Why changing your IT service provider is stressful
For a business, IT is stressful, hence why they pawn the entirety of their systems to an IT service provider in the first place. Just the knowledge of that past stress and what changing providers could mean, even when the business is receiving fluctuating service, is enough to put most businesses off. We know as many of our new clients have told us that they wished they’d transitioned sooner (2 or 3 years). It was just the time and trouble of changing that put them off. Once you’ve chosen a new managed service provider (MSP), the actual transition is incredibly fast and seamless, usually taking a few days to a few weeks and with no downtime to your staff.
There are several reasons why companies may wait a long time before changing MSP:
Fear of disruption: Companies may be hesitant to switch MSPs because they fear that the transition process will be disruptive and could result in downtime or other issues. They may also be concerned about the potential for data loss or security breaches during the transition.
Contract obligations: Many MSP contracts have specific terms and conditions, including minimum contract lengths and penalties for early termination. Companies may be reluctant to pay these fees or may not want to risk damaging their relationship or loyalty with the current MSP.
Lack of alternatives: In some cases, companies may feel that they don’t have any viable alternatives to their current MSP. They may believe that no other providers can offer the same level of service, expertise or cost-effectiveness.
Internal resistance: Changing MSPs can be a complex and time-consuming process that requires buy-in from various stakeholders within the organisation. If there is resistance from key decision-makers or IT staff, the process may be delayed or postponed indefinitely.
Lack of awareness: Some companies may simply be unaware of the benefits of switching MSPs. They may not realise that other providers offer better service, pricing or technology, or they may not understand the true cost of staying with their current MSP.
Tips for a hassle and stress-free switch
Take your time to research and gather testimonials of different MSPs. Sit down and have a chat with them to make sure they are covering your needs without pushing impulsive features on you to force you to pay more. A great managed service provider will ensure the transition is seamless, is not disruptive to your business and is stress-free.
Document all the problems and positives of your current MSP so that when you go to them to end the contract, you have grounds to stand on for wanting the change, as well as positives to say thank you to them for.
Take control of the change where you can and communicate with your MSP throughout the journey to ensure they are doing or implementing what they promised. Make sure they provide you with a plan so that you know exactly how they will manage the transition so your business operations are not affected.
During the proposal and initial assessment stage, you still have time to opt out of using the MSP. What’s beneficial in this stage is that the MSP will give you a fresh perspective on your IT systems and what’s normal in outsourced IT services. Since you’re at the point of wanting to switch IT service providers, this reaffirms your previous thoughts of wanting to switch as now you can actually see where your current MSP has not been providing you with the level of service or benefits you need. Similarly, a comprehensive audit of your IT systems by a different MSP can identify flaws and inefficiencies that your current MSP has been ignoring.
We never advocate switching MSPs for cheaper prices, but if a different MSP is offering better services than your current MSP at a similar price — managed IT services will generally be similar anyway — this means your budget goes further. You should always receive a return on your investment in your business.
Many businesses refrain from switching IT service providers too hastily due to perceived hassles with the switch and while risk management is essential for businesses, being too wary and worried can be detrimental to your business if the quality of your current IT service is not up to scratch. Remember, change can be positive.
Choosing a reputable and professional MSP mitigates these stresses and risks. Do your research and when receiving proposals and during the initial assessment stage, you will generally be able to gain a feel for the type of relationship you will have with the MSP in the long run. Like you, an MSP doesn’t want to be coming and going from a client’s systems, so they will do everything they can to maintain a great relationship with your business, as that’s what keeps them clients.
Why change can be stressful for business
Change is normal in life and for business to grow, your business needs to be prepared to take on change. When you’re unsure of the change, it comes down to the resources you have to cope with the stressful situation, i.e., the MSP transition. By doing your research and going through the first few stages with a prospective MSP, talking to them in person, having them assess your systems, and hearing their recommendations and how they can help you, this can significantly reduce the stress from changing IT providers.
In reality, stress and change all come down to psychology and perception towards the change. Learn everything you can about the MSP, do your research, contact testimonials of the MSP and read blog posts on their website to see if they have a diverse array of knowledge of the IT industry. Do what you need to feel comfortable with your prospective MSP and while you might keep telling yourself you don’t have time for this, it is a necessary step, especially if you’re becoming increasingly frustrated with your current provider.
Overall, changing MSPs can be daunting, but in many cases, it can result in significant improvements in service, technology and cost-effectiveness and can be incredibly beneficial to your business in the long run. Companies should carefully evaluate their options and consider the long-term benefits of switching MSPs.
If you need guidance about any step of the process and would like to learn about how Pronet Technology can help both manage your IT systems and improve your business’ Cyber Security measures, give us a quick call and we’ll have a chat!
How do partnerships between my business and my MSP look?
Business partnerships between your team and a Managed Service Provider (MSP) can be a powerful way to enhance your organisation’s IT capabilities. MSPs provide a wide range of IT services, including network management, data backup and recovery, security and software development. They also alleviate some of the IT burdens that small and medium-sized enterprises face and they offer technical expertise, cost savings and the ability to improve the end-user experience, as well as to improve security and to create a better employee experience. Ultimately, a healthy, long-standing partnership is what both parties are aiming for.
What might this relationship look like?
Here are some insights into what business partnerships between your team and an MSP can look like:
Collaboration and Communication: One of the essential elements of a successful partnership between your team and an MSP is collaboration and communication. Your team and the MSP need to work together closely to ensure that the services provided by the MSP align with your business goals and objectives. Communication is critical to ensure that expectations are met and any issues are addressed promptly.
Clear Service Level Agreements (SLAs): Service Level Agreements (SLAs) define the services to be provided by the MSP and the performance standards that will be met. Clear SLAs ensure that your team and the MSP have a shared understanding of the services to be provided, the timelines for service delivery and the expectations for service quality. SLAs also provide a framework for measuring the performance of the MSP and ensuring that service delivery meets the agreed-upon standards.
Customised Service Offerings: MSPs offer a wide range of services and it’s important to choose an MSP that can tailor their offerings to meet your specific needs. Customised service offerings ensure that you get the services you need, without paying for services that you don’t need. Your team and the MSP should work together to identify the most important services to your organisation and develop a customised service package.
Continuous Improvement: Technology is constantly evolving and working with an MSP committed to continuous improvement is essential. The MSP should have a process for identifying new technologies and service offerings that can benefit your organisation. Regular meetings between your team and the MSP can ensure that you are aware of new services and technologies that can improve your IT capabilities.
Scalability: As your organisation grows, your IT needs will also grow. The MSP should be able to scale their services to meet your changing needs. A good MSP will have the resources and expertise to provide the services you need, regardless of your organisation’s size or complexity.
Tips for building a strong partnership with your MSP
Choose your Provider Wisely
We have an entire article about how to find a good provider for you — read that here — but essentially, you need to find one that fits your needs. Like all businesses, each MSP is different and while one may suit next door’s business perfectly, it might not suit yours. An MSP should drastically impact the efficacy and performance of your IT systems, so make sure you choose one that has the right services, expertise and reputation that is important to you.
Prioritise Communication
Communication is crucial to any relationship so make sure both parties are transparent about challenges, goals and progress going forward. Your MSP needs to know everything it can about your business so it can provide you with appropriate recommendations tailored to your business. You should also outline the type of relationship you expect from the provider, such as great service, timeliness and expert opinions.
