PROJECT DESCRIPTIONIMPROVINGCYBERSECURITY OF
MANAGED SERVICEPROVIDERS(Supporting Small-and Medium-Size Businesses)
Karen Waltermire
NIST National Cybersecurity Center of Excellence

Harry Perper
The MITRE Corporation

DRAFT
October 2019
smb_nccoe@nist.gov

1
2
3
4
5
6
7

The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards
and Technology (NIST), is a collaborative hub where industry organizations, government agencies, andacademic institutions work together to address businesses’ most pressing cybersecurity challenges.
Through this collaboration, the NCCoE develops modular, easily adaptable example cybersecurity
solutions demonstrating how to apply standards and best practices using commercially available
technology. To learn more about the NCCoE, visit http://nccoe.nist.gov. To learn more about NIST, visit
http://www.nist.gov.

8
9
10
11

This document describes how managed service providers (MSPs) can improve the cybersecurity of theirinformation technology (IT) infrastructure. NCCoE cybersecurity experts will address this challengethrough collaboration with a Community of Interest, including vendors of cybersecurity solutions. The
resulting reference design will detail an approach that can be incorporated across multiple sectors.

12
13
14
15
16
17
18
19
20
21
22
23
24

ABSTRACTMSPs have become an attractive target for cyber criminals. As a result, an MSP could benefit from
improving its own cybersecurity through implementing a secure IT architecture that reduces
vulnerabilities to attacks such as ransomware. When an MSP is vulnerable to a cyber attack, it also
increases the vulnerability to the small-and medium-size businesses (SMBs) that it supports. SMBs rely
on MSPs as trusted partners for their cybersecurity needs and to help them address challenges in
implementing cybersecurity technologies, including cost and staff expertise. Unfortunately, many MSPs
face challenges similar to those of SMBs, including a cybersecurity talent shortage and a lack of
cybersecurity technology integration experience. To address these challenges, this project will provide
MSPs with informed guidance that will enable them to adopt cybersecurity technologies and techniquesthat result in better security for themselves and their SMB customers. The goal of this project is toprovide a cybersecurity reference model that MSPs can customize to fit their cybersecurity program
needs.

25
26
27
28
29
30

Publication of this project description begins a process that will further identify project requirements,
scope, and hardware and software components for use in a laboratory environment. In the laboratory,
the NCCoE will build a standards-based, modular, and end-to-end example solution(s) that will address a
set of cybersecurity challenges aligned to the NIST Cybersecurity Framework v1.1, listed in Table 2 in the
Scope section. The approach may include architectural model definition, logical design, build
development, test and evaluation, and security control mapping.

31
32
33

This project will result in a publicly available NIST Cybersecurity Practice Guide, a detailed
implementation guide of the practical steps needed to implement a cybersecurity reference design that
addresses this challenge.

34
35

KEYWORDS
cybersecurity; managed service provider; MSP; risk management; SMB; small business

36
37
38
39
40

DISCLAIMER
Certain commercial entities, equipment, products, or materials may be identified in this document inorder to describe an experimental procedure or concept adequately. Such identification is not intended
to imply recommendation or endorsement by NIST or NCCoE, nor is it intended to imply that theentities, equipment, products, or materials are necessarily the best available for the purpose.

41
42
43
44

COMMENTS ON NCCOE DOCUMENTS

Organizations are encouraged to review all draft publications during public comment periods andprovide feedback. All publications from NIST’s National Cybersecurity Center of Excellence are available
at http://www.nccoe.nist.gov.
Project Description: Improving Cybersecurity of Managed Service Providers245

Comments on this publication may be submitted to smb_nccoe@nist.gov.

