I run an IT company, and I think you should be asking us harder questions. Your IT provider can usually get into every computer you own, any time. Would you ask them to prove how they protect those keys, or just trust them?
What this means in plain English
Most small businesses hand their computers to an outside IT company, often called a managed service provider. To do the job, that company installs remote access tools on your machines and keeps admin accounts that can get into your network from their office.
That's convenient for you. It's also convenient for criminals. If they break into one IT company, they don't have to break into its clients one at a time. They can walk in through the same door the IT company uses. This week's emergency fix to N-able N-central, a remote management tool many IT companies use, is the latest reminder of how much rides on those tools.
Why a small business should care
This isn't a new worry. In May 2022, Canada's cyber agency (the Canadian Centre for Cyber Security) put out a joint warning with its counterparts in the US, UK, Australia and New Zealand. It said criminals and government-backed hackers were going after IT providers specifically because of the trusted access those providers have to their customers. Once inside, they can spread ransomware or quietly steal data from many businesses at once.
For a small manufacturer or office, that means a problem you didn't cause could still shut down your shop floor or leak your client files.
The other side
You hired an IT company so you wouldn't have to think about this. A list of security questions can feel like doing their job for them, and it can feel rude, like asking your accountant whether they lock the office at night. Plenty of good IT providers do all of this without being asked.
Where I land
Ask anyway. A good provider should be able to answer in plain words in a few minutes. If yours can't, or gets defensive, that tells you something. I'd rather my own clients ask me than assume.
What to do: everyone
Find out which tools your IT provider uses to get into your computers.
Ask whether every one of their accounts that can reach your network needs a second sign-in step, like a code on a phone.
If you ever see a remote session on your screen that nobody told you about, tell your IT provider right away.
What to do: if you run the business
The 2022 warning's advice for customers starts with the contract. Write down what security your IT provider is responsible for, and how quickly they'll tell you if something goes wrong on their side. It also recommends limiting the IT provider's accounts to what they actually need, keeping backups you can get back quickly, and shutting off their access if you ever switch providers. That last one gets forgotten more than you'd think.
Questions to ask your IT provider
Which tools can reach our computers remotely, and who on your team can use them?
Do all of your accounts that touch our network need a second sign-in step?
If you were breached, how fast would you tell us, and is that in our contract?
When did you last test restoring our backups?
Sources
CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers
BleepingComputer: N-able releases security hotfixes for zero-day vulnerabilities
So which is it for your office: ask for proof, or trust?
Tell me where you land on LinkedIn or X.
Contact Nautalex to see how we can help you with checking how your IT provider protects your business.
