EP165 - Are You Already An MSSP?
Building Your Own SOC
with Mark Taylor and Ian Luckett

INTRO

In this episode of the IT Experts Podcast, we talk with Mark Taylor from Chrous, about why you need to start delivering managed security services.

Welcome to the IT Experts Podcast, the only podcast to help MSP's scale to 1,000,000 in if already there get to 5 and go fast at the end of the day. Isn't it all about building a business that works for you rather than you for it? I hope you enjoy the show.

IAN

So good morning, good afternoon, good evening welcome to the IT Experts Podcast I'm totally out of my comfort zone today we're going to talk a little bit techy and we're going to be talking with Mark Taylor from Chorus around managed security services really working out how to protect your MSP, what you need to do, what the guys at Chorus amazing things that the guys at chorus are doing and you know it's always a prevalent subject security. It's always really important as we know, so welcome to the show Mark, how are you doing this afternoon?

MARK

Ah, good, Ian nice nice to be talking to you and yeah as you say seems to have been a hot pop hot button topic for a couple of years now doesn't it. So yeah, yeah.

IAN

I think it always is, isn't it. I think there's always something that pops up and we were talking about a recent breach attack. Whatever you want to call it, in the last couple of days at the Growth Hub and the thing that was really scary about it and we know that MSPs are you Know, hot targets for the bad guys, is just the simplest little thing leaving the back door open the cat flat open and the little buggers have got in and before you know it, you're in disaster recovery mode and in and it and in a right old mess aren't you. So before we get cracking Mark just explain to everybody, why are we talking today, who are you, what do you do, and who'd you help.

MARK

Ah, yeah, sure. So in terms of my role for me personally I'm the CTO of course I'm actually one of the founders. So usually just means I'm the oldest one around here in here. So yeah, we're startlers, a traditional MSP been going about 24 years and yeah, these days is kind of we've got a bit of scale to us and we've got three streams so we've got the traditional managed services. We've got dynamics practice. So we're very much a Microsoft focused house 100% Microsoft and then our newest practice which has been going for about 5 years now which is the security web which where...

IAN

Okay, cool which is I much talking met like yeah, excellent stuff and from a security point of view for MSPs, what's your view on the, kind of what's happened in the last 18 months and where's the focus need to be, you know a real high super sixty thousand foot level for MSPs right now.

MARK

Yeah, it's actually you, obviously you mentioned that attack recently right? I mean I think the thing is you highlighted there quite correctly that it's the simplest things right? The simplest things will always trick people up and I think that historically maybe you know a few years back people vote about security as some kind of like you know bolt down the gates make sure the walls are good. Let's really see ourselves in and you know we're obviously well and truly past those days now, you do have to accept that No matter how high you set the bar for yourself, there will always be some way in and actually what MSPs need to think about for themselves if their customers is that okay, they're probably going to get in what am I going to do to see them when they do come in. That's the ideal thing you want to catch them as quickly as possible when they do come in and you know how am I going to protect myself as far as possible. Both from an individual technical point of view but also from ah just a resilience point of view. What am I going to do, to make sure that if that bad thing does happen I've got myself a backup option over here. So It's nothing magical, you know, let's be really clear I know a lot of people want to sell it as as voodoo source but it's not you know you just got to do the basics and do the basics well... we're lucky to also live in a time where there's lots of options right? You know we're not in a world where it's you know you've got a B or C you've got a through pretty much so there's a size and an approach that will fit everybody. You got to find the one that where it's best for you and then just really make sure you do it well.

IAN

And I think you know what think you hit the nail on the head there you know, I think correct me if I'm wrong, you may not know this, it's been around since King Herod hasn't it. You know because I don't think he was a great guy. And you know it doesn't really change does it I've got something you've got something that I want I'm going to nick it off you and we're not going to have a contract or exchange. So whether that's shoplifting in the 80s or whatever it might be um, you know that's the kind of the thing and I think now you know or back then it was going to lock the doors. But I think as you say now. No, you've got A to it you've got this combination lock that's massive digital. You can't even see half of it and you know when we were doing a session a particular session yesterday as I say with our clients you could see the light bulbs going on. And the thing that came to light for me and I've you know mentioned this many times I'm not technical is where the hell do I start with this do I need to do I need it, do I need what the hell do I do and you know we kind of got talking around a framework so whether you're using Nist or whether you're using any of the other frameworks is that a good place to start. Analyze yourself on that we got talking about insurances. You'll put professional indemnity insurance negligence. Oh my god well you can imagine we went for nearly two hours on this subject.