46

Public comment period: October 8, 2019 to November 8, 2019

Project Description: Improving Cybersecurity of Managed Service Providers

3

47

TABLE OF CONTENTS

48

1

Executive Summary..........................................................................................................649

Purpose...................................................................................................................................... 650

Scope ......................................................................................................................................... 6

51

Assumptions .............................................................................................................................. 752

Background................................................................................................................................ 7

53

2

Scenarios .........................................................................................................................854

Scenario 1: Managing the assets of the MSP ............................................................................ 855

Scenario 2: Managing employee access to data and systems .................................................. 856

Scenario 3: Event data is logged, and anomalous events are detected. ................................... 857

3

High-Level Architecture Model .........................................................................................958

Component List ....................................................................................................................... 10

59

Security Characteristics ........................................................................................................... 10

60

4

Relevant Standards and Guidance ..................................................................................1061

5

Security Control Map .....................................................................................................1162

Appendix A References.......................................................................................................13

63

Appendix B Acronyms and Abbreviations ............................................................................1464

Appendix C Glossary ...........................................................................................................15

Project Description: Improving Cybersecurity of Managed Service Providers

4

65
66
67

LIST OF FIGURES
Figure 1: Example MSP Nonsegmented Network ......................................................................................... 8
Figure 2: High-Level Architecture for MSP IT Infrastructure ........................................................................ 9

68
69
70

LIST OF TABLES

Table 1: Additional High-Level Architecture Security Components.............................................................. 9
Table 2: Security Control Map .................................................................................................................... 11

Project Description: Improving Cybersecurity of Managed Service Providers

5

71

1 EXECUTIVE SUMMARY

72

Purpose

73
74
75
76
77
78
79
80
81
82

The National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence(NCCoE) is interested in helping managed service providers (MSPs) support the cybersecurity needs ofsmall-and medium-size businesses (SMBs). MSPs provide information technology (IT) and cybersecurity
products and services to the majority of SMBs in the nation. Therefore, providing cybersecurity guidance
to MSPs to improve their own cybersecurity will result in improved cybersecurity for their customers,
SMBs. The goal of the project is to provide MSPs with guidance for implementing cybersecurity
techniques that will help them secure their IT architecture. This guidance should allow MSPs to adapt
techniques to best fit their environment and needs by using current technologies, off-the-shelftechnologies, or open-source technologies. To ensure that the project best addresses MSPs’
cybersecurity needs, the NCCoE is requesting feedback on this project idea.

83
84

The NCCoE intends for the project to provide MSPs who adopt the guidance with the following potential
benefits:

85•

improved cybersecurity awareness86•

improved hardware and software asset management87•

improved system and data access control

88•

improved cybersecurity of an MSP’s IT infrastructure

89•

improved design, acquisition, and integration of secure technologies

90
91
92
93
94

Each MSP’s design must be based on its cybersecurity needs evaluation.
This project will result in a publicly available NIST Cybersecurity Practice Guide, a detailed
implementation guide of the practical steps needed to implement a cybersecurity reference design that
addresses this challenge.

95

Scope

96
97
98
99
100
101

The scope of this project includes the Cybersecurity Framework Subcategories noted in Table 2. The
Subcategories were chosen based on discussion with cybersecurity experts and MSP representatives.
The project will address the Cybersecurity Framework Functions (i.e., Identify, Protect, and Detect) andthe Subcategories of those Functions identified as the most pertinent to securing an MSP IT
infrastructure based on those discussions. Future projects may cover other Functions (i.e., Respond,
Recover) and Subcategories that are not included here.

102
103
104

Guidance will include a reference architecture model and example implementation (proof of concept)
details to enable an MSP’s decision makers or technologists to understand and implement any part or allof the proposed approach to improve the cybersecurity of its IT infrastructure.

Project Description: Improving Cybersecurity of Managed Service Providers

6

105

Assumptions

106

The following assumptions and dependencies will help shape the scope of the project:

107
108

•

MSPs recognized that improving their own cybersecurity program is important to their successand the success of the SMBs they support.

109•

MSPs consider themselves trusted partners of their customers.

110•

Applicable secure technologies are available.

111
112

•

The Cybersecurity Framework Subcategories listed in Table 2 are applicable to a broad segmentof MSPs.

113
114
115

•

MSPs understand that the proposed architecture model is modular and that the example
solution(s) will enable MSPs to adopt applicable portions of the proposed approach that best fit
their needs.