Set Goals and Responsibilities
As a business, you also need to know the capabilities of your MSP, which should have been detailed to you at the beginning of the partnership. They should have also outlined a range of goals that both they and your business need to achieve to see your business technologically advancing. Ensure you are also aware of the MSP’s role within your team, as they do have one, but you need to understand where their duties and roles stand. This should have been communicated to you in the contract stage.
Be able to Adapt
One of the reasons you hire an MSP, other than for them to manage your IT systems, is so you have access to IT professionals who can provide you with recommendations on improvements to your network, hardware and software. Sometimes, they would also have standards that they informed your business had to meet for them to work with you, so make sure your business is considering these so that your business can achieve its goals.
Monitor the Relationship
Like any relationship, make sure to check in regularly, whether that be in-person, via a phone call or video call, to make sure everything is running smoothly and everyone is on the same page. Meetings for updates and evaluations allow for open communication and strengthen your long-term relationship with the MSP. Relationships also change and evolve over time, and they can also potentially sour if a disagreement arises. Keeping up with communications and informing each other of issues should be a regular occurrence.
Look Long-Term
Working with an MSP is a long-term partnership. Unless you are not receiving the level of service required, you should aim to stick with the MSP rather than changing it every few years. This saves you time, stress and money and allows you to establish trust with the provider, where you can openly discuss each other’s shortcomings and where each party can improve. This allows you both to grow and prevail as businesses. This also encompasses the MSP understanding your business goals so that it can work with you long-term in achieving these and improving your business’ IT level. It might help to create a roadmap for this.
A business partnership between your team and an MSP can be an effective way to enhance your organisation’s IT capabilities. Collaboration and communication, clear SLAs, customised service offerings, continuous improvement and scalability are essential elements of a successful partnership. Choosing the right MSP and building a strong relationship with them can help your organisation achieve its IT goals and objectives.
Did you know that by 2025, globally, the amount of data generated in the cloud or connected servers will reach around 463 exabytes, each day? One exabyte is one billion gigabytes!
This figure from SeedScientific highlights just how much data businesses collect and store and is the reason why data must be kept safe from breaches and other cyberattacks. One of the ways to do this is through encryption which is already used in many of our daily online activities without you thinking about it, like in our online banking, shopping and browsing.
Encryption is the digital equivalent of an unsolvable jigsaw puzzle. It’s a way of scrambling information so that only the intended recipient can understand it. Encryption is an essential part of modern communication and commerce, allowing us to send sensitive, confidential or personal information over the internet without fear of it falling into the wrong hands.
With businesses storing their information in the cloud or on servers with an ongoing connection to the Internet, your data is most likely going to end up on another organisation’s systems, so it’s important to keep this data private.
What is encryption?
At its most basic level, encryption involves taking a message or piece of data and scrambling it using a mathematical algorithm. This algorithm is designed to be extremely difficult to reverse, meaning that anyone who intercepts the message will not be able to read it without the encryption key, which the recipient has, which then unscrambles it back into plain, readable text.
Encryption protects the data you send, receive and store on devices, whether it be text messages, running logs saved on your Apple Watch or banking information sent through your online account.
How does encryption work?
Think of encryption as a secret language between two people, the language being called, cipher text. Imagine you and a friend agree to use a secret code where each letter of the alphabet is represented by a number. You can use this code to send messages back and forth without anyone else being able to read them, as long as they don’t know the code.
In the digital world, encryption works in much the same way. When you send a message or data over the internet, it’s first encrypted using an algorithm that generates a unique key. This key is a long string of random numbers and letters that is used to scramble and unscramble the data in a process called decryption. Without the key, the encrypted data is unreadable.
This key can be generated through a couple of methods. Through Bit Sequence, or key space, where it specifies the units for the number of possible key combinations, with the bigger the key space, the stronger the encryption; as well as through Password-Based Key Derivation Function 2 (PBKDF2) which creates keys from a random string of passwords which then goes through Bit Sequence.
Types of encryption
There are two main types of encryption:
Symmetric encryption: where the same key is used to encrypt and decrypt the data. With symmetric, both the sender and receiver must have access to the same key.
Asymmetric encryption: this uses a pair of keys, one public key and one private key. The public key can be shared with anyone, while the private key is kept secret. When someone wants to send a message to you, they encrypt it using your public key. Only you can decrypt the message using your private key.
Encryption is used in a wide range of applications, from online banking and shopping to secure messaging and file storage. It’s also used by governments and military organisations to protect sensitive information.
There are different types of encryption algorithms, such as the now-obsolete Data Encryption Standard (DES) established by the U.S. government in 1977; Triple DES strengthens the DES through encryption, decryption and another round of encryption; RSA is popular for its key length; Advanced Encryption Standard (AES) was developed as the U.S. government standard in 2002 and is used worldwide; TwoFish is one of the fastest algorithms used both in hardware and software and is free to use.
One of the most common encryption protocols used on the internet by reputable websites is SSL or Secure Sockets Layer. This protocol is used to secure connections between web browsers and servers, allowing you to safely enter sensitive information like credit card numbers and passwords. SSL works by establishing a secure connection between your browser and the server using a combination of symmetric and asymmetric encryption. You can tell a website is using this technology by looking for the padlock icon in the URL bar and the ‘s’ in the ‘https://.’
Ensure you and your staff are only using sites using SSL when you’re storing or sending sensitive data, like purchasing something, filing taxes or doing other business-related tasks. Most email clients also come with an encryption option in the setting menu, so check that this is available so that your emails are being sent over an encrypted connection and that each email is then encrypted.
Encryption and Cybercrime
Encryption can also be used by cybercriminals to attack you, such as in ransomware attacks. Other than ransomware breaches that steal your organisation’s data and demand a ransom to prevent them from releasing that data, another attack involves hackers encrypting computers and servers of businesses and then demanding a ransom to provide the key to decrypt the data.
To protect yourself and your business from ransomware attacks, install and use security software on all your devices and make sure these are up to date. Update your operating system and other software you use as these often patch vulnerabilities found by the vendor. Be incredibly wary about email attachments, never opening any you’re not specifically waiting for. If an email tells you to enable macro settings to open attachments, doing so can cause macro malware to infect your files. Make sure your data is backed up in multiple locations, such as on the cloud, so that you can simply go back to the unencrypted form if in a ransom attack and above all else, don’t pay the ransom. The Australian Government states not to as there is no guarantee the criminal will release your data back to you.
Why is encryption important?
In our digital age, encryption matters. The internet comes with a magnitude of privacy concerns, both nationally and globally, and encryption is another layer of online privacy you can use to send your personal information securely. Government regulations also require industries to implement security measures that protect customers’ information, such as healthcare providers protecting patients’ sensitive information that is stored online and higher education institutions protecting student records. Any breach can cause an organisation to violate The Privacy Act 1988 and can see businesses facing hefty fines, data loss and loss of trust and reputation.
Encryption is an essential part of modern communication and commerce. It allows us to send sensitive information over the internet without fear of it falling into the wrong hands. Whether you’re shopping online, sending emails or storing files in the cloud, encryption is there to keep your data safe. So, the next time you use the internet, take a moment to appreciate the technology that’s working behind the scenes to protect your privacy and security.
