in over the next few months can also help your clients. This can reduce the perceived cost and make upgrades a bit more predictable. It also gives the clients time to get used to the change. Staging the upgrades in with the most technical or least impactful employees (e.g. interns) at the company to the least technical or most impactful (e.g. C-suite) can help build inertia for deployment and help the company adjust without as much impact.

Overcoming the Limitations

There are machines which cannot sanely be upgraded. There are several methods to overcome the limitations of the upgrade cycle. The two most common tactics are virtualization or partial air-gapping (or getting as close as possible) for the affected machines. These are not completely isolated tactics however and are best combined if possible.

Virtualization

This is the most common tactic to get around upgrades and the safest. There are still many Windows XP VM’s floating around. From old accounting software to legacy industrial systems, there are plenty of reasons to keep XP around. The more specialized the environment, the harder it is to move away from it or even upgrade it depending on the upstream vendor or cost.

For software which just won’t work outside of Windows 7 or Server 2008, most of which actually predates Windows 7 or Server 2008, virtualization is an easy step with modern Windows and decently modern hardware. A P2V migration may be a good idea for these scenarios. For workstations, this is pretty straightforward, especially when the machine is being upgraded because it’s usually too old for Windows 10 to be practical, but it can get a little harder with servers.

For servers, you want to make sure you have a suitable host, and you want to strip the server of as many roles as possible. The less access and privilege this server has on your network, the better. Even if it is less than ideal, it is also a good idea to try and avoid consolidating these servers too much. The more specialized they are, the more exact privileges they can have which limits security holes when intelligently applied.

Partial Air-gapping (Or Getting As Close As Possible)

Air-gapping is the practice of separating a machine entirely from the outside world. While complete air-gapping probably isn’t going to be too practical in most cases, the general principle should be followed as much as possible to partially air-gap a machine. A box which is inaccessible is not going to be practical to compromise. Every layer of convenience is a face to the attack surface for these weak-points.

Block as much traffic as possible to the given machine. If it was on a domain, take it off. If it has to be on a domain, spin up a secondary domain specifically for it. This limits the attack surface substantially and reduces what a successful attack can do.

If you need file shares, use a clean machine as an intermediary. Have multiple shares and use the intermediary as a jump box of sorts for transfers. Have a limited share between the intermediary and the old agent, and a share between the intermediary and the rest of the network. This adds a layer of complexity, but helps with safety.

How Many Are Out There?

Windows 7 usage sits at about 30%. A subset of our environment (just over 27,000 Windows agents for this example) shows that Windows 7 and all Server 2008 derivatives are sitting at around 30% as well. The general trend seems to remain the same for both business and overall usage. The overall number is in free fall, but still has a ways to go. Enterprise is a bit harder to peg down exactly what is going on.

Obstacles to Upgrades

The only thing which is really holding the numbers back is the lack of a viable alternative to most users. Windows 10 tries to be Windows 7, but misses the mark with both IT professionals and users. The majority of shifts happened during the free upgrade period, and newer shifts to Windows 10 are from machines dying rather than planned upgrades. Some clients even lament the loss of their Windows 7 machines. Some businesses were even buying old keys from salvage machines up until a few months ago. The Windows Update and upgrade system is maddening without moving to Windows 10 Enterprise.

From a server perspective, it doesn’t really offer enough to compel upgrading perfectly functional servers either. The licensing nightmare that is Windows Server further exacerbates the problem. Hopefully, Microsoft thinks to implement a smoother, more transparent plan to move servers (besides their push to Azure). I personally doubt they will as a power play, since they know many business’s hands are tied due to compliance.

Moving Forward

Ultimately, servers may hang on due to licensing, but the vast majority of workstations are going to have to be upgraded for both security purposes as well as pragmatic purposes. Newer software updates will begin shunning Windows 7 and Server 2008 the same as Windows XP back in 2014. It won’t start all at once, but within a year or two, the vast majority of applications which work on Windows 7 will work by lack of change rather than support.

It can be pricey and painful, but it is ultimately necessary. Try to amortize it out where possible and be ready to keep key infrastructure pieces secure which cannot be upgraded. If a client refuses to upgrade, they open themselves up to more and more security compromises which can bring down their business which hurts both them and you. There really isn’t much of a choice but to upgrade, or try to continue supporting a device past the point of obsolescence which weakens their business and yours.

by Sage Driskell

MSPs large and small are systematically being targeted over and over in the news. It’s almost weekly a new article comes out about a given large provider being targeted. Many of these attacks come from API weaknesses. You can’t control the provider or service, but you can minimize the chance of these attacks impacting you and your customers.

Leaky APIs

Leaky APIs are APIs which allow easy exfiltration of data from a service. These exploits often stem from deprecated APIs or privilege escalations. Many deprecated APIs exist in products for backwards compatibility, but they often come with caveats and holes.

Privilege escalations can happen on APIs due to loose queries which can return data from outside of their scope. Other escalations rely on multiple APIs which accidentally return data outside the scope a user can see normally due to their interactions. A deprecated API may help break another API when glued together with the wrong product.