116
117

•

MSP organizations will perform a risk assessment to determine the value of an investment in
one or more of the secure technologies included in the architecture.

118

Background

119
120
121
122
123

The MSP market has seen tremendous growth over the past six years. This success has resulted in MSPs
increasingly becoming targets of cybersecurity attacks that can impact their business and theircustomers’ overall trust in MSPs and jeopardize their customers’ security. For example, a recent attack
on MSPs, commonly referred to as Cloud Hopper, may have exposed the information that MSPs held
describing their customers’ IT infrastructures and account information.

124
125
126
127
128
129
130
131

The research conducted for this project indicates that a typical MSP focuses primarily on ensuring that it
can provide the best options for remotely managing SMBs’ IT and end-user systems and thatcybersecurity of their own IT infrastructure may be a secondary concern. The research was informed bydiscussions with subject matter experts (SMEs) in the MSP market and included interviews,
correspondence with MSPs, summaries from MSP-focused conferences, and vendors for back-office andcustomer technical support such as remote monitoring and management, professional service
automation, and automated backup tools. The research led the NCCoE SMEs to identify the list of
Cybersecurity Framework Subcategories listed in the Scope section of this document.

132
133
134
135
136
137
138

For example, after discussions with SMEs within the MSP market, the NCCoE’s technical experts
concluded that many MSP IT infrastructures are implemented on nonsegmented networks. These
networks are generally undesirable because they enable equal network access to all assets on the
network. If the network were compromised, nonsegmented networking enables the spread of malware
by creating a corporate-wide horizontal network. Nonsegmented networking also allows user access toall corporate assets by default, which greatly increases the potential for unwanted user activity. Figure 1
depicts an example of a nonsegmented network to illustrate this research finding.

Project Description: Improving Cybersecurity of Managed Service Providers

7

139

Figure 1: Example MSP Nonsegmented Network

140

2 SCENARIOS

141
142
143
144
145
146

The NCCoE, in collaboration with MSP organizations, identified three scenarios that capture a broad
range of the most pressing cybersecurity challenges facing MSPs. To demonstrate how cybersecurity
challenges can be addressed within these scenarios, the NCCoE will create a realistic MSP IT
environment, including common MSP applications. Within that environment, multiple standards-based
cybersecurity techniques and technologies will be implemented. The technologies used will addresseach scenario’s cybersecurity challenges.

147

Scenario 1: Managing the assets of the MSP

148
149
150

Asset Management: This scenario will address the challenge of asset management. The project will
provide a reference architecture and example solution for improving asset management, including
hardware, software, vulnerability management, and system patching within the MSP environment.

151

Scenario 2: Managing employee access to data and systems

152
153
154
155

Access Management: This scenario will address the challenges with access management. The projectwill provide a reference architecture and example solution for improving access management to MSP
data, MSP customer data, and MSP applications/tools, including multifactor authentication, role-based
access control, password management, remote access, and privileged account management.

156

Scenario 3: Event data is logged, and anomalous events are detected.

157
158
159
160

Tracking Events Data and Incidents: This scenario will address the challenges associated with various
aspects of event logging and correlation within the MSP environment. The project will provide areference architecture and example solution for improving event logging and correlation, including user
activity and network activity.

Project Description: Improving Cybersecurity of Managed Service Providers

8

161

3 HIGH-LEVEL ARCHITECTURE MODEL

162
163
164
165
166

The proposed high-level architecture model for an MSP includes components that address 10 of the 108
Cybersecurity Framework Subcategories as listed in Table 2. Figure 2 depicts a proposed network
segmentation architecture model, separating the various corporate assets into sub-networks with
common uses or access-control requirements. Figure 2 also aligns to Subcategory PR.AC-5 thatrecommends network segmentation. Table 1 addresses the remaining Subcategories listed in Table 2.