Have you ever lost important data due to a system failure and wondered if your data recovery system is fail-proof? Losing valuable data can be a frustrating and emotional experience, so it’s important to ensure that your data recovery system is reliable and effective.
When a company loses data that can be recreated or easily regathered, then data loss might not be a major issue for your business, but when data critical to your business is lost and unable to be reobtained quickly, this can cause devastating problems for your business, including possible fines.
Some business owners have the idea that they live in an area safe from disasters, or they’ve never had a disaster, so they don’t need to invest in a disaster recovery plan for their business. For those business owners or stakeholders, it’s time to start rethinking what disaster recovery means.
When something goes wrong on one of your or your employees’ devices, or even in your IT system infrastructure, a strong recovery plan can mean the difference between getting back up and running in minutes or struggling to recover your information for days, weeks or ever.
What Constitutes a Disaster?
A disaster doesn’t just have to be natural, like a fire, flood, cyclone or earthquake. In business, disaster also includes ones caused by human error, like an employee failing to save a document or clicking a phishing link. Data backups and recovery in your business means protecting your business from human error, corrupted files, fraud, ransomware, Cyber Security breaches, IT system failures and power outages.
Importance of a Disaster Recovery Plan
Other than protecting your business and its long-term operations, having a disaster recovery plan is important for many other reasons, including:
Protecting your business’ data
Protecting sensitive information of customers
Protecting your business’ reputation
Removing longevity worries and allowing your business to focus on more important matters
Cost-effective as it reduces possible financial loss and business disruption
The 3-2-1 Backup Rule
If you are not relying on an external provider to look after your systems and data recovery, businesses should use the 3-2-1 rule. All precious data should be stored 3 times, once on the original data storage place, like your computer, and then on two other different technologies, like on disks and the cloud.
Why do backups fail?
Your backup software didn’t work
There’s not enough space on the storage device for the backup
The backup didn’t cover the entire device
Backups are done manually, not automatically
The computer or storage device was not on when the automatic backup was scheduled
Files were lost before the backup was created
Backup tips
Here are some tips to determine whether your data recovery system is fail-proof.
Firstly, consider the type of data recovery system you have in place. If you’re relying on a basic backup system like an external hard drive or USB drive, it may not be enough to protect against all types of data loss. These systems can also fail, so it’s important to have a backup of your backup or consider using a more sophisticated data recovery system.
Secondly, consider how often you’re backing up. If you’re only backing up your data occasionally, such as once a week or once a month, you may be at risk of losing important data that was created or modified since your last backup, so if you received a large amount of customer data or analytics during that time, it’s all gone. Ensure your backup system runs automatically regularly so you don’t have to worry about forgetting to back up your data.
Thirdly, test your data recovery system regularly. It’s important to ensure that your data recovery system is actually working and can recover your data in the event of a system failure. Test your backup and recovery processes regularly and ensure you can restore all of your important data.
Fourthly, consider using cloud-based backup and recovery systems. These systems are designed to be highly reliable and secure and can protect against all types of data loss, including natural disasters, theft and cyberattacks. They also allow you to access your data from anywhere, at any time, making it easy to recover your data in the event of a system failure.
How an MSP helps
Your managed service provider should offer data continuity as a service and it is a service you should most certainly be using. The MSP will regularly back up your data and test these backups to ensure your business will be back up and running no matter what happens.
Pronet Technology’s disaster recovery solution provides several layers of redundancy to ensure that your essential data is backed up and recoverable. Our backup systems are also regularly ‘stress tested’ so that we can ensure your backups are ready and able to function in a real situation.
Ensuring that your data recovery system is fail-proof is essential for protecting your valuable data. Consider the type of backup system you’re using, the frequency and reliability of your backups, regularly test your data recovery system and consider using a cloud-based backup and recovery system. By taking these steps, you can ensure that your data is safe and secure and that you won’t have to worry about losing important data due to a system failure.
Businesses are full of data and while this data may not be 100 per cent safe from threats and losses, as long as you’re prepared for such emergencies, you will be able to pick up and keep business moving.
Like anything in the IT industry, risks and solutions are constantly changing, so keep up to date with different strategies to incorporate into your data recovery plan. Contact your MSP to see how they are adequately keeping your data safe and to see if there is anything else your business can do to keep itself safe.
Does my business need to implement every aspect of Essential Eight?
Essential Eight aims to get organisations to achieve a varied Cyber Security framework that spans the eight strategies so that they can improve their maturity of whichever strategy they are lagging. It’s an initiative that helps businesses understand the importance of Cyber Security within their organisation and gives them a framework on how to improve.
As the strategies are varied and quite specific, a business will not reach the maturity level it needs without any dedicated effort. We understand it can be a struggle to navigate the challenges of Cyber Security, especially since the higher the maturity level you reach, the more costs involved and the inconvenience it can be on yourself and your staff. It’s necessary though, as any cyberattack that occurs can be detrimental to your business, including unproductive staff, downtime, data breaches, ransom attacks, lost customer trust and reputation, high expenses plus any legal fees that may occur, and potentially could even see the closure of your company.
Does my business need to implement all eight strategies?
If you’re unsure what the eight strategies are, read this article here to learn.
Originally when Essential Eight was introduced by the Australian Cyber Security Centre (ACSC), now part of the Australian Signals Directorate (ADS), it suggested all organisations should aim to reach Maturity Level three. Businesses had to implement only four of the strategies — application control, patch applications, restrict administrative privileges and configure Microsoft Office macro settings — with the remainder being optional, and they were also able to self-assess their compliance.
With the updated version released in 2023, it aims for businesses to reach the same maturity level across the strategies before moving up to the next. What this means is that each of the eight strategies needs to be improved and lifted to your needed level. If seven of the strategies are at Level Two and one is at Level One, then your organisation’s Maturity Level is One. The newer version also introduces audits to check proper compliance.
For that reason, yes, your business needs to implement every strategy in Essential Eight. It’s the target level that determines how intensely you then implement these strategies.
Your business may not need to reach Level Three. This will be determined in your initial risk audit and assessments that you complete alongside a Cyber Security audit. Business owners and stakeholders must understand the risks that your business faces, as well as the costs associated with these and the consequences if they happen.
Is Essential Eight enough to protect my business?
Other than Essential Eight, your business should also have other Cyber Security practices in effect, including proactive monitoring of your networks and devices for malicious activity and regularly testing data recovery solutions so that when a cyberattack occurs, you can get your business back up and running. Essential Eight also doesn’t approach the task of the initial risk assessment that your business must undergo before implementing any Cyber Security strategy.
Essential Eight is simply a starting point for businesses to protect their digital assets. At current, the framework is about to become compulsory for all non-corporate Commonwealth Entities (NCCEs) so that Australia conducts business securely in the future to protect the country and its citizens. Now that so much of our lives and information is online, action needs to take place to protect this information. The government will be auditing NCCEs for compliance and, as part of their contracts, the NCCEs may require businesses they work with to also comply, meaning businesses may lose opportunities if they do not comply.
