|
Reminder: Procedures To Keep You Safe
A large part of our business as an MSP/IT services partner has become cybersecurity. In particular, this has been the primary focus of much IT development and budgets over the past few years. While we’re here to help you and keep you secure, we wanted to send a reminder about why some requests may require additional and possible written confirmation.
As the ones who have to make and adjust security policies, IT providers like ourselves are prime targets for a bad actor who want to attempt to breach an account or an employee potentially looking to stir up some trouble. Requests such as releasing administrator account credentials, upgrading user access levels, or granting one user access to another’s email/files may appear (and often are) routine, but these moves could carry security concerns if they are not requested by an authorized party. A single privilege escalation could expose sensitive data, intellectual property, or regulated information.
Attackers frequently impersonate executives, finance staff, or even IT personnel to exploit rushed processes or informal approvals. Without strict verification and documented double-check procedures where appropriate, that risk could go unchecked. It's not much different than when you get an email appearing to come from a superior asking for gift cards and other favors where you need to double-check/verify rather than just jumping into it because of who supposedly sent the request.
While it’s nothing new, we did want to re-enforce our layered verification for requests like this which dramatically reduces those risks. Double-checks create friction in the exact places attackers rely on speed and urgency. While it may sometimes be a bit of an annoyance, as an IT partner entrusted with privileged access and with helping to protect your networks, these more disciplined approval workflows are meant to protect our partners security.
| 
