Article by Naj Raza – General Manager | Unitrends MSP
The past 12 months have significantly changed the way MSPs think about protecting and storing data — both their own and their clients. Backups must now protect endpoints, the cloud, and SaaS apps like Google Workplace and Microsoft Office 365, and this data is growing 33 times faster than those that manage it.
Cybercriminals are taking advantage of the current hybrid work environment by launching even more sophisticated attacks directed at MSPs and their customers. More than half of all businesses experienced a ransomware attack in 2020, and 2 in 5 SMBs were impacted by ransomware, an increase of more than 145%. Organizations that paid ransom payments jumped 31% in 2020 to $233,817.
MSPs are hyper-aware of the security risks they face internally. The 2021 Annual Kaseya MSP Benchmark Survey showed that 39% of MSPs acknowledged their business was more at risk in 2020 than in 2019. However, MSPs often struggle to implement more stringent internal security measures because they are already stretched thin — any time spent on internal security efforts is time that isn’t allocated to revenue-generating activities with clients.
The news in 2021 isn’t better. Having antivirus protection in place and training employees is critical, but it’s not enough — threats still slip through. Weak data protection strategies have certainly opened up new opportunities for the criminal denizens of the Dark Web, including account takeover (ATO) attacks. ATO attacks have become a lucrative business for cybercriminals who steal or buy credentials in third-party breaches, then reuse them to gain easy access into corporate systems to steal IP addresses, perpetrate business email compromise, gain access to financial accounts, and commit other types of cyberfraud.
To combat the ongoing threats, it’s crucial that MSPs position backup solutions as part of their overall cybersecurity strategy. Many companies were already thinking of their backup and security strategies as interconnected, and the continued evolution of the cybercrime landscape has made this shift in thinking a necessity. As the data environment continues to grow in complexity for organizations of all sizes, businesses must equip themselves with integrated solutions that span both traditional security and backup functions to help prevent, anticipate, and mitigate account compromise and data loss.
Unified Business Continuity and Disaster Recovery (BCDR) To The Rescue
BCDR represents a set of approaches or processes that helps an organization recover from a disaster and resume its routine business operations. Disasters include natural calamities, outages or disruption due to power failure, employee negligence, hardware failure, and cyberattacks.
Backup and data recovery services are a mainstay for MSPs, and 75% are offering a combination of cloud and local implementation and SaaS application backup (up to 69% in 2020 from 53% the previous year), according to the MSP Benchmark Survey. However, there is much more to gain from backup and recovery solutions.
Modern ransomware variants often come with a gestation period designed to overcome the backup defense, meaning the malware does not detonate and encrypt immediately. It first attempts to disable environmental utilities, such as antivirus and VSS writers, as well as delete and encrypt backups it is able to locate. MSPs should look for unified BCDR solutions that are hardened against malware and use artificial intelligence (AI) and machine learning to detect suspicious patterns and alert administrators to ransomware before it wreaks havoc. Solutions with anti-phishing defense capabilities empower end users and provide another layer of protection from credential compromise, ensuring that phishing attacks are stopped before an ATO takes place.
A truly unified solution provides a single view of the entire data landscape. The key is keeping it simple with a single vendor. Moving between multiple systems wastes time and increases room for errors. Technicians can spend up to 33% of their day monitoring, managing, and troubleshooting backups. Automated solutions that proactively fix common problems in production and backup environments are key to increasing productivity, securing the environment, and ensuring recoverable backups. With a unified BCDR solution, MSPs can rest assured that their clients’ data is protected and can divert their time from manual tasks that slow productivity and profitability. In some cases, MSP business owners are giving up 40%–50% margin on inefficient backup.
According to the MSP Benchmark Survey, fewer MSPs are testing their disaster recovery programs weekly or monthly, while more are relying on annual testing when compared to the previous year — 30% in 2020 versus 17% in 2019. This downward trend amplifies the need for greater testing automation in the BCDR space, as frequent testing is more than what most MSPs can handle. MSPs should look for a solution that helps them orchestrate automated runbook testing to validate that recoverability of applications and services as well as ensure that compliance objectives, such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO), are being met.
By prioritizing a unified BCDR solution, companies of all sizes — and the MSPs that support them — can build comprehensive uptime strategies no matter where data lives and adequately protect it from ever-evolving cybersecurity threats.
Unified BCDR solutions don’t need to break the bank. Due to the changing IT landscape brought on by the pandemic, more vendors have embraced subscription pricing to help MSPs better secure data at a pricing structure that aligns with their needs.
A Partner Who Has A Vision For The Future
As more MSPs reassess their needs and those of their customers, having a partner who can pivot is invaluable. Choose a vendor that offers flexibility and support with a plan to transition from on-prem to the cloud if needed.
As an MSP grows, backup solutions can become an albatross around the neck without the right partner. What worked for a handful of clients won’t scale to support a larger operation. At the end of the day, backups provide MSPs with peace of mind. Transitioning to the cloud means change, and protecting data should remain a top priority.
Practice Automated Testing For The Win
The only way you know you will recover is to test regularly, automatically, and after every change to your infrastructure. You also need to prove to your clients that you have verifiable plans in place to execute recovery programs.
Recoveries seem simple but are often complex because many applications have multiple tiers spread across different virtual and physical machines. You want to test how you would recover not just individual machines but also how all the machines in an application are recovered together. While instant recovery with zero downtime is ideal, putting in place the resources to meet this objective may not be feasible for every application for every client.
PRO TIP: Recovery plans should triage applications by their importance to the business so critical apps can be recovered first.