The framework is also highly recommended by the Australian Government for all other businesses, but we believe this will change soon to become mandated. Cyber Security attacks are growing, both in number and complexity. Criminals are using social engineering to trick staff into believing they are legitimate actors which then leads to disaster for businesses. Your business needs to aim to decrease as many of these opportunities, plus other complex threats, from reaching your staff, which Essential Eight can help achieve.
The ACSC themselves mention that:
“While no single mitigation strategy is guaranteed to prevent Cyber Security incidents, organisations are recommended to implement eight essential mitigation strategies as a baseline. This baseline, known as the essential eight, makes it much harder for adversaries to compromise systems.”
What now?
Implementing Essential Eight is something we, as an MSP specialising in Cyber Security, have been working with our clients to do and is something we do with every new client we take on board. Cyber Security can ruin businesses, so it’s something that must be applied.
The maturity level your business requires depends on your business and circumstances, so during the assessment, make sure to ask questions like ‘What is the risk of an attack’ and ‘What does my business have to lose.’ Once you’ve determined the level, it’s then time to achieve this through implementation, reviewing and monitoring.
If you’re unsure where to go from here, we can help you along the journey. In addition, Pronet Technology can also help with broader and stronger Cyber Security strategies and offer services with advanced threat protection and detection.
Contact Pronet Technology today to learn how prepared your business is for Essential Eight and how we can improve your Cyber Security.
Essential Eight and why your business needs to Integrate Cyber Security
In today’s world, IT systems are an essential part of any organisation. They help in improving efficiency, communication and productivity. However, with the increasing use of technology, the risks associated with IT systems have also increased.
You must know what Essential Eight is if you’re an Australian organisation. It’s a cyber self-assessment security maturity tool to help organisations reduce Cyber Security incidents caused by cyber threats
The government currently recommends that organisations implement the eight essential mitigations as a baseline but we believe this will change in the future to be mandated so it is something we advise our clients and prospects to implement.
Developed by the Australian Cyber Security Centre (ACSC) to protect Microsoft Windows-based internet-connected networks, the framework has four maturity levels for each business’ risk category.
Level Zero: not aligned with strategic objectives.
Level One: partially aligned with the objectives.
Level Two: mostly aligned with the mitigation strategy objectives.
Level Three: fully aligned with objectives.
The levels depend on your business’ risk status and data sensitivity. Level One businesses, for example, are not commonly targeted specifically, so they just receive the typical mass scam emails. Level Two has the potential to be targeted but criminals will often move on if they find the security systems to be too hard to breach. Level Three are where attackers primarily focus as they have high dollar value data, such as banks and telecommunication companies.
Why should your business measure against Essential Eight?
Essentially, Essential Eight is all about Cyber Security and can be seen as a baseline for businesses to measure their maturity against, but it should be just one part of a wider framework that you should have in place. Cyber threats are constantly evolving, so businesses need to adapt to disruptions caused by Cyber Security incidents so that they can maintain business operations. This includes detecting, managing and recovering from incidents. We have other articles on our blog relating to these, so please read those to understand what your business should be doing to protect itself.
By measuring your business against the framework, your business can increase its knowledge of Cyber Security in business and identify company risks and how to control them. It allows your business to create a roadmap going forward that you can tick off to know that your company is becoming secure, and it gives you something to assess your service provider with to ensure they are integrating the Cyber Security processes within your business.
Limitations of Essential Eight
As mentioned, Essential Eight should not be used in isolation to protect your organisation. It’s not a fully-fledged Cyber Security framework and will not protect you from ever having cyber threats. For example, if you’re at Maturity level Three, this will not stop adversaries with the time, money and effort to compromise your business.
The Essential Eight is currently just a loose framework for your business to get started with implementing Cyber Security strategies to protect your businesses. When data leaks can cause your business to be in breach of laws such as The Privacy Act, you need to ensure that you are adequately covered.
The framework is also primarily designed for Microsoft Windows-based businesses, which represent the majority of public sector organisations’ corporate environments, hence why it was introduced by the government. So, while it’s not specifically designed for other operating systems like Mac, Cloud, Operational Technology (OT) or Linux, you can still use it to support your organisation’s Cyber Security development.
So, what are the Essential Eight strategies?
The Essential Eight strategies are designed to address the most common types of cyberattacks that businesses face. They are practical, actionable and cost-effective. Here’s a brief overview of each of the Essential Eight strategies:
Application control: This strategy involves creating a list of approved applications that can be executed on a system. By doing this, organisations can prevent malicious software from running on their systems.
Patch applications: Regularly patching applications can help businesses fix vulnerabilities in their software. This reduces the likelihood of cyberattacks that exploit these vulnerabilities.
Configure Microsoft Office macro settings: Cybercriminals often use Microsoft Office macros to deliver malware. Configuring the macro settings in Microsoft Office can help SMEs prevent this type of attack.
User application hardening: Blocks or removes common software used to download or run malicious software and prevents malicious software from running on business’ networks.
Restrict administrative privileges: Limiting administrative privileges can help businesses prevent malicious actors from gaining access to critical systems.
Patch operating systems: Similarly, regularly patching operating systems can help organizations fix vulnerabilities in the underlying software. This reduces the likelihood of cyberattacks that exploit these vulnerabilities.
Multi-factor authentication: Using multi-factor authentication can help organisations prevent unauthorised access to their systems. It involves requiring two or more forms of authentication before granting access.
Daily backups: Regularly backing up data can help businesses recover from cyberattacks. In the event of a ransomware attack, for example, businesses can restore their data from a backup rather than paying the ransom.
While you might not understand the technical processes of each of the Essential Eight, your IT service provider should be implementing these strategies to help your organisation protect itself against cyber threats. Talk with your MSP to see how and if they’re implementing these into your business.
Does my business need to implement Essential Eight?
While it is not mandated to do so, the framework is highly recommended by the government for Australian businesses to follow. At Pronet Technology, we recommend your company start integrating the framework as soon as possible. Even though we’re an MSP, over the last five so years, we’ve been doing all we can to learn more about and specialise in Cyber Security as we believe it plays an integral role in the longevity of businesses.
While ACSC recommends all businesses be at maturity level 3, each organisation’s Cyber Security level depends on its business need, size and complexity. As a business, conduct a risk assessment alongside your IT service provider to determine, analyse and prioritise the gaps in your business that can be strengthened and then act on those.
There are always going to be some challenges to improving Cyber Security within your business. It could be that you lack the staff and funding or that you don’t have the knowledge to successfully implement Cyber Security. You could have other organisational priorities or believe ad-hoc security is enough. Some people in the business might not yet be on board or you just don’t know how to improve. Cyber Security runs throughout the business so it’s something that everyone needs to understand and come on board with.
Most companies these days outsource their IT systems to service providers. Make sure you know the cyber maturity of your MSP in relation to Essential Eight so that you can build a strong working relationship with the MSP to ensure your business is protected.
By implementing these strategies, SMEs can significantly reduce their risk of cyberattacks. Essential Eight is not a silver bullet, but it’s a great starting point for any organisation looking to improve its Cyber Security posture. It’s important to note that Cyber Security is an ongoing process, and businesses should continually assess and improve their security measures.