You know in your view and you know as a CTO and obviously protecting your business as well as you can and where should people start if they going I'm hearing this I'm hearing that I should be using that I guess I need to use too if I oh I need to do this I need to do that. But I'm not quite sure because it literally is it's that just that one little update that patch might not be done where what's your kind of you know.

MARK

Yeah, yeah, I mean if you read the studies and obviously, I've already said we happen to be a Microsoft focused organization and they release each year and a thing called the MDDR the Microsoft Digital defense report which is always interesting reading to be honest, one of the things that pulls out and it's been fairly consistent for a few years now is that it's still possible if you do the basic security hygiene stuff and let's face it for the vast majority of organizations and people that means properly implemented MFA if you do that properly and you do that? Well, and I emphasize that word properly then you know what 98% of your risk is already starting to be mitigated right now. Unfortunately, the 2% that's left is still a pretty big chunk I know, it doesn't sound like much but it's still a pretty big chunk and you do have to think about these things.

The other reference I always give to people is that you know we've got that historical world of security again, going back for years where your endpoints you know, you're all about the antivirus on the endpoint whoever that happened to be. We know what the big names the MCAFY’s the sohos the world right? And you thought about endpoint and antivirus anti-malware. And you still need to think about that a little bit however, really today's world you need to be thinking about what the rest of the world now calls endpoint detection and response or managed text and response and really the really easy way to think about that and what I always say to people when I'm talking to them is that look if you think about the way we all work today. You know you've got maybe a handful of servers. We live in a Cloud world these days so less and less servers perhaps but you know you've got a handful of servers in your business. You've got a whole load of endpoints laptops, Ipads, Iphones whatever happens to be and where do your staff spend their time working day and day outright and it's on the endpoint. So, in terms of the risk where the risk exposure is, it's the endpoint because all day every day those users are receiving those emails from customers partners, the nefarious third parties. They're clicking on the websites they're doing the drivebys on the adverts from the from the websites that are even legitimate websites.

MARK

And so just by the sheer mathematics that the amount of time spent doing work on an endpoint you need to think about your endpoints. So for me, yeah, encouraging customers and partners to move on from a traditional anti- malware approach back in the day to a modern, and managed detection response or endpoint detection response. You can call it what you like sort of a modern threat-based approach on your endpoints that is absolutely the place I would encourage everybody to start because that's where you're going to get highest value.

IAN

Okay, okay, so we talk about, MSP, we know what an MSP is, and we're talking about our customers looking for managed security. They certainly want you to look after their IT and make sure everything's all hunky door and stuff like but now they want to. They now want you to start managing security does that mean everyone's got to turn into an MSSP and what is an MSSP anyway.

MARK

Yeah I think so you know obviously we've had a few years now of the MSSP in existence and you know, but everybody's inserted that security word into the into the description and I think when it first appeared it was a way for. Ah, certain organizations to differentiate themselves in terms of what they delivered and it still is today a little bit but truthfully actually I also say to the partners we were with today. Yeah, you're all MSSPs, right, because nobody is not doing security right? Even if you're not delivering the kind of security we might talk about in a little more detail. You know the kind of full-blown 24/7 security operations center security. Even if you're not doing that you are going to be talking to your customers about two, you're going to be talking to your customers about things like conditional access and tying down their machines and doing the basic security in hygiene you're going to be doing that and in my opinion that makes all of us an MSSP, we are all having those security conversations. So everybody's one today really I think it's just different varying degrees, and some specialize a little more than others. That's all.

IAN

I'm glad you said that because I'm listening to all this stuff going on and I'm going well I got a minute, don't we if we just add that to that doesn't that mean that adds. Talk to me about your journey because you guys have built your own CSOChaven't you?

IAN

So why does, why do MSPs need it. Why do businesses need it. What was what was your kind of driver behind your your investment in this.