These types of attacks are often used to harvest credentials or information for attacks later. Stolen passwords can be used on any similar account on multiple platforms to see what is shared. Hackers glean data which makes their later attacks easier either for traditional attacks or for things like phishing attacks.

Weaponizing APIs

With the creation of things like fileless malware and easy, privileged access via RMM tools, weaponizing an API has never been easier. Other products like Webroot have been had similar incidents from adding the feature to run commands remotely. This feature creep combined with API access makes these tools further targets.

Most products rely on various SQL products for databases. Many APIs where the developers are not security conscious will be a thin layer between the user and raw SQL queries. These can be weaponized to poison the data allowing greater access or to exfiltrate useful data. Depending on the product, it may be possible to insert hostile, arbitrary code which gets run by something within the API. Some RMMs even store scripts as blobs in the database.

How Do These Attacks Happen?

These attacks happen because of lax security policies on both sides of the equation. Many vendors do not take into account the ramifications of the access their API can provide. Vendors which integrate their products may ask for more permissions than they should need to function. A lot of permission sets are too permissive in general because its easier for the developer and the user to set up.

Clients of these products often fail to limit users enough. API users floating around provide an easy in to a company if they are compromised. Sometimes, the way multiple APIs talk to one another may be targeted as well. A simple return status from a query in a limited API may provide information that the other API would not normally have given. A simple boolean reply may provide a necessary bit of information for a malicious actor to work off of.

What Can You Do?

Removing unnecessary API users or users which may have API access is one of the easiest steps to protecting yourself, even from APIs outside of your control. Turning obsolete or unnecessary API versions, or even entire APIs off, is another great step. Use it or lose it. Trim off enough of the fat, and the hunter will target easier, more profitable prey.

Shrink your attack surface to shrink what you have to keep safe. Besides just trimming off the obsolete, scope your API users. An API user which only reports from a product doesn’t need write access. Your users need Two-Factor Authentication (2FA) everywhere possible. Do not share credentials between API users and do not recycle user names if you can help it. These basic steps have headed off many attacks before they even have the chance to become a threat with very little imposition on our technicians.

If you run products in house which have an API you use, try blocking traffic based on IP for whatever is using it. This isn’t always possible, but can often be used to limit certain service APIs to specific, known entities which limits the impact of a leaky or broken API. Rate limiting connections is another great step. If your average client hits 5 requests per hour, why not set a limit of 10 requests per hour so that brute force attempts take significantly longer? Alerting on these thresholds is another great step, especially if you control something in the stack which can see this.

Researching Products

No product is going to be perfect, but you can shop around to minimize damage. How does your current product handle exploitation? Are they quick to report it or do they take their time? A vendor which reacts fast, may still get hit, but at least you’ll know before your clients do and be able to protect yourself.

A vendor which tells you about an exploit quickly is also a vendor which works on fixing it quickly. Look at the vendor’s response history and how long it takes them to clear out serious CVEs to know how big a threat they are to your business. If they can’t keep up with serious vulnerabilities which are reported, what else are the missing that’s not reported yet?

Always be on the lookout to how a vendor impacts you and your clients. A vendor which never has real access is easier to trust than one which can make system level changes. Look out for how they handle older APIs too. A vendor which leaves deprecated features in too long runs the risk of being exploited down the line.

Ask your vendor what they do about older versions and whether or not they rate limit requests and accounts. See what the scope of their API access is. The irony is that those proudest of their APIs open access will usually be the first to tell you about it. Weigh this with your other options and the impact on your client before signing.

Our Strategy

We minimize unnecessary API interaction and work to maintain best practices to prevent exploits. When an API becomes obsolete, it is removed from our system where possible. API access is also further limited for fixed entities to prevent more wholesale access from being available off premise. Users need 2FA to get into basically anything. These patterns heavily minimize the attack surface with very little maintenance. Our large community contributes to helping make sure every potential exploit is known as soon as possible.

Our Security Focus

We focus on a holistic approach to security, and try to stay ahead of exploits and reduce the risk of any given component. Your security is only as strong as its weakest link, so you must be vigilant. Prevent unauthorized API access by preventing any access unless necessary. We want to know about an exploit as soon as it is public, if not before and be able to react to it.

Cutting off your finger is better than losing your arm, but not having to lose either is best. Prioritization of exploits is extremely important to surviving in the modern security landscape. We’re well past the days of “perfect security” even being a pipe dream, let alone realistic. We work to hedge our bets and make our platform the least ideal for hackers without sacrificing functionality. An ounce of prevention, even if it’s bitter, is a lot better than a pound of cure.

Going Forward

Stay ahead of hackers by locking down every aspect of your security. APIs are one of the most often overlooked, easily exploited part of many products. Almost every major software product is going to have an API of some kind too. Know what you’re dealing with and limit the damage where you can. MSPs have become low hanging fruit to many hackers, elevate your security and elevate yourself from being next.

by Sage Driskell