Episode 20: If your MSP is hacked you're screwed

Speaker 0 00:00 Made in the UK for MSPs around the world leases, pool greens, MSP marketing podcast. Speaker 1 00:09 Hello and welcome to episode 20 here's what's coming up in this week's show. Speaker 2 00:13 We can't Bundy around those types of terms. Not knowing whether or not the receiver of our message really understands what it is that we're trying to say. Speaker 1 00:22 We're also going to be talking about a great tool that will help your clients and prospects to self identify if they need phishing training and we've got a question from an MSP about how to build trust with prospects Speaker 0 00:35 for Green's MSP marketing podcast. Speaker 1 00:38 I think one of the scariest things you can talk to any MSP about is the prospect of you being hacked. I mean, could you just imagine how business ending it would be if you got hacked and through you the hackers access to your clients. There's virtually no way back from that. I'm [email protected] but from February and the headline is I'm selling access to an MSP, have three vendors, teams to foil hacking plot, and you've probably heard about this. It's how data Huntress labs and ConnectWise found an MSPs access credentials up for sale on the dark web and they work together to find the suspect and the suspect was arrested, which is absolutely great, but maybe it's the thing that keeps you up at night. I had this discussion a few weeks ago with my MSP masterminders. These are small groups of noncompeting MSPs. We meet in the UK and we meet once a month and we sit around a table and we talk about everything that grows the business and we talk about things that get in the way of growing the business. Speaker 1 01:35 And the fear of being hacked is such a huge one that we came up with a bit of a mini list of things that you could do to secure your RMM, for example. So simple things like enabling multifactor authentication and of course making sure that that MFA is not email based. And of course it's not text-based because of course SIM jacking is very much a thing. We talked about things like removing the ability for someone to click on, I forgot my password because if they've breached one of your staff's email accounts and someone could go and click on, forget my password and reset the password link. We discussed that instead of having a couple of admins with the ability to manually reset passwords when required would be a better thing. We discussed removing things like trust this device capabilities. Even me, a layman who's not a tech has looked at, I think it's zero. Speaker 1 02:23 The accounting software system is you want to trust this device for 14 days and even I am thinking no because what if I lose the laptop? Whereas if I have to generate a code every single time I log in, that seems safer. We talked about forcing stricter password requirements even on your staff using random password generators. Of course using passwords management tools, at least minimum 12 character mixed passwords or using pass phrases or sentences. Some of the other more technical things that my masterminders discussed were setting IP restrictions for host access in admin, which apparently is done through the admin console. We still have to be careful if you locked out of your RMM on that. But the point being that there's lots of things that you can do within your business and actually all of those things that we've just been talking about there aren't they? Speaker 1 03:08 The things that you would want your clients to do. There is a concept and you'll have heard it, it comes out of Apple, but when Steve jobs was running it the second time around, which is do you drink your own Koolaid? And the goal with the first iPhone and with the iPod son with the max was that those computers had to be, and those phones had to be good enough. The Apple could use them every single day, you know, as their main devices. You know, you think about 15 years ago they wouldn't have actually used their own devices because they just weren't good enough. So do you drink your own data security Koolaid? Have you got multifactor authentication everywhere, proper MFA? Do you remove the, forget my password and trust this device capabilities, you recommend it to your clients. Okay. Some of them ignore it, but are you doing it within your own business? Speaker 1 03:54 I would say as a series of basic things that you should do, you should just do those things. In fact, you should be telling your clients that you've done those things and you should be recommending it as your standard best practice data security checklist. Maybe even you'd put one together and you'd say to your clients that we've got this basics checklist for data security. This is what we do. We run through this with every single one of our devices, every single one of our staff. We highly recommend you do the same because when someone sees their supplier, their trusted partner doing something and it's the same things that they recommend that they do for them so that the seller, the vendor is doing the same things as the client is. That engender is a huge amount of trust and an enormous amount of Goodwill, so this isn't just good for security. Speaker 1 04:38 This is actually good for marketing and sales as well. Here's this week's clever idea. They're kind of on the same vein. I'm sure you've recommended to many of