Small and medium-sized enterprises (SMEs) often face the challenge of managing their IT systems and infrastructure without specific in-house resources. This can result in IT issues that disrupt business operations and impact productivity. To address these challenges, SMEs can choose from a variety of IT support options, including ad-hoc support, small managed service providers (MSPs) and large MSPs to improve their IT system optimisation. Each option has its advantages and drawbacks, and the choice depends on the specific needs and budget of the SME.
A separate post will detail what ad-hoc IT services are and why, for a company reliant on its computers and that has more than five computers, this should not be how they manage their IT. This post will focus on the difference between smaller, established MSPSs and larger, enterprise-level MSPs.
Established MSPs
Established MSPs are on par with large MSPs in terms of their services, resources, expertise and cost. They just have a smaller team (under 30 staff) and typically work with small and medium-sized businesses rather than larger ones. This is where Pronet Technology falls. We are not a large MSP but we’re established with immense managed service experience as well as Cyber Security experience, the latter being something many larger MSPs don’t even specialise in. In terms of cost, we go in and evaluate the needs of your business and base your package around that. If you don’t need all the services we provide, we don’t offer those, so the price will be different than what our other clients are paying. This means the price could also be more, or less, than what other MSPs are charging, it just depends on the needs of your business.
Enterprise MSPs
Large, enterprise MSPs, like Brennan IT and Powernet IT Support, typically have a broader range of services, resources and expertise than smaller MSPs, and may offer 24/7 support and specialist solutions. Large MSPs can provide SMEs with comprehensive IT solutions and greater scalability, but may also have higher costs due to overheads and less personalised service. SMEs may have to navigate complex service contracts and may not have direct access to the same technicians or engineers each time they require support.
The differences between the two
Personalisation
One of the big drawbacks of working with a large, enterprise-level managed service provider is that they offer less personalisation for their clients. A smaller MSP can look at your company and systems and tailor a plan that works for you, ensuring you’re receiving adequate security and service while also not trying to ‘over-service’ you with technology you don’t need. They can offer customised service plans that meet each client’s specific needs, rather than offering a one-size-fits-all solution.
With a larger MSP, your point of contact is often an account manager whose service depends on how many other clients they manage. If they leave, you’re then stuck in limbo until another account manager is assigned to you, who may or may not offer the same level of service as the previous one. Larger MSPs may have a larger client base, which can make it more challenging to provide individualised attention to each client.
Flexibility
Due to the large size of enterprise-level MSPs, escalations are often slower as they have to go through the channels to get to the right person. You will find that smaller MSPs generally have more flexible arrangements and can come out to your business when there’s an issue relatively quickly and within your timeframe. While not always, larger MSPs are more rigid and you have to wait on them for when they’re free.
A key difference between established and enterprise-level MSPs is that they utilise different technical standards for their clients. While the cost of the managed services between the two is on par, many enterprise-level MSPs require their clients, no matter their size, to utilise higher grade hardware, such as CISCO, for their security, which may cost about $30,000, compared to an established MSP, like Pronet Technology, requiring their clients to use Sophos, which is about $3,000.
Our technology stack, that is, the software, hardware and applications we use, are more focused on small to medium-sized businesses as they’re the clients we take on, whereas a larger MSP will often require all their clients to use enterprise-level technology, regardless of their size and whether the tech is right for their business. Working with a larger MSP isn’t always beneficial, even though they may seem better and more experienced since they’re larger. You have to work out whether the MSP is right for your business.
Expertise
Large MSPs have the advantage of high-level, specific expertise in certain fields, so they have more experts and engineers within their company than smaller MSPs, so they’re fantastic for specific technologies and projects. This raises the question though, of whether those experts also know other areas of managed services. In a smaller MSP, while they might not have the in-depth expertise about a specific technology you’re after, they have general knowledge of the whole managed service industry to help give you recommendations and look after your systems. Due to the scale of the larger MSP, it may take your business longer to get access to those experts though, as your call goes to the help desk who have to ask you a range of questions before you can ever gain access to that specialist. Kind of like calling your telco or bank. Established MSPs like Pronet are smaller but with a broader knowledge span. Bigger, more specific MSPs might not be what you need unless you have a specific project or problem.
For example, an enterprise MSP might have an SAP specialist, whereas a smaller MSP, who takes accountability for your systems, takes over the issue and contacts the SAP vendor themselves. The pros and cons of this depend on the problem your business is facing. By the time the larger MSP gets onto the problem, if it’s a less complicated issue, they can deal with it right away. If it’s a complicated issue, they then have to escalate the issue further and contact SAP directly, which, by that time, the smaller MSP could already have worked the issue out with the vendor. This hierarchy system, while organised and beneficial for a larger company to manage, doesn’t always work for the client as with smaller MSPs, where all tech staff, no matter their level, are working together, then can just turn to another tech employee and ask for help.
Smaller, established MSPs are generally more invested in your business and longevity as they take on the responsibility to fix the problem even though they may not be direct experts on the issue.
24/7 Support
Most large, enterprise-level MSPs provide 24/7 support, compared to smaller MSPs who may only offer extended work hours support, such as between 6am and 11pm. This might be necessary when you run an international business, but bear in mind that this support is outsourced overseas and the help desk associates generally only have Level-one knowledge to help you. If you need more expert support, you will have to wait until normal trading hours to get the help. These days, even some trading hours help-desk support is also being handled overseas. You will find that this is not the situation with smaller established MSPs as most believe in local service and, while outsourced service is cheap to provide, we have found that most clients don’t want it. At Pronet, even though we provide extended-hour support, we have found that we rarely get called anyway, with a lot of the after-hours work driven by us when our systems inform us that there is an issue in your business, which we then fix remotely.
Geographic Coverage
Another difference between the two, due to their size, is their physical reach. A large, enterprise MSP will often have more than one office across Australia and can handle large-scale projects and clients. This means that if a client in Perth needs a hardware upgrade, such as a router, someone from their Perth office can head out to install it. For smaller MSPs, while they may have clients in other cities, many will rely on strategic local partners to fix on-site issues. This is beneficial for smaller MSPs as they can work with more clients, but since the staff are not from the MSP, they cannot control the level of service provided to the tee. If it’s a large-scale issue that needs on-site fixing, the client will often fly the MSP’s employee/s out. Since most problems can be fixed remotely, this is not often an issue, and you will find that enterprise-sized MSPs will often use partners for regional work too.
Buying Power
Enterprise-level MSPs have more buying power to purchase computers and hardware at lower costs, and larger clients are often happy to bulk buy computers to receive those discounts, which they then have stored at the MSP. Enterprise MSPs don’t have any buying power when it comes to licences and services, like Microsoft 365 and internet service, as those prices are outside their control. Keep in mind that just because the MSP can receive a discount on hardware, that doesn’t necessarily mean those savings will be passed down to the client, and definitely not for their smaller clients.
Business Structure
Larger, enterprise MSPs take longer to plan and get started on projects due to their size and hierarchy of operations, whereas smaller ones, due to having less staff and formal procedures, have shorter lead times. Having more processes and procedures to follow does make operations smoother for both the MSP and your business though, so that is an advantage. It can also, however, be a disadvantage as these processes mean the MSP is more rigid and won’t change, whereas a smaller MSP can offer more flexibility and use their judgement on projects and issues. Large MSPs may be slower to adapt to changes in the IT industry or changes in a client’s needs. They may have a larger management system and processes in place that can make it difficult to respond quickly to changes.
