What should an MSP monitor to detect a compromise of its own tools?
Your own sign-ins, your management tools' audit logs, and the traffic your tools create in client networks. Alert on technician logins from new countries or devices, new admin accounts, disabled multi-factor authentication, mass script deployments and API keys created outside a change. Keep those logs outside the tools themselves, so an attacker cannot erase them. Protect the servers or cloud accounts that run your tools like a client's crown jewels, and monitor their network traffic too. In client networks, watch for activity that starts from your agent's host and does not match a ticket. NetSenX can watch your own office network and each client's, as separate tenants, with lateral movement and unusual uploads raised as alerts.
Read next
Related questions
- How can an MSP add night and weekend coverage for clients without hiring?
- What can an MSP promise clients about after-hours security monitoring?
- How should an MSP describe security monitoring in a contract without promising a SOC?
- Who is liable if a monitored client is breached?
- What should an MSP do if a client refuses to pay for security?