stock.adobe.com
A strong security culture comes from within
The experience of managed service provider Littlefish demonstrates the benefits of developing a company-wide appreciation of security
For Sean Tickle, cyber services director at Littlefish, security is both an external and internal issue, as he wrestles with responsibility for protecting both customers and the MSP’s own operations.
Being able to help develop strategy and get involved with operations is an illustration of how security is an area where MSPs have to practice what they preach and demonstrate that they take data protection seriously.
MSPs are coming under increasing pressure to be able to demonstrate a strong security posture or face not only losing business but potentially being fined for enabling data breaches.
From a customer point of view, Tickle believes the role of an MSSP is to make sure it’s on top of the threats a customer could encounter, and take responsibility for following alerts and threats on a 24/7 basis. “I’m basically here to get our MSSP side of the business signed up to mid-market and enterprise clients,” he said. “Lots of that entails expanding the Security Operation Centre (SOC), and embedding new processes and technologies.
“I’m lucky enough to have come up as a tier-one security analyst,” added Tickle. “I came up in the blue team, the defensive team, and worked my way up. I understand the granular issues that can exist in these environments, and it’s about how we address those, because if we do, our analysts get more time to carry out projects and security bulletins, and also they’re happier and they’re stickier.”
Focusing internally, he’s not just looking for ways to help security specialist retention, but also to make sure his own business is defended against cyber threats.
“I also have the responsibility to ensure our internal security structure is where it should be,” added Tickle.
Security culture
He is also keen to make sure Littlefish maintains a strong security culture across the business and that potential risks are documented and mitigated against.
Demand in the security market tends to remain robust, even in the face of economic headwinds, but Tickle warned that just pitching the latest and greatest technology was not the right approach, and called for a focus on layers that can counter a wide range of threats.
“We are not the type of organisation to say, ‘You better get these, you’re going to get ransomware’,” he said. “It doesn’t work like that. What you need is a layered, in-depth approach to your security.”
Given his position with both an internal and external view, he’s also able to describe the elements that generate a solid security position, with it clear that the success of technology depends on the ownership and staff working towards protecting data.
“Who’s in charge of that? Who’s got ownership of that solution? Who’s looking after the alerts?” said Tickle. “I always say it’s not necessarily the solutions that are ever the problem. It’s the team you have behind them.”