your clients that they have phishing training where the you buy and resell the one that's bundled into ID agent or continuum or of course there's no before. There's loads of phishing training out there so you don't have to physically go on site and do it. But of course clients go now we don't need that. We wouldn't make that mistake. Well now there's a tool that you can use. In fact, you can embed it into your website to show them whether or not they actually need to do some fishing training. It's a website we found called fishing box.com and if you go to fishing box.com forward slash fishing dash IQ dash test and we'll put that URL into the show notes on my website. Speaker 1 05:25 So I'm just on that website now and I'm looking at it and it says, is the image below of a really mail or a phishing email? It says it's from QuickBooks. I'm just looking at the domain name. Do not reply. quickbooks.com and it's about recent changes to your credit card. Um, yeah, that looks all right. So I'm gonna Mark that as a really, now, uh, the next one we've got is the image Clover, really mellow or phishing email. And we've got the same on here to this one since it's from Wells Fargo, but it's got a, ah, it's got a secure mail attachment, but the word attachment that's been spelled wrong. So I'm going to Mark that as a phishing email and it looks like I'm 20% completed. So it looks like there are 10 questions in this. It's quite clever because it's making me have a look at it. Speaker 1 06:04 So this next one from the email address, no [email protected]. So I'm going to say that, that say a phishing email, be really interesting to see what score I get out of this. Anyway, this is a service that you can buy from fishing box and I believe that you can embed this into your website. And I'm just having a look on the pricing and for a single company, you know, it's not a huge amounts of money. Um, so clearly you can, you can sell this training, but the fact that you can embed that test into your website and actually use that as a way to show your clients you're not as good at fishing as you think you are. So often it's the person at the top who tends to be a little bit more rubbish at fishing than some of the staff, but certainly a tool like this is a good way for them just to see how good or bad they are as an organization, which is going to help you to actually sell some phishing training pools, blatant plug, and surprisingly this week my blatant plug isn't going to cost you any money because it's something that I would like to give to you. Speaker 1 07:00 You see, a couple of years ago I wrote a book, it's called updating servers doesn't grow your business and as the title suggests, it's about the need to work on the business rather than in the business. In fact, it contains within a whole series of suggestions, a whole bunch of advice, a whole load of marketing ideas for you to grow your MSP. Now this is a physical print book. I had 5,000 printed in the UK and we're going to weigh around about 1800 of those so far. And the big news is we've just had some printed in the United States as well because we all know that no one ever really reads PDs. They just sit on laptops. So we've been sending PDFs to the States for the last year and now we've actually got physical print copies that have been printed somewhere just outside of New York city and we are posting those around the U S as well. So if you want to just go onto my website, you go onto Paul greens MSP marketing.com and right there on the homepage there are details of how you can get a free copy of my book. Updating servers doesn't grow your business. Go on, go and get your free copy now. Big interview. Speaker 2 08:01 Hi, I'm Tracy <inaudible> and I run a business and own a business called <inaudible>, which is all services around it and tech. But my background is, I've been in the it industry for 35 years. I sit on the board of directors for <inaudible> worldwide and I'm also part of the Comcare executive council here in the UK. So I do a lot of work in and around the channel as well as with end users. Speaker 1 08:26 And I want to talk to you today, Tracy, about how difficult it is for most MSPs to look at their business from the decision makers point of view. And yet that's a critical skill that we have to develop. Isn't it Speaker 2 08:36 eight a is absolutely. I in today's world, um, end users decision, Mike is a much more informed back technology than they ever have been in the past. Now you want to know that the suppliers and the people that they work with understand that business, not just the technology that supports it, but understand that business their industry. And that's quite a hard thing to do for managed service providers because they'll be looking after lots of different organizations and lots of different industries. So they're going to have to become more chameleon-like, um, for want of a better phrase in being able to use other industries, language and terminology and really understand what technology means for the end user business. Speaker 1 09:21 But doing this in a way where you're not using jargon. I mean we know that even the word the cloud is jargon to people outside of our world because the cloud can mean lots of, lots of different things to them. What are the, some of the things that you see MSPs doing, which, which almost moves them further away from a sale rather