When MSPs begin to get incredibly large, they tend to start becoming more sales focused, which is where you find differences in cost between them and smaller providers. A smaller provider, while on par with a larger provider in terms of managed service costs, tends to be more affordable due to them not trying to sell you all their services and new technology which your business might not need. Most established MSPs are technical but operational-focused as, due to being in the trade for many years, understand business and risk management for business longevity. Newer MSPs maybe not as business inclined and are quite technical in their work and communication with your business, while larger, enterprise-level MSPs are often technical but with a sales focus where they try to push more services on you to get you to spend more.
Writing this post, we understand it might be skewed more towards the positives of smaller, established MSPs and that’s because we are one. At Pronet, we used to work with larger clients but then scaled back as we knew that SMEs were being left behind and, ultimately, we enjoy the level of service we can provide these businesses. We understand the frustrations of SMEs as we’ve had clients who have come to us who were left behind as their previous MSP grew and were, essentially, forgotten. Due to this, we’ve tailored our services and technology stack to suit small and medium-sized businesses.
That’s not to say enterprise-level MSPs are bad or unneeded, because they are certainly needed for larger businesses with 200 to 300 computers and up as they’re too large for smaller MSPs to handle. The same thing goes for small businesses with one to five computers. Unfortunately, while you might need the services of an MSP, you might struggle to find one who finds it worthwhile to take you on as a client.
Ultimately, SMEs should carefully evaluate their IT needs, budget and goals when choosing between smaller but established MSPs or large, enterprise-level MSPs. Smaller MSPs can provide ongoing support and personalised service for SMEs with more modest needs. Large MSPs can offer comprehensive IT solutions and scalability for SMEs with more complex requirements but may come with higher costs and less personalised service. Seeking advice from an IT advisor or consultant can help SMEs evaluate their options and find a provider that can deliver the right level of service and support for their unique needs. When gathering proposals from IT providers, ask them questions relevant to your business to ensure they’re the right fit for you.
Overall, SMEs need to understand that just because an MSP is larger, doesn’t mean they’re better for your business. You need to determine the needs of your business to see what is best for you.
What would be the true cost of disaster to my business if my IT failed?
As a business owner myself, I know the importance of keeping my business’ IT systems running smoothly, which I’m sure you are also aware of in your own company, but have you ever thought about the true cost of a disaster if your IT systems fail? The truth is that it can be catastrophic.
Imagine your business losing all of its data or being unable to access critical systems for a prolonged period. The impact on your business can be devastating, resulting in lost revenue, damage to your reputation and even the closure of your business.
So, what is the true cost of a disaster for your business if your IT fails? Measuring the cost of failure is complicated as there are so many different areas that factor into this, like direct costs and indirect costs.
Direct costs include costs of repairs or replacements of damaged hardware and software, as well as any business interruption. There is a range of indirect costs that IT system failures can create that can actually be higher than the direct costs. Let’s take a look at some of these:
Lost Revenue
The first factor people generally think of when they think of costs is lost revenue. Lost revenue occurs when a business is unable to continue normal business operations which can be incredibly devastating for businesses who heavily rely on technology. If your IT systems are down, your business may not be able to operate at full capacity, resulting in lost revenue.
Downtime also creates impatient customers and if other stores are selling similar products, customers will go there instead, to which they may find they like that store better, and therefore may continue using their products or services instead. Businesses need to understand the lifetime value of lost customers and when IT failures can cause your business to seem unreliable, this can tarnish the business’ reputation and therefore, lose customers.
The exact lost revenue from unplanned system outages depends on the type of outage and the size of your business. For a small independent store, an IT outage could result in no card payments for a few hours, leaving you relying only on cash — which not many people have on them these days. This is even more devastating for businesses that rely on every sale to stay afloat.
To calculate potential annual lost revenue, you can use a simple formula:
Lost Revenue = (G/T) x I x H
G = gross annual revenue
T = total annual business hours
I = percentage of revenue lost during an outage
H = number of annual outage hours
Reputation Damage
An indirect cost that occurs if your business experiences a significant IT failure can be a damaged reputation. Reputational damage occurs when customers and other stakeholders lose confidence in the organisation’s ability to effectively manage risks and protect their interests. Suppliers may also be hesitant to work with a business that has suffered a data breach, leading to potential supply chain disruptions and delays. If you’ve noticed the business’ reputation has been damaged, an entire marketing campaign may be needed to repair this, further incurring your business costs.
Customers may lose trust in your ability to provide reliable services or products, resulting in lost sales, and, as mentioned, lost customers occur when customers become frustrated with the disruption that occurs to businesses to which they then switch to a competitor, resulting in lost revenue.
Recovery Costs
Another direct cost associated with IT failures is the cost associated with fixing the issues. In the event of a disaster, you may need to hire IT professionals to restore your systems. This can be a costly process, especially if you need to pay for emergency services or if you don’t have a managed service provider.
Part of this also includes recovering or repurchasing hardware and software or services, which can differ in their severity. For example, a company’s email server not working is less severe than customers being unable to place orders. In this way, it’s the exact nature of the loss or outage that will determine the costs.
A factor that many people don’t think of are the costs surrounding overtime to catch up on missed work during downtime. Not only that, but IT failures may have forced your staff to keep paper records of transactions or notes during a system outage, which then need to be manually input when systems go online again, leading to overtime and other labour costs.
IT failures can also cause your staff to miss deadlines or follow through on contractual obligations with projects, meaning more money will be spent on projects that should have already been finished or you will have to reimburse customers.
Data Loss
Direct losses also include losing data, which has an even bigger impact on your business than the loss of an application or service. Data loss can be permanent and can have financial and legal implications beyond the direct losses on your company. The costs surrounding data loss can even lead to the closure of a business. Data loss ties into every other factor on this list and has a direct link to cyber threats like phishing, malware and ransomware. If your IT systems failed and cybercriminals had easy access to your network and data, this can also lead to ransom demands or costs related to recovering lost data.
Legal Costs
Depending on your industry, you may be subject to legal or regulatory requirements that mandate the protection of sensitive data. SMEs that suffer a data breach can face lawsuits and government fines, especially if they’re not in compliance with data protection laws. These legal battles can be expensive and time-consuming, and can also cause damage to your reputation.
Time and Productivity Loss
If your IT systems are down, your employees may not be able to work as efficiently. This can result in lost productivity and increased costs.
A Dunn & Bradstreet survey found that 59 per cent of Fortune 500 companies experience 1.6 hours of downtime per week or more. If this is a company-wide failure that prevents all employees from working and that company has 5,000 employees, with an average labour cost of $30 per hour, the labour downtime for that week is $240,000 in lost productivity. Per year, that’s $12,480,000. Even if you had one-thousandth of that amount, that’s still $12,480 per year just for outages.
In 2004, Gartner led a survey that found the average hourly cost of downtime for a mid-sized company was $42,000. They conducted the survey again in 2014 and this number had risen to $300,000 per hour. If they do the survey again next year, who knows how high this figure will have increased.
Keep in mind that this varies by industry, with financial organisations losing the highest amounts for every hour of downtime and these averages are heavily skewed by large organisations. In a recent survey of IT managers, only 20 per cent of companies had costs higher than $12,000 per hour.