MARK

Yeah, so um, so I start with the easy stuff right? So SOCC and CSOC interchangeable terms again in my opinion. So it's just Security Operations Center or Cyber Security Operations Center um, and really again, you know I think obviously most MSP would be familiar with NOC so network operation center that that concept of a 24/7 teams sort of monitoring things in terms of infrastructure. It's exactly the same principle for but for security and they're monitoring via you know various bits of tooling for things that just don't look right in a security context. It's obviously changed over the years and our modern SOCC works a little bit differently to perhaps the way they did five ten years ago as you would expect but that's fundamentally what a sock does is just sit there 24/7 and monitor security for you and take actions. The reason we ended up there is because we'd obviously we'd had our historical MSP practice. We had those customers and what we basically saw with a handful of those larger customers a few years ago is that they were exposed to some of those you know, sort of more well-known attacks back a few years ago and we looked at it and we were just thinking, got to be something better. We can do about this and that was kind of what really triggered it for us right? So we started looking it just happens that was again because we're a very Microsoft focused house sort of 28 late 2018 twenty nineteen was when Microsoft launched their sentinel product which is their Cloud product seem product for the cloud and we just timing kind of all fell into place and we went. Yeah, that was the right time. Let's figure out how we can use this for our customers and deliver a service really so that's where we started and yeah, we but decided ourselves certainly not what. What every MSP does obviously MSSP does but we decided to build 1 out for ourselves.

IAN

Cool so you've got in and this is where I'm at the point of either making myself look relatively intelligent or completely stupid. You've got your help desk looking after the network finding out what's going on with there, you've got your knock that's making sure that kind of everything's up and running and then you've got a third one which is the sock where we're looking at. It's kind of what you said at the top of the hour we're just checking the CCTV cameras to find out the bad guys. As and when they're coming in so you got these 3 elements so most did I get that right for that you mean.

MARK

Yeah, you did you? Absolutely not watching CCTV but I get the principle and in fact I just as a point of flat. That's one of the reasons people sometimes pull out the difference between a sock and a seas sock so that sock sometimes for a large organization sort of broader remit and they might actually look at CCTV.

MARK

Whereas a CSOC is very much obviously just the digital version.

IAN

When I'm, when I'm at CCTV I meant the metaphorically speaking watching the bad guys come and breaking in the back door for but CCTV as well. Yeah, if you've if you got any you need anyone to come and help on you help us just give us a shout another. I'll be sure to help you. So if we take those 3 areas, you know we've kind of got your help desk, you've got all your automation then we've got the the sock and then the NOS sitting there as well. Where most MSPs are sitting there are they just relying on the on the kind of the help desk and then any flags that come up as and when stuff happens with their security products whereas you're actively looking for things before they get detected is that the difference?

MARK

Yes, and no, so you know, yes the you know we certainly, there are plenty of MSPs out there today working in that fashion where they've got some security tool in security tooling detects something whatever it happens to be. And it raises as an alert into the to sort of standard I t team and they triage it they look at it. They decide to take some action and they might do something and obviously all that happens over a course of time our version of it sort of the modern sock version is if we are still detecting the... you know the word we tend to use is anomalous. We're detecting the activity that doesn't look right. So we're detecting that that unusual activity that might be a login that doesn't write. It might be a file that's executing that doesn't look right. It could be a whole range of things. But we're detecting that thing that doesn't right when we detect that thing that doesn't write the difference with the sock operation is it works fast and it takes definitive action. So from the moment that thing is detected that doesn't look right currently as we operate today our meantime to get to that they can start looking at it in detail.

It’s about 4 minutes our meantime to take definitive action and contain a threat and that's what we talk about today is containing threats is about 11 minutes so from the minute it's happened 11 minutes later if we've detected something that definitely looks at a place. We've pushed a button and we've contained that threat. And we've locked a locked a wall around it so that it can't get anywhere else on your network, basically.

IAN

Cool. So with the sock operation which obviously you've got great, great opportunity for a pitch there but with the sock operation that you've got um is it does that protect the whole MSP or do you just have that for certain clients or how does that kind of work.

MARK

Very much. You know it's ah it's an optional thing so um, for us, it's you know we obviously when we started we built it up right today I would say well in excess of 95% of our MSP customers are also sock customers and we operate very much as, you know we treat the sock treats the NOC as a client. So 95% of our MSP customers are using the sock. So yeah, it's just a choice. It's a choice for everyone. You know, obviously everybody's looking for different levels of sophistication different levels of security. And you know everybody makes their own individual choice about what level they think is suitable for them.

IAN

Okay, now, that good I get and I guess that depends on the risk profile of their end customers on what's going to be excuse me on. Um, what we've firm what they've got kind of coming in in terms of a different risk from you know whether it be someone sitting out there on...

Or if it's someone who's in a professional services business with high levels of multi-users and all of that kind of stuff. Okay, okay, so do you find when we look at the MSP and then we look at the end user the end users very much are just kind of like saying just keep us safe and secure and everything like and then it's the MSP who's going right? I need to use all these various new you know techniques because we talked we were talking early on. We were preparing for the show just around you know MDR the managed detection and response and MXDR, what is MDR and MXDR and why are they different and where does the application of that sit with different MSPs or clients.