than moving them closer? Speaker 2 09:39 Ah, that's a really good question. I'm still talking about technology is really disengaging from an end user's perspective. They don't want to know that they need a such and such router or they need this speed of broadband. What they want to know is that they've got continuous protected, um, connection to the internet and they want that in their own words so that it means something to them within their business. So you can't use jargon in any way, shape, or form, as you said. You know, people talk about the cloud, people outside of the it industry have a different perception of what the cloud is. Some people understand that, some people don't. But we can't Bundy around those types of terms. Not knowing whether or not the receiver of our message really understand what it is that we're trying to say. What are the pain points and then on juices, business and addressing those pain points. So eight people want to feel secure, they want peace of mind, they want to know that the technology that they are in bath again is actually done to help move that business forward. Or it's going to help them avoid a painful situation. So you need to talk about what that pain is, not what the technology is that sits behind it Speaker 1 10:53 and what's the most effective way to gain access to their pain points. So how do you understand their business when, as you say, there are hundreds, thousands of different types of businesses out there? Speaker 2 11:03 There are, I mean the rest of the generic clapping apply across all businesses. So all businesses have to sell. They need to knock it. They either have products or services, they'll help internal admin, they'll find stuff and they'll need to account for it. So understanding the basic principles of how businesses work gives you that common ground, but it's having conversations at that business level that are more strategic. So being able to talk to somebody who runs finance. It could be the owner manager, it could be a finance manager, it could be somebody who isn't from the industry that their business is from. But being able to talk on common terms. So talking about profit and loss, talking about balance sheets. And I know that can sound a little bit off putting because then they must be, might think, well what do I know about that? Speaker 2 11:54 But this is as a business, the MSP also needs to understand the balance sheet and the profit and loss and financials and how they work. So it's finding opportunities to share that common ground. But being inquisitive. And lots of people, I know her in tech, they like to learn. So being able to learn about another industry is as fulfilling as learning about the technology that can be supplied into that industry as well. You know, MSP, they have help desk staff, they have engineers who might go out on site. They are great salespeople because they're not seen as a sales person. So they're not seen as threatening, which means that people will talk to them about what those pain points are, what's going wrong. And if you can teach your staff to listen out for warning bells so that somebody might be struggling because they're not using technology properly, they aren't great leads then. Speaker 1 12:49 So how would you train your staff to, to look for those, bearing in mind that your staff are technical and are inclined to sell great things. From a technical point of view, what's the most effective training that you've come across? Speaker 2 13:00 Anything to do with customer experience? And I'd have to say 2020 seems that to be the year of customer experience and there is a lot of training that's been developed around that. So a lot of vendors will run training programs around how to improve customer experience. Distribution is changing and a lot of distributors and are adding sort of the soft skills to their training programs. So it's not just about the product, but it's also about how do you deliver a good service. So I'd start with vendors. I'd start with distribution, um, and Google, you know, good old Google. There are so much information, it's a wealth of knowledge about what represents good customer experience, what doesn't for people to learn from and apply that within their business. So I'd have a culture of customer experience within an MSP practice too. It's not just doing it because somebody said it. It's the right thing to do. Or because it's the current Vogue, it's doing it because actually as a business, you want to give a good customer experience and you want your end users to be sticky and to recommend you to other clients. Speaker 1 14:10 Tracy, thank you. What's the best way for us to learn a little bit more about you and get in touch? Speaker 2 14:14 Uh, LinkedIn is probably the best first point of call. Um, you can look to me Tracy pounds on LinkedIn or my website, which is <inaudible> dot co dot. UK boss max, I M I T Speaker 1 14:29 Green's MSP marketing podcast. Ask Paul anything. Hi, this is rapid Jim Goshen from Triana networks. How do you build trust with prospects? All that really is a great question. Thank you very much Rafi. It is so important to build that trust with prospects because the sales cycle is very long. One for MSPs and prospects come into, it's almost a suspects. They're suspicious technology is a massive thing to them. They don't understand it. They don't really like the idea of being