In a series of three blogs, we’re going to look in detail at the steps we’re taking to protect N-able, you, and your customers as one part of a greater, worldwide software supply chain.

A common cliché in cybersecurity is, it’s not a question of if you get attacked, but when. We witnessed this firsthand when our former parent company was part of a major attack last year. While N-able products weren’t affected, it was difficult to watch friends and colleagues deal with the aftermath of an event of that magnitude.

There’s not much we can say about it that isn’t public record, but we want to address how it changed our outlook, and what we’re doing to help protect ourselves, you, and your customers.

Risk has changed

We’re playing a different game these days. It’s not just our former parent company—other major tech companies were part of the same breach. And other MSP vendors recently faced down major breaches as well. We saw the gas pipeline in the southeast United States shut down for days over a breached password.

It’s a trend—large-scale attacks continue proliferating to devastating effects.

These are only the attacks that make the news. Each day, small businesses get hit. Some may come from cybercriminal gangs or from individuals purchasing malware off the dark web, but today’s cybercriminals share resources and run like businesses. This puts everyone at risk—serious risk.

It comes down to this: we’re all part of the supply chain, and we must think about ourselves this way. We cannot think of ourselves as separate. Even though larger vendors make news, smaller companies can get hit with variations on those same attacks.

In the physical world, businesses can get robbed at any minute. Banks have higher levels of security—from alarm systems on the doors to emergency buttons that automatically call police under tellers’ desks—because they keep so much cash on hand, making them high-value targets. Retail stores often lack this level of security due to lower levels of risk. Many convenience stores open later at night—or in areas where crime remains high—have high levels of security due to a lower barrier of an attack, like cages or bulletproof glass between the cashier and customers.

Cybercriminals now have numerous advantage. First, they can attack businesses that don’t have cash on hand, like a medical office or a tech company. These are both high-value targets because of their access financial and data information. Second, the barrier to entry is lower due to the malware-as-a-service trend, where cybercriminals resell their malware to others who lack the hacking skills. Third, they can often get away with it more easily because they are able to hide their tracks by deleting logs or even showing up at the business if they’re in another country (leading to jurisdictional issues that can turn crime into a profit). Plus, cryptocurrencies hide transactions well enough that criminals can further prevent their identities from becoming public.

All this means we’re facing new levels of business risk, and companies need to make sure to tackle it accordingly.

What we’re doing to help

Over the next few blogs, we’ll go into greater depth on how we’re protecting the broader supply chain, from our own infrastructure and products to you and your customers. For now, let’s cover the broad strokes.

• Offering a wide range of integrated products: Your customers need protection at multiple layers—from the data layer up to the internet layer. They also need help at all stages of an attack, from prevention and discovery to investigation and recovery. We offer a broad portfolio of top-of-the-line products that tackle today’s toughest threats and have worked to integrate them where possible. This can help simplify a lot of the process of delivering security. Even with sophisticated attacks, you can still stop many—if not most—threats without needing a full SOC or becoming a full-blown MSSP. Yes, major risks will still exist, but the right layers can still take you far.
• Building with security in mind: We design our products for security before we write a single line of code. From training developers on the latest attack patterns and vectors to scanning code both while running and at rest, we work to minimize potential vulnerabilities slipping into the codebase.
• Protecting our infrastructure: We also protect the underlying foundation that powers and runs our products. From 24/7, global third-party monitoring to regular employee security trainings and wargames, we put multiple safeguards in place to keep cybercriminals from getting into our systems and potentially harming you or your customers.

Protecting the full risk cycle

Cybercriminals have evolved, so we all need to think about risk differently. Today’s sophisticated attack becomes tomorrow’s commonplace as it gets resold on the dark web to criminals who often don’t even need hacking skills to turn a profit.

As we witnessed the storm taking place, our outlook changed. We have always emphasized security, but seeing the effects of something that large—and more importantly what could have happened had it been worse—really affected us.

We fortified areas that were already strong and enhanced our security programs where we could. Over the next few blogs, we’ll cover in more detail the steps we’re taking to protect N-able, you, and your customers as one part of a greater, worldwide software supply chain.