Now that working from home is more common, performing network assessments can be a challenge for managed services providers (MSPs) and value-added resellers (VARs).
Alex Quilter, Vice President, Product Strategy for SolarWinds MSP, says, “Network assessments are interesting because the term itself implies that you have access to a network. When you think about remote work and network assessments, the really interesting element is, do you even have access to someone’s home network? Most of the time you don’t, which means you can’t run a remote network scan easily.
“In this remote work world, a lot of people brought their work computers home, potentially putting company-owned data and access at risk, without you being able to easily assess what that risk might be,” he adds.
Quilter shares answers MSPs and VARs are looking for regarding the best way to continue providing this important service that gives businesses visibility and helps them to keep their networks safe.
How can a service provider conduct network assessments when their clients’ employees access the network from home?
Quilter: That’s where an agent-based assessment can come in handy. Agent-based protections give you the ability to assess a specific system, even when that system isn’t on a network you would have access to. If employees are using their own machines from home, you’d typically accomplish the assessment by having them go through a VPN. However, you’re now using that individual’s home network bandwidth to perform security assessments, and some home users won’t like that. The net-net is that network assessments in work-from-home environments can be tricky without the right tools at your disposal, and agent-based tools are becoming more important in these scenarios.
Does social distancing make it more difficult to perform them?
Quilter: In a lot of instances, assessments are done by experts, in person. For example, you might send a pen tester onsite to locations where you do not have network access, and they would connect their own equipment to the network to perform the assessment. Social distancing probably doesn’t make it more difficult to perform the actual task, but all of that changes with a home environment. It’s unlikely someone’s going to be comfortable letting someone into their home to do this kind of testing, even in a non-pandemic world. What’s more, now that the number of remote locations has drastically increased to the homes of each remote employee, that model isn’t at all scalable. Agents can act as “people” and do the job for you, which is a big part of their appeal.
With changes in the way businesses are operating, are network assessments revealing different types of issues?
Quilter: Network assessments are harder when everybody is distributed because you don’t have access to those distributed networks. However, if you did conduct an assessment of a home network, you’re going to find a whole bunch of devices that you don’t typically find in a business. For example, if someone scanned my home network right now, they’re going to find things like a Wii, a couple of TVs, my family’s phones, the security cameras, the wi-fi routers, my personal printer, etc. Personal IoT devices now co-exist on the same network as the devices needed to do business. This changes the risk profile of both the home devices and the devices used for remote work. This is where more sophisticated security assessments are coming into play to help you manage risk at the right level.
Are network assessments still trending as effective sales tools for MSPs?
Quilter: Network assessments are still important for MSPs; the difference now is that in order for the tools they use to be effective, they need to be more blended. You need both the agent approach and the network approach with the flexibility to choose the right one as needed. So, they’re just as effective as ever. It’s really more about making sure your tools provide the different ways that you need to assess systems that now live in different networks or that you’re not directly connected to.
What is the primary value that network assessments offer end users?
Quilter: With end users, they don’t know what they don’t know. So, the primary value to them is when they now have actual visibility into what’s on the network (specifically, their users’ home networks) to better understand what may be at risk. That’s even more important in this hybrid world of personal and work devices. It’s not really security. It’s not really compliance. For the end-user, it’s about reducing the chance of an attack. That’s the true benefit because cybercriminals don’t choose people; they choose targets based on how easy they are to breach. MSPs are helping by fixing the most pressing issues and following with monitoring and expanded user awareness training.
What are the main benefits to MSPs and VARS?
Quilter: The home network is no longer an edge case; it’s the standard case. That’s one of the main reasons security is one of the fastest-growing areas for IT services providers. A security assessment provides the proof point that an MSP needs to show a customer how they are being protected. It’s no longer about just “not having anything bad happen.” It’s about showing the value of continuous security monitoring for known risk and exposure that prevents their customers from being easy targets.
This is one of the key focuses we have at SolarWinds MSP, to help our MSP partners add value for their customers by giving them deeper insights, building longer-term security relationships, and navigating work-from-home as the new normal. With tools that show key patterns of risk and improvements, the MSP can say, “Look, we found and resolved these issues last month; we plan to resolve these additional issues this month and will check for any new issues; each month, we can make you safer.” Security is transforming into something more tangible and real for businesses, and MSPs are making that happen. 