so reliant on technology, but they are and they know that choosing the wrong MSP could utterly devastate their business and for that reason, the better the relationship you have with them, the more likely you are to sell to them. I believe there are two distinct phases of someone being a prospect in two distinct ways to build relationships with them. So the first distinct phase is before they've made that decision that it is time to switch from one MSP to another one. Speaker 1 15:23 So at this stage, there may be some level of dissatisfaction. They may be doubts in their mind, but they're not yet at that point that we're going to take action. But this is, this is the point at which you want to get to know someone. This is the point. You want to get them to join your audiences. That's to join you on LinkedIn, be connected to you there to be connected to you on Facebook, maybe to join your email list. And if you go back over previous additions to this podcast, we talk about all these things and how to grow these audiences. This is the point to do more and more content marketing. So to put more of your stuff in front of them, that's daily posts on LinkedIn and thought leadership is a great thing. You know, you taking technology and translating it for them. Speaker 1 16:03 Uh, it's about more articles onto your blog. It's about videos on your Facebook. Uh, it's about sending out a weekly or even twice weekly email to your email list. Cause all of this stuff is what builds a relationship with prospects before the point at which they're ready to have a conversation with you. In fact, we call this one to many cause it's you or someone on your behalf doing all of this stuff and you can send it out to potentially thousands of people using the tools like your CRM and LinkedIn and scheduling stuff with HootSweet and things like that. So it's one to many at this stage and you won't need thousands in your in your prospect list. For most MSPs, just having 500 prospects are that content marketing stage is enough, but then it changes the point at which you actually start a conversation with someone and they have entered the phase of looking for an alternative supplier. Speaker 1 16:53 The relationship needs to change because now you can't do one to many. Now you need to do one on one and this is where things like impact boxes, which we talked about in the podcast a few weeks ago, which is a box of physical stuff. That's a great way to build a relationship with someone. Sending them stuff by direct mail is great. You know, literally right down to printing off an article that you've seen on the web that you think would be of interest to them because it's relevant to them in their situation and posting it to them. Yes, I know you could email it to them, but posting it to them will have a greater impact and of course there is the person relationship as well. There's sitting, meeting with them, having conversations, talking about their business. You should be talking more about their business than your business. Speaker 1 17:32 It's building that relationship. The key thing to remember is that people buy from people and before they're ready to actually start to make that buying decision. It's okay to hide behind email platforms and social media platforms and all that kind of stuff, but at that point they're looking to do the switch that's, you've got to roll out the people. It's got to be senior people, they've got to be likable and you've got to give the prospect's time. Some prospects make fast decisions, some of them make very slow decisions. One of my MSP masterminders recently told me it took them 18 months to get through this stage with a client, 18 months to win one client because that was the speed the client was working at. But it was a big contract and they've won it for three years and we all know they'll probably keep it for 10 years. Speaker 1 18:15 So it is worth doing. So essentially the more relationship building activity you can do with your prospects, the closer they are to making a decision, the more likely that is to pay off. What's wonderful is if you've been in business for a few years already, you already do this. The challenge is for you is to systemize this. So as your business gets bigger and even the point of which you personally stopped doing all of this and you start hiring other people to do it for you as a business, you carry on building relationships in this way. So it's not haphazard. It's not relying on people remembering to do stuff. It's a systemized process that builds relationships day in, day out without anyone having to worry whether or not it's happening, how to contribute to the show. I'd love to know what you thought about today's show. Why don't you drop me an email? It's [email protected] coming up next week. How can they look up extracting sales in the business so that business is actually worth more without them? That's Richard Tubb. He's an it growth expert and he'll be here on next week's show to tell you exactly how much your MSP is worth if you were to put it up for sale tomorrow. We're also going to be talking about KPIs, key performance indicators, which ones should you be tracking to make sure your business grows, and we're going to be talking about overcoming objections at sales meetings. See you next week Speaker 0 19:34 made in the UK, the MSP around the world pool greens MSP marketing podcast.