Managed service provider (MSP)
A provider that remotely administers its clients' systems, whose compromise opens every client's network to the attacker at once, making it a major cyber accumulation point.
A managed service provider handles, on its clients' behalf, the administration of their IT: workstations, servers, networks, backups, security, often through remote monitoring and management tools with elevated rights over every managed system. For a small or midsize company, it is often the only way to access professional IT skills. For an attacker, it is a multiplied target: compromising a provider means obtaining privileged access to dozens or hundreds of client networks at once, with tools the clients' defenses treat as legitimate. For insurance, the provider is an accumulation point the underwriter sees poorly, since it appears in no application unless asked about, and a diversified portfolio of small businesses may depend on a few common administration tools. It is also an insured in its own right, whose technology professional liability policy is exposed to claims from all its clients after an incident. Applications now ask about managed service dependencies and the controls imposed on these providers.
In December 2018, the United States and the United Kingdom attributed to the APT10 group, linked to China's Ministry of State Security, the so-called Cloud Hopper campaign, which targeted managed service providers in at least a dozen countries in order to reach, through them, the networks of their industrial, financial and public clients.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.