We are creating our MSSP security stack for the SMB market. We want a decent and affordable stack for the SMB market but not overkill. So far, we are leaning towards the following:
Please feel free to share any other solutions we should be looking at.
Posted May 19, 2021, 8:08 PM UTC
I'd say those should be part of the normal stack. There's nothing above what we'd consider the basics. Also which sophos? I think there's still standard, then standard with intercept X, then MDR and MTR and...
*EDR and MTR
I would probably use EDR+MTR over Huntress if your team is small
To OP Sophos also have a cloud email advanced product on their MSP Flex pricing.
EDR and MTR and PDR* and DDR* (3, 4 and 5 but 3 is EOL next month), and SSR.
*Denotes it will one day work on mac, we promise. Also won't work on old OS's. Or new ones.
MSSP is much more about the people, process, and paperwork; though the tech stack plays a part. What framework(s) are you using? What requirements do your clients have for certification/audits? Are you looking to resell managed solutions (Huntress as you mentioned is an MDR, not an EDR). Do you have people with the skills to respond to incidents?
So very much this. MSP channel sales would like you to believe that you can just pack on the tools and be secure. True INFOSEC is so much more. You first need to stop looking at it from an IT standpoint. Maybe hire someone with security experience and let them help build your functions and processes and then find the software that meets your needs.
Meant to reply to this earlier. But absolutely this.
Security is just as much about process and training as it is software, hardware, and configs if not more.
I don't consider huntress an MDR since it still requires the MSP to perform some action to actually stop the threat.
Friends don't let friends buy Sophos...
What's wrong with Sophos?
Nothing, friends dont let friends buy Webroot, Sophos Intercept X with EDR combined with a Sophos firewall is one of the best EDR/XDR systems going
Lots of bad experiences with Sophos. Everything from loads of false positives to all out operating system destruction.
This was 8-10 years ago, but I’m not inclined to give them another chance at the prices that they charge.
Long time ago, product and market has changed, most AV vendors have had plenty of false positives over the years including OS breakers, sophos were actually very good when they screwed up with that one
I’m also not defending them, just curious. We switched to S1 for endpoint but still use Sophos XGs for firewalls. Never had any serious issue with their endpoint though.
Do you have any backup/disaster recovery in your current stacks? It's tablestakes for MSPs focused on security and data protection.
What are you using for log collection, monitoring, analyzing?
OP you need to look into SIEM and managed SIEM.
People seem to love or hate Crowdstrike, and I'm not sure why it is so polarised.
Crowdstrikes full suite from my understanding is pretty good. Just extremely pricey.
its ok on windows. they;re massively lacking on linux
How do you feel about them vs other products on the market?
I think you can get better products for the money, especially on Linux. Trend Micro, Palo Alto, Sentinel One are all solid. PA benefits a lot if you're running their firewalls too. Sentinel One has the best detection engine, Trend is right behind them and has tons of security controls, which can make it more complex to manage if your team is small or junior.
If it's an all windows environment, I see no reason to use anything but windows defender for AV/AM.
This should be the typical stack for any MSP.
Affordable? Loaded term, what does affordable mean to the client? Lowest price possible, or reduces their risks to an acceptable (to the business) level? Cheap that doesn't work isn't cheap, it's really f'ing expensive.
I'm not beating you up, just want to make sure that you understand what you are proposing before you try and sell this. Obligatory - have an attorney write your MSA/SOW and make sure you aren't promising something you can't deliver on - to include what your marketing messages might infer. Also, get cyber insurance w/ 1st and 3rd party coverage adequate to your risk exposure before embarking on this
I would call what you posted something that you should already be including as a base, or foundational level of protection. This really does little to address detect and respond, let alone recover (I assume you've got a solution to fill that gap.)
Don't forget, as we help our client mature their risk management and risk reductions for cyber threats, this increased people time involved.
Set guardrails for clients who avail themselves of your services - outline client responsibilities, require BCP/DR services and a plan, they have cyber insurance, follow best practices, MFA on M365, etc.
Look at the NIST CSF. Protection is technology heavy and cheap, relatively speaking - aka, throw a box at it and do some sane best practices. Detection and Response require people, as does a good risk management program - these are largely not "your" people" rather third parties and the clients own staff. You'll have to guide their efforts through application of frameworks, helping them craft policies, helping them through assessments and whatnot to achieve their goal of reducing their risks.
Sophos works great in a PC world. If you need to get that on Macbooks... It's terrible. Still no real support on the new OS, let alone new processor.
I concur with a lot of the other sentiments here that you should be more focused on tightening up on what your do as an MSP first before exploring MSSP. The three items you have listed are 'basics' of standard MSP services in the current market.
When I talk with MSPs who have big ambitions but are lacking on resources/skills/direction on moving into an MSSP model it's worth starting out by looking at a Security Framework (CIS Controls v8 was just released and is a great framework to start with) and just work through the list of controls and safeguards in the framework and decide 1) would you like to implement this control, 2) what are you going to use to implement this control, 3) what margin are you willing to make on this control. By the time you do this you'll have added a metric shit-ton of new services to your managed services portfolio but you'll still not be anywhere near being an MSSP.
Here's a good self-check. If you aren't already doing simple things like disabling and monitoring the status of TLS 1.0 and TLS 1.1 on your servers and endpoints then you need to take a deep breath and center yourself because there's a whole world of 'security best practices' you haven't even begun to touch.
