MSP cyber security report warns of tougher regulations ahead

The MSP industry could face tougher regulation over the coming year as attacks on vulnerable third-party providers continue to rise, ConnectWise’s Perch Security predicts.

The forecast comes as part of the second annual Perch MSP Threat Report, which dives into the major trends from 2020 and makes predictions for the year ahead.

At the top of that list of predictions is the belief that either government or insurance providers – or potentially both – will move to start regulating the MSP industry to protect against rising cyber attacks.

A sustained period of attacks on vulnerable third-party providers - a tactic known as 'island hopping' or 'buffalo jump attacks' - that target an MSP and many of its customers at once, has already seen many insurance carriers choose to close out policies with breached MSPs.

“Some are even not renewing policies for MSPs across the board,” Perch explains. “Buffalo Jumps and their subsequent damages have caused insurance carriers to realise they may have bitten off more than they can chew with regards to MSP’s cyber policies.”

Over the last year, the report found that just 25% of MSPs that suffered a security breach said it was related to ransomware. However, almost 73% reported that at least one client had experienced a security incident, with nearly 60% of these MSP client incidents involving ransomware.

Looking forward, Perch predicts cyber insurance carriers will continue to demand “better cyber security maturity” from MSPs looking for coverage, while US state governments are also beginning to cast an eye at the MSP.

“Whether driven by government or insurance carriers, we predict that new regulations or compliance minimums are on the way,” the report continued. “MSPs still have a voice in this discussion. That voice needs to be used quickly before others outside our industry dictate the future for us.”

Perch also predicts that attackers will continue to focus on cloud-based attacks that exploit poor cloud visibility and understanding, resulting in data-hostage scenarios where criminals demand a ransom to not leak the data. Cyber extortion will also vastly increase the costs of a breach and the time it takes to recover from one, it added.

In terms of security budget, more than 82% of MSPs increased their spending last year, while 75% of survey respondents have indicated that their budget for 2021 will increase by an average of 12.1%.

Perch’s 2020 iteration of the report accurately forecast the beginning of data exfiltration as an attachment to ransomware, ransomware moving to the cloud, ransom demands continuing to settle in the six figures for MSPs, as well as the increasing threat of island hopping.

“Unfortunately for MSPs, all of the predictions we made in our inaugural 2020 report came true,” commented Wes Spencer, CISO at Perch Security. “But the good news is that after taking some serious blows, MSPs have woken up to the existential threat they face from cyber criminals and are finally fighting back.”