Many small and mid-sized companies don’t have an in-house IT team. They hire a managed service provider, or MSP, to look after their computers, networks, backups, and security. It is a sensible arrangement. It is also one that attackers have noticed. When one managed service provider serves hundreds of clients, breaking into the provider can be a shortcut into all of them.
What a managed service provider actually does
An MSP is an outside company that runs part of another business’s technology on an ongoing basis. Typical services include monitoring servers, installing updates, managing user accounts, handling backups, providing help desk support, and responding to security alerts.
Imagine a dental office, a small law firm, and a local charity all using the same provider. None has a security specialist on staff, so each trusts the provider to handle patches and backups. That trust is reasonable, but it concentrates risk in one place.
To do that, the provider needs deep access. It uses tools that can connect remotely to client computers, push software, change settings, and read system data. Those tools are efficient for the provider and very attractive to a criminal.
The multiplier effect
Attacking one small company yields one small company. Attacking a managed service provider that looks after a hundred small companies yields access to a hundred. That is the multiplier effect, and it is the core reason service providers draw so much attention. A single stolen password for a provider’s management console can matter more than a dozen stolen passwords at individual clients.
It is a type of supply chain attack, in which the intruder goes through a trusted supplier instead of attacking the final target directly. The same logic applies to software vendors whose updates are installed by thousands of customers. In each case, trust becomes the weak spot.
Common ways providers are compromised
- Stolen credentials. Passwords obtained through phishing or earlier breaches, used to log in to management consoles.
- Unpatched software. Remote management tools exposed to the internet with known flaws that haven’t been fixed.
- Weak authentication. Accounts without multi-factor authentication.
- Overly broad access. One administrator account that can reach every client.
- Compromised tools. Flaws in the software the provider relies on, meaning the provider can be breached through no fault of its own.
What attackers do once inside
The goals differ. Some groups deploy ransomware across many client networks at once, hoping to collect many payments. Others quietly collect information over a long period, which is known as espionage. Stolen data can include contracts, customer lists, financial records, and credentials that open more doors.
The quiet cases are particularly hard to catch. Because the provider’s tools are expected to access systems, malicious activity can look like routine maintenance.
If you are a customer of a managed service provider
You can’t control your provider’s security, but you can ask good questions and limit what you hand over.
- Ask about their security practices. Do they use multi-factor authentication everywhere? How do they manage and patch their own tools?
- Limit access. Give the provider only the permissions required for the services you buy, and review them regularly.
- Keep your own backups. Store at least one copy that the provider’s credentials cannot delete or modify.
- Log and monitor. Make sure someone is watching activity from the provider’s accounts, ideally independently.
- Plan for an incident. Agree in the contract how breaches will be reported and how quickly.
- Know your exit. Maintain a record of your systems and who owns each password so you could move to another provider.
Put these expectations in writing. A contract that says nothing about security leaves you arguing about responsibility after something has already gone wrong with your managed service provider.
If you run a managed service provider
The responsibility is larger. Providers should treat their own environment as the most sensitive one they manage. That means separating administrator accounts, requiring strong authentication, segmenting client networks so a single credential doesn’t reach everyone, keeping detailed logs, and patching management tools quickly. It also means preparing for the day something goes wrong, with clear communication plans for clients.
Many providers are small businesses themselves, with limited security budgets, which is part of why they are attractive.
Signs worth watching for
- Unexpected software installed across multiple machines
- Remote sessions at odd hours
- New administrator accounts you didn’t request
- Backups that fail or disappear
- Security tools switched off
None of these proves a breach, but each deserves a quick question to your provider.
Trust, but check
Outsourcing IT is still a good choice for many organizations. A skilled managed service provider is often safer than a lone staff member who tries to do everything. The lesson isn’t to avoid providers. It is to treat them as a part of your security perimeter and manage that relationship accordingly.
Ask your provider once a year for a short, plain summary of what access they hold and what changed. Good providers will be glad to share it.
The rule of thumb is simple: anyone with the keys to your systems should be held to the same standards you apply to yourself, and you should be able to see what they do with those keys.
For a neutral background reference, the Wikipedia article on Managed services is a useful place to start.
Related reading: Why Do Some Crypto Hackers Give the Money Back? and Why You Get So Many Spam Texts and How to Make Them Stop.
