Mastering vulnerability management: A practical guide for MSPs

In Part 1 of our two-part series on vulnerability scanning and penetration testing, we explored these tools’ core differences and implementation strategies. In Part 2, ASCII Group members Angel Rojas Jr., president and CEO of DataCorps Technology Solutions, and Felicia King, CTO/CISO of QPC Security, delve deeper into the operational aspects that MSPs must master to provide robust security solutions.

Reporting and alerting capabilities: Delivering actionable insights

Effective reporting is crucial for demonstrating value and driving remediation. Rojas emphasizes the need for:

• Customizable reporting: “The ideal tools offer customizable reporting that caters to both executives and technical teams.”
• Real-time alerts: “These are needed for critical vulnerabilities or deviations from the established baseline.”
• Compliance-specific reporting: “E.g., PCI-DSS, NIST, HIPAA.”
• Remediation guidance: “This includes actionable steps for resolution, ranked by business impact and risk level.”

King adds that “Summary views and full detail exports are mandatory. The summary view is intended for oversight personnel such as executives and compliance managers to quickly assess how compliant assets are with policy. The summary reports are insufficient for legal attestation proof, which must include full details on a per-asset basis. Both types of reports should automatically be published to the attestation platform or governance, risk and compliance (GRC) framework without the requirement for human upload, which would deem the data as possibly being tampered with before upload. Few systems achieve this level of quality.”

Continuous monitoring and real-time threat detection

Continuous monitoring is essential for maintaining a consistent security posture. Rojas explains, “Continuous monitoring involves periodic or event-driven scans to maintain a consistent baseline of known vulnerabilities. Many tools connect to real-time threat intelligence feeds, allowing them to detect and assess new vulnerabilities as they emerge. Integrating SIEMs or behavioral monitoring tools enables these processes to extend beyond detection, providing insights into active exploitation attempts or anomalies in real time.”

King cautions against the misnomer of “continuous” scanning, stating that it can lead to performance issues. Instead, she recommends scheduled scans for high-exposure systems and daily secure configuration management. “Continuous is a misnomer because a network or public-facing resource (website) that is continually scanned may be overwhelmed. The same could be said for an endpoint that’s continuously scanned. ‘Continuous’ would likely be seen as a denial of service. Instead, vulnerabilities on high-exposure systems such as end user computing devices should be scanned at least once every 24 hours. Networks should be scanned when they are most likely to find issues, which inherently means avoiding scanning at midnight when many systems are offline. Secure configuration management should be done daily through human discipline and policy-based enforcement technology.”

Support and training for MSPs: Building expertise

Vendors should provide comprehensive support and training to ensure effective tool utilization. Rojas suggests:

• Initial onboarding and setup support.
• Ongoing training on interpreting results and developing remediation plans.
• Access to certifications, webinars, and knowledge bases.
• Technical support for troubleshooting complex issues.

King notes, “I am unaware of training classes on managing vulnerabilities or engaging in secure configuration management competently. Training is available on how to use a product, but that assumes that the person receiving the training is being provided a set of policies and governance structure to guide them.” She stresses the importance of experienced IT leadership and recommends exploring resources like QPC’s podcasts on vulnerability management.

Real-world examples and case studies: Demonstrating impact

Rojas shares an example of a financial services client who avoided a ransomware attack due to a timely vulnerability scan and penetration test. “One of our financial services clients had an exposed remote desktop protocol (RDP) vulnerability identified through a routine vulnerability scan. A subsequent penetration test confirmed that attackers could exploit this weakness to gain access. We immediately worked with the client to patch the issue and restrict RDP access using firewall rules. This proactive approach prevented what could have been a major ransomware attack, saving them significant downtime and potential financial losses.”

King notes that many breaches involve email and website browsing vectors, emphasizing the importance of secure browser configurations and patch management. “The majority of breaches occur through an email/website browsing vector. Many involve browser software configuration or unpatched vulnerabilities. Some involve vulnerabilities in secure configuration management of cloud assets such as a Microsoft 365 tenant.”

The do’s and don’ts of monetizing vulnerability management services

Rojas offers these monetization tips:

• Do: “Bundle vulnerability scanning and penetration testing into comprehensive security offerings, emphasizing continuous improvement. Highlight value with real-world scenarios that show how the processes prevent costly breaches. Educate clients on the importance of both automated and manual testing as part of a proactive security strategy. Use baseline automated pen tests to complement manual testing and demonstrate quick wins. Report regularly on the business value provided.”
• Don’t: “Don’t treat vulnerability scans as one-time tasks. Continuous monitoring is essential for long-term security. Don’t deliver reports without offering business value, actionable guidance, and follow-up remediation services. Don’t downplay the importance of human expertise in pen testing, especially for complex environments. Automation can’t replace skilled professionals when identifying sophisticated risks.”

King, concurs, adding the following do’s and don’ts:

• Do: “Require clients to have written policies for vulnerability management, secure configuration management, and penetration testing. Do require clients to obtain your written authorization for any penetration test performed by a party other than your company. Do require the client to provide the MSP with the results of any penetration test or external assessment. Use a secure configuration management tool like Senteon to produce the compliance reports. Do ensure that you have a system for compliance attestation regardless of whether the client has a GRC or not.”
• Don’t: “Do not lead clients to believe that simply monitoring Windows Update status is sufficient. Do not configure exceptions for penetration testing.”

Building a successful vulnerability management practice

By mastering reporting, continuous monitoring, and training, MSPs can build a successful vulnerability management practice. Emphasize the importance of real-world examples and follow expert advice on monetizing these services. MSPs can strengthen client relationships and drive business growth by providing comprehensive and practical solutions.

About The ASCII Group, Inc.

Founded in 1984, The ASCII Group is the original IT community of the channel, uniting MSPs across North America. As a vendor-neutral organization, ASCII provides unbiased resources and a collaborative environment to support business growth. Members span the U.S. and Canada, ranging from SMB-focused MSPs to international solution providers. ASCII offers leveraged purchasing programs, education, marketing support, peer networking, and more, complemented by a vibrant ecosystem of technology vendors. Learn more at www.ascii.com.