Emotional Toll
Continued downtime, while affecting employee productivity, also affects morale, as when overtime is needed, this means more time away from families and their hobbies, and if this happens too often, staff will start looking for a new job.
IT failures and data loss also cause immense stress and anxiety for both business owners and employees. Cyberattacks that cause important business information to be lost, like customer details, financial information and inventory records can feel like a personal attack, especially when you’ve put so much time and effort into building your business. Disaster carries with it an emotional toll that takes a long time to recover from.
How to reduce the costs of a disaster to your business’ IT systems
So, what can you do to mitigate the risks of a disaster and protect your business? The answer is to invest in a comprehensive IT support plan that includes disaster recovery and business continuity. This type of plan can help ensure that your critical systems are backed up and can be restored quickly in the event of a disaster, and will help you and stakeholders understand how affected your business will be if anything occurs and also give you a path forward for how to reduce these risks.
In addition to disaster recovery, your IT support plan should include regular system maintenance, security updates and proactive monitoring to prevent issues before they occur. Partnering with an IT service provider that specialises in data security can also be a wise investment. These providers can help identify vulnerabilities in your system and implement security measures to protect your business from data loss. They can also provide ongoing support and monitoring to ensure that your systems are secure and up-to-date.
It’s also important to educate your employees about data security and implement security measures such as firewalls, antivirus software and multi-factor authentication, as well as by implementing the Australian Government’s recommended Essential Eight Cyber Security measures. By investing in a comprehensive IT support plan, you can help minimise the risk of a disaster and protect your business from the potentially catastrophic costs of an IT failure.
There’s no point in pretending your IT systems will never fail. Over the years of using a personal computer, we all know that’s not possible, and this is the same for IT systems in business landscapes. No organisation will experience no downtime, but as long as practices are followed that keep downtime to a minimum, then you can feel reassured that everything will be okay in the long run.
An IT service provider can be monumental in helping with preventing risks from occurring within your business. Your business probably already has one, but make sure you’re constantly keeping in communication with them to ensure they’re properly looking after your business’ interests.
If your business is not with a provider or you’re looking to switch, give us at Pronet a call to see if we’re the right fit for you.
Problems you might find working with Pronet Technology
While a strange topic to discuss as a business, ensuring your SME is properly informed about our services is crucial to our interests.
Problems
Size
Pronet Technology is an established Managed Service Provider, not a one-man or enterprise-level MSP. This may or may not suit your business needs so it is essential to understand how each size works and what you will be receiving with each.
Ad-hoc IT Support: Involves hiring a technician or consultant on an as-needed basis to address specific IT issues. This can be a cost-effective option for SMEs with limited IT needs, but it may not provide the support or expertise required for more complex systems or ongoing maintenance.
Established MSP: Larger than one-man ad-hoc IT support service but not as large as ones dealing with over 200 or 300 computers, established MSPs typically provide a range of IT services and support such as help desk support, network management and security services. Established MSPs are on par with large MSPs in terms of their services, resources, expertise and cost, they just have a smaller team and typically work with small and medium-sized businesses rather than larger ones.
Enterprise-level MSP: Large MSPs typically have broader resources and expertise than smaller MSPs and may offer 24/7 support, comprehensive IT solutions due to hiring niche employees — an SAP expert, for example — and greater scalability, however, they may also have higher long-term costs due to their industry technology standards and sales-focused approach, and less personalised service.
Working with Tech Staff
When dealing with IT problems in your business, one concern you might have is that the tech staff you’re dealing with might not answer your questions in ways you completely understand. Tech staff are very technologically minded and are not as eloquent with their words when speaking with those who are not so. You may have faced situations in the past where you have felt as though you were being talked down to with all the technical jargon and have left the conversation feeling even more confused than you entered it. While this is quite stereotypical, many tech staff are often quite introverted also, meaning when you do talk to them, you find you’re not quite getting all the answers you need. While not the case with Pronet, if your IT support is outsourced overseas, you also might come across heavy accents and different explanations due to colloquialisms and cultural words used.
For this reason, Pronet Technology hires by motivation, eagerness to learn and positivity. We believe that, while a technical education is essential, skills can be learned but it is the attitude of the individual that makes an employee valuable. This is our way of ensuring our IT staff can work effectively with clients while also fixing the issues you need fixing.
24/7 Support
In our over 20 years of working in the industry, we have found that most small and medium-sized businesses don’t need 24/7 support. Even clients with busy Christmas periods rarely need emergency support, but that’s not to say it’s not for you.
Even then, after-hours support is usually outsourced overseas, such as in the Philippines. MSP tech staff are either Level 2 or 3 trained whereas outsourced are mostly Level 1, so when you have an after-hours emergency, they don’t have the training required to help. This means they then need to call a local Level 2 or 3 trained staff member to come out who they may not be able to get in contact with as they’re asleep.
For that reason, Pronet Technology offers after-hours emergency support over the weekend and between 6:45am and 10:30pm to cover the early start by manufacturers and the occasional after-hours work by staff. As long as the issue gets solved quickly the following day, it’s generally not a big deal.
As one of our clients said:
“If you’re a manufacturing facility, in reality, does 24 hours really matter?”
If your current provider offers 24/7 support, it is worth asking what level those support staff are trained to see if you’re getting value from the service.
Website Security
A question to ask your MSP is ‘Do you deal with website security.’ While on our Platinum Plan, we offer website hosting and website management services, Pronet Technology doesn’t directly deal with website publishing and design. Passwords and network security are areas we work with, so this is often looked after, but website design and copywriting are often outsourced so the onus is on those working on the site to have secure networks. As a website is a function of marketing and sales, it’s best to leave this to professionals who know what they are doing
As a business owner or executive in charge of growing the company and its IT systems, it is necessary to know the pros and cons of IT providers before signing contracts. We hope this has answered any questions or lingering fears you had about our services, but if not, contact us at the number above to have a chat to see how we can help.
Multi or Two-Factor Authentication (2FA) is an incredibly effective way to prevent cybercriminals from accessing your business’ systems, services or applications. We’re all accustomed to the standard username and password model, but 2FA requires users to present two or more different pieces of evidence when logging into their accounts.
These can be things like a username and password (something you know), authorisation through a multi-factor authentication application (something you have) or a fingerprint (something you are). In an everyday scenario, while PayPass has made it obsolete, except for withdrawing money, when making a purchase, you used to need a bank card (something you have) and a pin (something you know).
While there is some highly advanced new tech that can overcome 2FA, by requiring two factors for authentication, 2FA makes it much more difficult for cybercriminals to gain unauthorised access to sensitive data and systems, even if they have obtained the user’s password through a phishing attack or other means.
Other than 2FA software that your business can use on your network, like Windows Hello, oftentimes, third-party vendors also have an option for this service to be used. Make sure to go into settings to set this up or contact the vendor to ask how.
When should Multi-Factor Authentication be implemented?
As an SME, you may not think that you have valuable data or assets that are worth protecting. However, any business that collects customer data, such as names, addresses and credit card information, is at risk of a data breach. In addition, if your business has any proprietary information or trade secrets, such as manufacturing processes or customer lists, you could be at risk of industrial espionage. Even if you don’t believe your data is worth protecting, the mere risk of a cyberattack interrupting your business operations is worth considering.
