ConnectWise’s top security executive believes the Tampa, Florida-based maker of IT management software has “some work to do on the education side,” after patching a critical flaw in October in the ConnectWise R1Soft server that could have infected 5,000 servers.
“The biggest lesson learned is we had some hiccups on how it came in the front door,” ConnectWise Chief Information Security Officer Patrick Beggs told CRN. Going forward, he is focusing on vulnerability management, phishing simulations and education on all things cybersecurity so that the ConnectWise team is ready even before bad actors try to infiltrate their ecosystems.
“We’re going to be red teaming where it’s hardcore cyber experts that basically try to break into our own networks. Threat hunting is more internal looking for behavior that exists but that shouldn’t be there,” he said.
[RELATED STORY: ConnectWise Patches ‘Critical’ Flaw That Could Have Infected 5,000 Servers: Huntress]
A part of that is the newly formed product security response team who will have a security-first mindset to all phases of product, engineering development, planning, design and execution.
“We have our ear to the ground to what some of our partners are going through,” he said. “I hope to pass on some of that knowledge to some of our folks and say, ‘Listen, I’m not necessarily promoting one product over another, but it’s just a capability that I want folks to know about.’
Along with the product security response team, the software vendor also recently launched ConnectWise Labs, a new special operations unit, will analyze data to anticipate what’s coming and build solutions that help partners solve problems they aren’t facing yet through ConnectWise Access Management.
The ConnectWise Access Management tool, also recently anounced, will provide credential-less, temporary administrative logon accounts and credential-less approval and denial of end user elevation requests. Many of the benefits include decreased ticket volumes, enhanced security, improved customer experience and the opportunity to redeploy resources to generate additional revenue, according to the company.
And it all starts with education, Beggs said.
“Security awareness training isn‘t just pushed one time a year. If you’re failing or if you have challenges on these tests, you actually get training as it goes,” he said. “One of our big goals is transparency through what we do with our own stuff.”
Here’s more of what Beggs had to say about cybersecurity trends, education and the recent R1Soft vulnerability.