96
Inside the mind of a CISO
View this email in your browser
The weekly newsletter of the Business of Tech, giving you new insights into the world of IT service delivery.
Looking for stories from the podcast stories? Check out the pod itself on Apple Podcasts, Spotify, or daily in your inbox. Stories are available to everyone for five days,and Patreon supporters forever.
Was this forwarded to you? Join the list!
Inside the mind of a CISO
With our recent deep dives into the role of the Chief Information Security Officer, I couldn’t pass up the opportunity to sit down for another discussion with Patrick Beggs, the CISO at ConnectWise.
Between his government experience, commercial knowledge, and on-the-ground work at one of IT’s biggest management software companies, we had a lot to unpack on the cybersecurity front.
Ready to hear what’s on his mind these days? If you’re looking for ways to freshen up your own approach to security, keep reading for his advice, insight, and more from his bonus episode of the Business of Tech.
Operationalizing Security
We kicked off our convo – this time in-person at ConnectWise’s IT Nation Connect conference – with a simple question: how does Beggs approach implementing security at his organization?
He walked me through a strategy he’s been using for many years across all his roles: cyber fusion, a proactive, intelligence-driven approach to cybersecurity operations. In his words:
“We would rather find challenges within our own environment before somebody else does.”
Because cybersecurity can too often become reactive, Beggs and his team are focused on leaning forward to test themselves and peeling back their operational layers to discover their own weak spots.
So, what does this org chart actually look like in practice? I asked Beggs to explain, and he outlined a few pillars (in particular order).
The first pillar is all about privacy, compliance, and governance. This is a really big space for ConnectWise, as they have to follow various regulatory rules while interacting with third parties.
The next pillar is their traditional cybersecurity operations group, including their Security Operations Center, Incident Response Organization, and Identity and Access Management teams.
Then, they have their product security and counter-threat operations group, which focuses on maintaining the integrity of all of their product security offerings.
“From just idea to inception all the way through release, there are different places where our product security engineers and teams and analysts are engaged with our CTO shop and our product manager shops to ensure that it’s being baked in versus layered on,” he said.
ConnectWise’s Work with CISA + the JCDC
If you didn’t already know, Beggs was one of the founding members of the Cyber Security Communications Agency, which is now CISA. AKA, he really knows what he’s talking about here.
Since helping with its launch over 15 years ago, Beggs has kept up those relationships – so much so that ConnectWise was formally invited to join CISA’s Joint Cyber Defense Collaborative (JCDC) in early 2023.
Through that partnership, ConnectWise has been able to be a part of the development process and best practices for a few products, specifically properly secured RMMs (remote management tools).
Additionally, the JCDC passes Beggs intelligence and indicators that ConnectWise should be monitoring extra closely – sometimes even on a weekly basis.
I’m highlighting this here because despite how tempting it is to shake your fist at the government, there are actually a lot of opportunities for beneficial collaborations on both sides. And if the worst comes to pass and you need help with a breach, having those communication pathways ready to go never hurts.
The Complete Access Problem
As we all move toward a Zero Trust environment (in theory, of course), I wanted to know how Beggs is approaching a specific Zero Trust roadblock: balancing minimal trust with products that oftentimes want aggressive administration access.
To explain his approach, Beggs started by saying that it’s all about understanding your attack surface.
“It’s the analogy of knowing how many doors and windows you have in your house, right? And you don’t need them all open at the same time, right? It can be very complicated because the nature of those products is to have a lot of access. But it doesn’t mean they have to have every window and door open to the house,” he said.
So, he sees it more as a people process versus a technology problem. It’s about understanding your environments, finding the path to your crown jewels, and putting up just enough roadblocks to still maintain operational efficiency.
The Pass Key Problem
Along these lines, I also asked Beggs what he’s thinking about pass keys as we move toward a password-less future (listeners know I recommend asking new vendors this).
Once again, Beggs sees this as a people, process, and educational challenge as we alter something folks have become used to.
Additionally…
“I’m not going to pontificate on should it be, but I would say you’re going to see more on the leaning towards that really is that zero trust, trusted device approach to identity and access management,” he said.
Google and Microsoft have been leaning into this lately as well, so I asked Beggs how much MSPs and IT services companies should be rotating toward this vision of the future.
Once again, his advice was focused on education:
“Everyone is resistant to chance. So I think step one is showing, showing A, the security of it, but also the flexibility of it, and how it’s just evolution,” he said. “I think it’s going to be a hard charging educational process, so we have to understand what would be the more specific needs of our partner base before we approach it like that.”
The Needs of the Partner Base + Proactive Changes to Explore
I also asked Beggs to share a bit about the partner bases’ key needs from a general security standpoint these days.
His answer shouldn’t surprise you: vulnerability management. He threw out some questions to ask yourself, including:
What are entitlements that your third party apps have?
What are the defaults that they’re enabled when you connect with them from an API standpoint?
Are you actually peeling the layer back and understanding what the default access to those apps are?
That’s where many of the bigger breaches have had their launch points, so he highly recommends learning more about your own ‘attack surface.’
Of course, that’s easier said than done. On top of internally testing employees and pushing out security awareness training, Beggs also recommends this:
“If you see a breach that happened somewhere in the news, take a look at what happened, get as much information as you can from it, and understand your weak points in relation to that.”
Beggs is full of timely advice, and this is only scratching the surface. Click here for the full conversation, where we also talk about managing mental health as a cybersecurity leader and how to grade your own security efforts.
That’s it for this week’s newsletter! As always, I’m available to connect, so feel free to reach out with stories, insight, and musings of your own.
More from MSP Radio
Missed Things?
How about our latest videos to catch you up?
The Daily Podcast available as videos
Customer Experience and the Importance of Engagement with Gerwai Todd
The Future of Distribution: Predictions and Perspectives from Industry Leaders
Exploring Autonomous Project Monitoring and Management with Mike Psenka
Streamlining Business Operations through AI Automation with Uzair Ahmed
Insights into Product Management and Revenue Growth with Jessica Nelson Kohel
Want the Daily News?
All the stories from the daily Business of Tech Podcast are available in the daily digest, and stories are available to everyone for the first five days, and Patreon supporters forever. Catch the audio of the show anytime on Apple Podcasts, Spotify, YouTube, or wherever you find podcasts. Links at businessof.tech
Copyright © 2024 MSP Radio, All rights reserved.
Want to change how you receive these emails?
You can update your preferences or unsubscribe from this list.