Some older, legacy systems may not support multi-factor authentication and even though it adds another step for employees and therefore, an added inconvenience, 2FA must be added to your business’ operations, even more so since it’s one of the Essential Eight Cyber Security strategies. It becomes important when performing work-related activities like remote access solutions, users performing privileged actions and when staff access important data. As mentioned, it provides a way to securely authenticate the user. If the first form of defence is breached, like a PIN (personal identification number), password or passphrase, then the attacker is unable to progress further as they don’t have the second.
Depending on what maturity level of Essential Eight your business is aiming for, how you implement two-factor authentication can differ.
At Maturity Level One, the authentication methods used must not be of the same class — something staff know, something they have or something they are — and one doesn’t have to be a memorised secret. If you’re only now implementing multi-factor authentication and need to be at a higher maturity level, it might be easier to simply use a higher form of 2FA as mentioned below.
At Maturity Level Two, the authentication methods that can be used, and in what combination, are restricted. Some acceptable multi-factor authentication implementations can include something users have (like a single-factor one-time PIN device or a single-factor cryptographic (a way of protecting information and communications through codes) software/device) or something staff have that is unlocked by something they know or are (multi-factor OTP device or multi-factor cryptographic software/device). Biometrics, like fingerprint or retina scanning, are not acceptable at this level. At this level, event logs for multi-factor authentication should also be collected and stored to help with incident response.
At Maturity Level Three, all staff accessing important data must be using multi-factor authentication. The types and combinations of 2FA are restricted, such as through cryptographically verifying what they are authenticating. Cybercriminals try to get around multi-factor authentication by stealing authentication requirements to impersonate staff, so organisations are to use multi-factor authentication solutions that are resistant to phishing, like security keys, smartcards or a Trusted Platform Module. Businesses are not to use push notifications or SMS codes as authentication methods as these are often used by adversaries.
How to Implement Two-Factor Authentication for SMEs
Implementing 2FA may sound complicated, but it is actually a straightforward process. Here are the steps you can take to implement 2FA for your SME:
Choose a 2FA solution: There are many 2FA solutions available, including hardware tokens, mobile apps, and SMS-based solutions. Choose a solution that fits your budget and needs.
Configure your 2FA solution: Once you have chosen a solution, you will need to configure it for your business. This typically involves setting up user accounts and configuring the authentication factors.
Train your employees: It is important to train your employees on how to use the 2FA solution and why it is important. This will help ensure that they understand the process and are more likely to use it consistently.
Test your 2FA solution: Before deploying 2FA to all users, it is important to test the solution to ensure that it is working correctly and does not cause any compatibility issues with your existing systems.
Roll out 2FA to all users: Once you have tested the solution, you can roll it out to all users. This typically involves providing instructions on how to use the solution and ensuring that all users are using it correctly.
To test if these measures are working, try logging on to a system or software that has the authentication set up and see if the request for two or more authentication factors, such as a password or a one-time PIN, is shown. For high levels, watch as an employee that has administrative privileges authenticates to log into a system or software to see if they are required to use multi-factor authentication. Make sure to monitor the log-ins of multiple services, as, for example, a cloud service may have a different implementation of 2FA than an on-premise service. Also, for Level Three, ask staff members to send through lists of the important data repositories in the business’ network as well as screenshots of attempting to log in to these, including the multiple forms of authentication it should be requesting. Ensure event logs of multi-factor authentication are also protected and monitored for signs of compromise and modification.
Some tips
If you’re not aiming for Maturity Level Three, then select a multi-factor authentication solution that impedes less on user functionality. Make sure to also turn off and replace old and redundant authentication systems. If you’re receiving pushback for 2FA methods, introduce policies or implement the authentication in stages across the company, starting with high-risk users. Also, have a support plan to handle failed logins and account lockouts.
Keep in mind though that Cyber Security should be a part of your business’ culture. Everyone must be on board with implementing security measures, as multi-factor authentication is just one of the eight strategies and businesses need to implement them all to a certain degree.
Types of Two-Factor Authentication
SMS Token: Sends the user a unique token, usually a 5–10-digit code, via text message after entering their username and password, and this pin is then entered to allow them access. While user-friendly and available to pretty much everyone, text messages can easily get intercepted by 3rd parties and this method relies on people having a charged phone.
Email Token: Similar to SMS Token, this method sends a 5–10 alpha-numeric token or asks you to click a link provided in the email. Once again, these are user-friendly, cheap to set up and maintain and offer both a link or token if one doesn’t work. Sometimes, emails can go to spam or fail to be delivered and these can be intercepted by criminals.
Hardware Token: A user is given a physical device, such as a key fob, USB dongle or another device that generates a token for the staff member. These tokens are usually valid for only a short time. Hardware tokens don’t require reception or internet connectivity and is reliable and secure. They can be a bit expensive to set up though, and can be misplaced and can be a bit user-unfriendly when having one for service. Examples include:
Yubico YubiKey 5
Kensington VeriMark USB
Google Titan Security Key
Software Token: Where users download and install an application on their computer or device that generates tokens for the user. These are only available for short periods before changing. These are more user-friendly, updates when needed and can be customised with different features. Some can be expensive, though, and requires users to download and install software that might be compromised without knowledge. Two-Factor Authentication is available on most applications today for no additional cost and should be enforced across these applications. A firewall can also help by enforcing 2FA for remote connections. Examples of 2FA software include:
Google Authenticator
Microsoft Authenticator
LastPass Authenticator
andOTP
Authy
Phone Call: The employee receives a phone call once logged in, which provides them with the token. This method is both easy and inconvenient but is cheap and reliable due to requiring less bandwidth than data. Some negatives of this service are that phone calls can be intercepted or your voicemails can be hacked, and reception is required, as well as actually needing a phone.
Biometric Verification: Relies on the user being the token through fingerprints, retina scans and voice and facial recognition. It’s also user-friendly. This does, however, raise questions about the storage of biometric data and privacy concerns, and storage locations can be compromised. It also requires specific hardware, like cameras and scanners.
Implementing two-factor authentication is a simple and effective way to improve your SME’s Cyber Security posture. By requiring two authentication factors, 2FA makes it much more difficult for cybercriminals to gain unauthorised access to your sensitive data and systems.
If you have any questions or would like help implementing 2FA for your SME, please don’t hesitate to contact us. Our team of expert technicians specialising in Cyber Security can help you choose the right solution and ensure that it is configured correctly for your business.
Get A Full IT System Assessment
Identify key problems & critical improvements to your systems
Locate security loopholes & lock down vulnerabilities
Conducted by fully certified Microsoft Engineers
Call 03 9069 2188
Or fill out the form below and we'll call you back straight away!
All our services are underpinned by our 100% Service Level Guarantee, so the onus is on us to perform and provide you with better service and support for a lower total cost. If we don’t perform well, it’s us who pays, not you!
99.9% Guaranteed system uptime
Fast, 15-minute response
All your IT needs under one roof
WARNING: Telemarketers have been posing as Pronet & calling individuals/organisations to sell
website and domain hosting services.
Pronet Technology ensures that we DO NOT contact businesses or individuals to offer these products.
If this has happened to you we apologise and encourage you to email info@pronet.com.au so we can prevent the issue.
