Breach, Americas, Content, Content

US Secret Service: Hackers Increasingly Target MSPs

Tip Sheet:
Tip Sheet: How to stop a ransomware attack against your MSP business

Hackers are increasingly targeting MSP solutions and using them to attack service providers' customers, according to a U.S. Secret Service security alert issued June 12. Threat actors are using hacked MSPs to launch cyberattacks against service provider customers' point-of-sale (POS) systems and perform business email compromise (BEC) and ransomware attacks.

Since a typical MSP may support dozens or hundreds of customers, cybercriminals are attacking service providers in the hopes of infecting multiple companies via a single vector, the Secret Service noted. If an MSP is compromised, cybercriminals can then use the service provider's applications to attack its customers' networks.

Recent ransomware attack victims in and around the MSP and IT outsourcing market include:

Best Practices for MSPs to Guard Against Cyberattacks

The Secret Service offers the following recommendations to help MSPs protect themselves against cyberattacks:

  • Establish a well-defined service-level agreement.
  • Keep remote administration tools up to date.
  • Enforce least-privilege policies for access to resources.
  • Create security controls that comply with data security regulations.
  • Conduct annual data audits.
  • Assess local, state and federal data compliance mandates.
  • Offer cybersecurity training to employees and update it regularly.

Along with the aforementioned best practices, multi-factor authentication (MFA) may help MSPs guard against cyberattacks, Lane Roush, VP of Presales Engineering at security operations center-as-a-service provider (SOCaaS) Arctic Wolf, told MSSP Alert. Roush indicated that MSPs also can conduct user access reviews of their systems and vulnerability management to improve their security posture.

How MSPs Can Mitigate Ransomware Attack Risks: To further safeguard your MSP business and clientele from ransomware attacks, follow this tip sheet.

Dan Kobialka

Dan Kobialka is senior contributing editor, MSSP Alert and ChannelE2E. He covers IT security, IT service provider business strategies and partner programs. Dan holds a M.A. in Print and Multimedia Journalism from Emerson College and a B.A. in English from Bridgewater State University. In his free time, Dan enjoys jogging, traveling, playing sports, touring breweries and watching football.