Federal agencies must “immediately” adopt guidance on software supply chain security as required under the May 2021 cybersecurity executive order, the Office of Management and Budget stated on Wednesday. Federal agencies must begin to adopt NIST’s Software Supply Chain Security Framework and related guidance effective immediately, tailoring it to the agency’s risk profile and mission, the agency said in a statement.
CISA has warned about the Ragnar Locker gang, which the FBI says has breached at least 52 organizations from multiple US critical infrastructure sectors. Specifically, Ragnar Locker operators terminate remote management software (e.g., ConnectWise, Kaseya) used by managed service providers (MSPs) to manage clients’ systems remotely on compromised enterprise endpoints.
N-able findings show that managed service providers (MSPs) are quickly overtaking their customers as a primary target for cybercriminals. The research also revealed that while 90% of the surveyed MSPs suffered a cyberattack in the last 18 months, the number of attacks these MSPs are preventing has almost doubled, from six to 11
- 82% of MSPs have also seen attacks on their customers rise, though not quite at the same rate, with an average of 14 attacks prevented per month.
- DDoS and ransomware are among the primary attacks MSPs detect, but the top attack remains phishing.
I also want to highlight a change in perception of open-source software. 89% of IT chiefs believe open-source software is as secure as proprietary software, according to a survey by IBM-owned Red Hat, the maintainer of Red Hat Enterprise Linux (RHEL). This is from Red Hat’s The State of Enterprise Open Source.
Changing perceptions… that’s my thought today. Open source isn’t the risk it was. MSPs themselves are more the target than their customers.
If I were still working for a vendor, I’d have taken the N-Able data to imply how much security matters for MSPs. Now, my analysis adds the other side – MSPs are at greater risk even than their customers.
It’s about challenging assumptions – so-called Best Practices. Those change over time, and it’s important not to forget that. I’m pondering a lot of those right now.