MARK

Yeah, yeah, so, it's you know obviously they're all broadly the same thing they just have sub variations in between them. We talked a little bit earlier about that endpoint risk profile and how you know MDR managed detection and responses where I Certainly recommend most businesses start in terms of getting those endpoints protected. So what then tends to happen is that you know businesses as naturally happens with anything and it they mature and they get comfortable with that initial service and they're kind of like okay this is working well but I can see that now there are other areas that I could improve the security on across my estate and so the way the MXDR. So the X is inserted there for extended kind of an industry term so managed Extended Detection Response and again the way we describe it to partners and customers is quite simply that you're expanding the scope of things that you're looking at, so we've obviously talked about the fact that.

For the MDR, we just look at laptops. Let's say laptops and endpoints or servers and laptops with MXDR. We start to look at things like we start to look at sign-in logs on domain controllers. We start to look at cloud sign-ins we start to look at. Ah, email traffic and then a lot more detail than we do on the MDR service. So what we start do is we're pulling in more and more pieces and obviously the more data sources you have the more you can see and that gives you that sometimes slightly quicker sometimes slightly more detailed option to catch a threat sooner.

And if you just wait until it hits the end point. So it's just about doing looking at a little bit more. You're just broadening out your view and looking at more information really as you go up the service to an nemxdr.

IAN

Okay, so and can that application and you know and that that function there can that be provided by standard MSP practices or do you need a ah specific sock that's built or sees sock that's built to deliver that is that a function that can sit outside.

MARK

Yeah I mean my experience is that that everybody as is always the case has got every flavor right? So there are MSSPs I've worked with who you know, kind of take a up set security tooling, they let it do it.

MDR thing and they pick up the alerts and they handle it themselves I've seen I've seen ones where they get to a certain point and they realize perhaps actually we need this 24/7 so do we build out ourselves and some I've seen build it themselves some want to then outsource it at that point, you know to be honest with you there's every kind of flavor but imaginable.

So it's again, it's back to that individual MSPs. Okay, what, where, are our strengths where our scope. What scope have we got to make that expansion right, because obviously one of the things you do get to pretty quickly with security is it. 24/7 is really the only viable approach to be honest, because we all know those threats aren't going to stop at 6PM right so um that's probably I would say one of the key challenges MSP’s face is what am I going to do with the out of hours you know because my clients are going to be working out of hours.

IAN

Okay, yeah, yeah, threats don't stop at six o'clock do they?

MARK

Threats are still going to be there out of ours. No no, no and so that's usually in my experience the point where even MSS MSP that decide to stick their toe in the water a bit and try and do some of that stuff go okay, how do we move it to the next level and that's where you know. You start to make your big choices about left or right.

IAN

And that's and that's with a and that's as you you're kind of talking about with the with the CSOC and the sock and that's ah I'm guessing that that's a ah department of people who are just out there looking at the you know they're looking at stuff got loads of automations just pretty much like a help desk but they're doing that kind of on your behalf.

MARK

Yeah, yeah, exactly and and you know and again like I said we live in a world where there's lots of choice right? So there are some truly global players out there that everybody will know the names of you know the crown strikes of the world, dark traces and they're effectively offering that kind of service I would argue. It's a little bit different but you know nonetheless broadly it's similar and then you know you've got all options all the way down to the to the very SN of the SNB market where again you can just go and outsource for you know what is quite frankly, a very reasonable cost, a monitoring service. 24/7 for your customers endpoints and like I said it's great. We live in a world with lots of good choices and good options.

IAN

So with those options. Why do you think that, why companies moving more to like the Microsoft for the security side of things and the XDR element?

MARK

Yeah I think I think you know we are definitely seeing a bit of that no doubt about that and I think there's probably a couple of reasons. I think that you know one of the reasons is that you know we've obviously had years now of businesses moving to Microsoft Productivity suite so they've gone the office 365 to Microsoft 365 route and in the Microsoft 365 space customers have either got or started to move towards things like Microsoft 365 business premium as a particular line item because it offers quite a lot of value at a certain price point and you know Microsoft have chosen to include there. EDR product in that license. So suddenly what you've got is a lot of customers who have got licenses and they're looking at their estate and they're going hang on a minute I've got this Microsoft security product defender for endpoint in my license. It's supposed to be pretty good. But I pay for I don't know whatever it is. You know some other third party solution and I think that's one of the drivers I think the other drivers to be honest with you is that you know again, we live in a world where I think everybody appreciates that to do cyber security. Well the one thing you need to have is lots and lots and lots of data. You need to have as much data as possible because you're using that data to then look for what looks normal and what doesn't look normal and obviously Microsoft by definition I think the most recent stat I've seen is they're currently processing 72000000000000 signals per day in their cloud.

