Why Attackers Target MSPs: 3 Quick Checks for Your Own Shop
If you run an MSP, you are holding the keys to every client you serve. That access is why clients hire us. It is also why attackers target us.
You can watch the short version here:
The video uses a digital avatar of Erick Grau, CEO of Chibitek.
Why Does This Matter?
A joint advisory from CISA, NSA and FBI, along with the cyber agencies of the United Kingdom, Australia, Canada and New Zealand, warns that attackers can use a vulnerable MSP as an initial access vector to multiple victim networks. The same agencies said they expect attackers to step up their targeting of MSPs.
The warning from the joint advisory, as used in the Short. Source: CISA AA22-131A.
Think of it like a locksmith who holds keys to every shop on the street. If those keys are copied, it is not one door that opens. It is many.
That is not only a theory. Since July 2, 2021, attackers used a vulnerability in Kaseya VSA on-premises products to run ransomware against MSPs and their downstream customers, according to CISA.
I walk through three quick checks for your own shop in this Short: Watch the Short on YouTube
What Are the Three Quick Checks?
The three checks from the Short, each traced to the joint CISA advisory.
These three checks come from the joint advisory, not from a marketing list.
1. Put MFA on every account that can reach a client, and treat those accounts as privileged.
The advisory is direct: MSPs should implement multifactor authentication (MFA) on all accounts that have access to customer environments, and should treat those accounts as privileged. If a sign-in can reach a client, it is not a casual login. It is a key.
Check one from the Short: MFA on every client-facing account, treated as privileged.
2. Never reuse admin passwords across clients.
The advisory says, "Do not reuse admin credentials across multiple customers." A long password does not fix this. If one client environment is compromised, a reused password can carry the attacker into the next one.
Check two from the Short: no shared admin passwords across clients.
3. When a technician or a client leaves, shut that access off as soon as they go.
Access should leave with the person, or with the contract. The joint advisory says to identify and disable accounts that are no longer in use, and it warns that disabling MSP accounts can be overlooked when a contract ends. That warning is about MSP accounts in a customer's environment when the work is over, not a deadline CISA set. The "as soon as they go" habit is ours.
Check three from the Short: offboard as soon as they leave, and do not miss MSP accounts when a contract ends.
What Is the Bottom Line?
The hook from the Short: your MSP holds the keys to every client.
One MSP can open many doors. The work that stands up to that fact is not exotic. It is MFA on every client-facing account, no reused admin passwords, and access that leaves when the person or the contract does.
In our own shop at Chibitek, we use MFA, Conditional Access policies decide when and how people can sign in, and staff working from home connect to the office over VPN. That is a baseline, not a boast, and it is not the whole list an MSP should be able to answer for. It is how we start.
If you want the short walkthrough, it is here: Watch the Short on YouTube
Key Points of Why Attackers Target MSPs
If you run an MSP, you hold privileged access to the clients you serve, and that is why attackers target you.
A joint advisory from CISA, NSA, FBI and the cyber agencies of the UK, Australia, Canada and New Zealand warns that attackers can use one vulnerable MSP to reach many customer networks, and that they expect targeting of MSPs to step up.
Since July 2, 2021, attackers used a vulnerability in Kaseya VSA on-premises products to run ransomware against MSPs and their downstream customers, according to CISA.
Check one: MFA on every account that can reach a client, treated as privileged.
Check two: never reuse admin passwords across clients.
Check three: when a technician or a client leaves, shut that access off as soon as they go. CISA warns that disabling MSP accounts can be overlooked when a contract ends.
Frequently Asked Questions
Why do attackers target MSPs? Because one provider can open many doors. The joint advisory says attackers can use a vulnerable MSP as an initial access vector to multiple victim networks.
What is the first check I should run? Confirm that every account that can reach a client has MFA, and that you treat those accounts as privileged, as the joint advisory recommends.
Is a shared admin password across clients acceptable if it is long? No. The advisory says not to reuse admin credentials across multiple customers. Length does not cancel that rule.
What should happen when a technician or a client contract ends? Shut the access off as soon as they go. The advisory says to disable accounts that are no longer in use, and it warns that disabling MSP accounts can be overlooked when a contract ends.
Does CISA set a time limit for shutting off that access? No. The joint advisory does not give a number of hours or a "same day" rule. The "as soon as they go" habit is ours. The CISA warning is that MSP accounts can be missed when a contract ends.
How does Chibitek handle this in its own shop? We use MFA, Conditional Access policies decide when and how people can sign in, and staff working from home connect to the office over VPN. We think every MSP owner should be able to answer these three checks about their own shop.
Let's Run the Checks on Our Own Shops
At Chibitek, we are an MSP talking to MSPs. These three checks are the starting point we think every owner should be able to answer about their own shop. If you want a second set of eyes on your list, we are happy to compare notes. Contact us at hello@chibitek.com.
You can watch the short version here:
The same video is also on LinkedIn.
We make IT effortless so you can create, disrupt, and grow!
Follow Chibitek on YouTube at @chibitekmsp, and follow Chibitek on LinkedIn.
Sources
CISA, NSA, FBI, NCSC-UK, ACSC, CCCS, NCSC-NZ. "Protecting Against Cyber Threats to Managed Service Providers and their Customers" (AA22-131A), last revised May 11, 2022. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-131a
CISA. "Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers," released July 12, 2021. https://www.cisa.gov/news-events/news/kaseya-ransomware-attack-guidance-affected-msps-and-their-customers
Comments