As others have mentioned already, AV, EDR/MDR and antispam are part of an MSP standard stack.
As always, vendors marketing tries to convince you that you can just resell their stuff to be an MSSP. But actually becoming an MSSP requires dedicated cybersecurity personel, maybe pentesters in red and blue teams, maybe even a SOC, and most importantly a lot of organization and processes to allow you to deliver some valuable audits and protection.
I’m struggling to get my customers to understand that the basic Protection in o365 is not enough. What’s your selling points?
By the was, Mimecast is in our default stack.
We sell Avanan in house.
One of my easiest ways to sell it to them, is almost EVERY business has experienced an email hack. Not sure of Mimecasts abilities but we get our foot in the door with Account Takeover Protection many times. E.g If you login over in California and 5 minutes later login from Texas or Idaho. It will block that login and notify the admin (us).
Same with Click-Time Protection. Explaining to them that Avanan will screen or block links before a user can click on them.
For higher tier stuff we sell on DLP alot. DLP is huge in email from a compliance standpoint.
Not actually sure that a lot have experienced that, and that’s why customers can’t relate to It.
Never heard of avanan, and those Abilities. That sounds brilliant.
Mimecast is mail Protection / link scanning/ and so On. Best in its class.
I'd never heard of Avanan either. But I've liked them this far. Little pricey but I liked them more than proof point and web titan. Haven't messed with Mimecast. Couldn't get them to even email me back when I had money to give them 🤷♂️
Avanan works through API mostly though and I've loved a lot of what it can do. Especially active DLP and Malware scanning in SharePoint, OneDrive, etc.
Account takeover is fantastic also 👌
As far as customer experience with emails being hacked, maybe it's just a geolocation thing. Our area its happened so much it's insane (small area too). Cleaned up many businesses from cyber breaches that initiated with email.
[deleted]
av - bit def with edr or fully sentinel
email - bit def email filtering
Feel free to DM if you want a free trial of TitanHQ - thanks for the mention too. WebTitan MSP Cloud has over 3,000 MSP's globally using webtitan daily. Happy to send more info if you need on SpamTitan too.
Been with TitanHQ for two years for both email and dns - fantastic business and haven't had a single issue - pricing very good.
Huntress are my favourite vendor in cyber - msp giants now .
I'm actually looking at an AV change myself so thanks for this post
We use knowb4 for awareness training which has actually been a really great little earner for us
MDR - Ironsales
SAT - HacWare
AV - Avanan
security stack is av an mdr and email filter......lol.....
We only implement MQ tool sets.
SIEM - Securonix
XDR - TrendMicro
Log Collector - Snare
Vulnerability Scanning - Tenable
Email Protection - Barracuda
MDM - Sophos
First an MSSP is an entirely different ball game than an MSP.
To start the below bulleted items are items that should be in your standard stack as an MSP among others.
If you're getting into MSSP and Security you need to go much further.
And of course good INTERNAL policies.
There is a TON to unpack when you get into security and getting into it before you're ready and careful can wind you up in a heavy amount of litigation. Step into it slowly with no "guarantees" or hire people already knowledgeable and ready to work in a security environment.
Ultimately (this is completely based off the post, I could absolutely be wrong) you don't sound like you're in a position to be an "MSSP".
You sound like you need to standardize your MSP security stack and raise prices a little to accommodate the increase in costs.
To get started with that I would tackle these first and get solid solutions for them.
These are some of the best bang for your buck options in my opinion. They're usually relatively cheap if you don't already have them (e.g almost all RMM tools have patch management). They're not incredibly difficult to configure from a technical standpoint and will help to decrease your attack surface and protect you and your end users.
Best of luck :) Hope some of this helps!
EDIT: And build inside of a Cyber Security Framework!!!!
Not OP but I found this to be an incredibly helpful answer.
Glad it was helpful!
TIL we qualify as an MSSP.
This is an excellent post, thank you!
I find a good majority of the active people in this group tend to already be on the right track :)
I wish I could say we were 100% on top of all these items ;) but one step at a time as they say!
We got tired of the number of support tickets our VPNs were creating, so we switched to a ZTNA tool. The result is fewer support tickets and no client software to manage. We've also seen massively increased throughput^1 and then a bunch of security benefits (isolating lateral movement and MFA on pretty much everything being the 2 most prominent).
We were using Pulse VPN prior to the switch. While I have no desire to shill for the vendor we chose, I'm making it my mission to get folks to take a look at the ZTNA "area". Very interesting technology IMHO.
^1 For reference, our tool is handling ~5k concurrent connections, whereas Pulse was crapping out when it hit 300.
I can get behind that. I'll give that a look tomorrow! Thanks, I had never heard of that.
Edit: reread your comment lol.
Great post. I would ask the OP to ditch their "tech stack" window shopping and hire someone experienced that has opinions on all these categories. Get to the point where the questions are less open ended and you have questions about PAN vs FTD rather than just 'what firewall'.
Same, extremely helpful, added to favourites for further review tomorrow when I'm in work mode. Thank you, Sir.
No problem! Work/Life separation is important! Hope it's beneficial!
Read a post on sysadmin earlier in the evening with a stark reminder of that separation, thank you, mate.
Thank you for this response mssp
Thanks, appreciate your detailed feedback!
This…. This is a damn good listing I’ve needed for a while now…. Thank you.
Glad to be of assistance!