And I think we all know that any provider would struggle to have the volume of data available to them that Microsoft do so I think between the sort of you know huge volumes of data which makes doing a security job easier versus the licensing inclusion, What we're just seeing is customers just coming to their to their MSP and they're saying you know I'd like to take a look at the Microsoft option. Please you know so that's I think that's what's driving some of it.

IAN

Mark, so it would be remiss of me not to mention the two letter acronym that is on everybody's lips at the moment. AI, you know, data, we talked a lot, you know everyone talks about, it's going to change the world. It's going to do this. It makes everything easier, but also a lot of people talking about it and the guys from uptime solution Jason and Bradley were saying they built their own machine learning things. They want to control the data. I don't want to have anybody's, you know, open source data in there. We're hearing every week I use this now it detects and whether clients unhappy or not. I've got this. This is great but for me. It's like opening up all those little cat flaps again and opening up all of these things so you know how, what's your kind of view on how AI is going to change the security landscape, particularly for MSPs?

MARK

Yeah, definitely. I think, yeah, I think we all know we're a bit of a turning point with it, that's for sure. So we've got an interesting few years ahead of us, which is great. You know, I think I think in you know every space is going to be touched. By it, as you said, and security for sure. You know, security is actually one of those areas where they've been heavily investing for a few. Years, to be fair. Because everybody wants to do that machine learning and find those normally faster. So I think it's a great space to be using AI in. We're actually. So obviously we've already talked about the fact we're Microsoft Focus, so Microsoft have their what they. Call their security. Pilot, which is their AI for security. And we're actually, we're a preview partner. For that, so we have access to it. So we're live using AI today to do some of our security stuff and you know it. And it's what you'd expect probably. Which is, you know, it's about. Bringing information to people. Faster bringing it to them more effectively and obviously, when analysts are doing work, that's really a lot of what they're doing, right? It's crazy information, making decisions and pushing buttons. So AI is inevitably going to speed that up and improve that. So I think there's definitely I think really we're only scratching the surface there. I think it actually over time it will. It will get better and better. I still think that personally, you know again certainly what I've seen there we're off. It's not about replacing people at all. It is it is about supporting people. It's about enhancing what they can do, doing more doing it faster. It's not about replacing people in my experience. So we will see how that pays out you know one of the things for sure is that things are changing so fast I wouldn't even want to guess what's going to be here in 12 months time or in 12 days in time.

IAN

In 12 days, indeed, be nearly Christmas, wasn't it at that time by the time of recording, yeah. Mark, thank you ever so much for your time this afternoon in putting the show together and structuring it to give it, you know, to give that value for, for all the MSPs listening to today really serious issue. I don't think this is going to be the last conversation you and I are going to have on this. I think there be going to be many more so, we'll probably be Wheeling you in as and when things change and develop. But in the meantime, do you want to just explain to everybody kind of what it is? You know what you've got, how they can get in contact with you if they want to continue the conversation and we can put all the links in the show.

MARK

Yeah, sure, sure. So, yeah, I can be found all the user usual places as they say to be honest. So obviously hang out on LinkedIn, LinkedIn and I always used to call it X. But let's say the twitters of the world so you know can find, we find it all the usual spaces and yeah happy to chat our experiences of security building security practice, you know, like I said, I've talked to MSPs doing every flavour of it. Obviously, our particular flavour of it is very much about supporting other MSPs these days, so that that puts us in a good place to have those conversations with MSPs you're trying to make decisions about what they do next. So yeah, always happy to chat.

MARK

So LinkedIn, Twitter. Yeah, all of those kind of places. Mark Taylor.

MARK

Yeah, it.

IAN

Brilliant stuff. OK, well, thanks ever so much. Good luck with everything you've got going on. Sounds like you guys. Have got a lot. Going on, so keep safe. Happy and yeah, I'll look forward to catching up. With you soon. Cheers, Mark.

OUTRO

So I hope you enjoyed the show if you did, I'd love it if you could leave a rating and review on your favorite podcast platform. If you want to know more about how to take your MSP to a million or if you're already there go faster. Then come and join Stuart Warwick and myself in the scale with confidence Facebook group the link is in the show notes. You go enjoy the rest of your day and I look forward to connecting with you soon.