167

Figure 2: High-Level Architecture for MSP IT Infrastructure

168

Table 1: Additional High-Level Architecture Security Components
Identify

Protect

DetectAsset scanning and detection

Directories (Active Directory)

Event logging and collection

Automated update
management

Role-based access control

Event log analysis

Update testing

Physical access control

Analysis to detect
unauthorized (out of policy)
users, user activity, devices,and software

User resource access policies

Multifactor authentication

Network monitoring

User role policies

VPN
Disk encryption
Backup systems (auto andmanual)Project Description: Improving Cybersecurity of Managed Service Providers

9

169
170
171

The proposed high-level architecture model components are expected to be included in the project anddocumented in the practice guide. These components will combine to raise an MSP’s cybersecurity
posture and address the Cybersecurity Framework Subcategories listed in Table 2.

172

Component List

173
174
175

The following components will be needed to create a realistic MSP IT environment and demonstratecapabilities to address the cybersecurity challenges presented in the three scenarios described in
Section 2:

176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194

•
•
•
•
•
•
•

•
•
•
•

•
•

mobile and desktop devices
cloud application and directory services
mobile-device manager (cloud service)on-premise applications
on-premise IT infrastructure
security incident and event management (SIEM)
identity and access management capabilities
o identity storeo access rights management (role-based)o authentication and authorization
network segmentation capabilities
encryption capabilities–disk levelnetwork monitoring capabilities
asset management capabilities
o vulnerability scanningo automated updateo asset identification
RMM capabilities
PSA capabilities

195

Security Characteristics

196
197

This project will develop a reference architecture and example implementation that meets the following
requirements:

198
199
200
201
202
203

•
•
•
•

is standards-basedis effective and secure
addresses the subset of Cybersecurity Framework Subcategories in Table 2
supports modular implementation such as:o multivendor implementationso independently implementable security capabilities

204

4 RELEVANT STANDARDS AND GUIDANCE

205

Standards, guidance, and open-source activities that may be leveraged for this effort include:

206
207
208
209
210

•
•
•

NIST Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 [1]NIST Interagency or Internal Report (NISTIR) 7621, Revision 1, Small Business Information
Security: The Fundamentals [2]NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems andOrganizations [3]Project Description: Improving Cybersecurity of Managed Service Providers

10

211
212
213
214
215
216
217

•
•
•
•
•

NIST SP 800-63-3, Digital Identity Guidelines [4]NIST SP 800-171 Rev. 1, Protecting Controlled Unclassified Information in Nonfederal Systems
and Organizations [5]NIST SP 1800-18, Privileged Account Management for the Financial Services Sector [6]NIST Federal Information Processing Standard (FIPS) 140-3, Security Requirements for
Cryptographic Modules [7]NIST SP 1800-9, Access Rights Management for the Financial Services Sector [8]218

5 SECURITY CONTROL MAP

219
220
221
222
223

Table 2 maps the characteristics of the commercial products that the NCCoE will apply to thiscybersecurity challenge to the applicable standards and best practices described in the Framework for
Improving Critical Infrastructure Cybersecurity. This exercise is meant to demonstrate the real-world
applicability of standards and best practices but does not imply that products with these characteristics
will meet an industry’s requirements for regulatory approval or accreditation.

224

Table 2: Security Control Map
Function

IDENTIFY(ID)

PROTECT(PR)

Category
Asset Management (ID.AM): The data,
personnel, devices, systems, andfacilities that enable the organization toachieve business purposes are identified
and managed consistent with theirrelative importance to organizational
objectives and the organization’s risk
strategy.
Risk Assessment (ID.RA): The
organization understands thecybersecurity risk to organizational
operations (including mission, functions,image, or reputation), organizational
assets, and individuals.

Identity Management, Authentication,
and Access Control (PR.AC): Access tophysical and logical assets andassociated facilities is limited toauthorized users, processes, and devices
and is managed consistent with theassessed risk of unauthorized access toauthorized activities and transactions.

Subcategory

ID.AM-1: Physical devices andsystems within the organization are
inventoried.

ID.RA-1: Asset vulnerabilities are
identified and documented.
PR.AC-1: Identities and credentials
are issued, managed, verified,
revoked, and audited forauthorized devices, users, andprocesses.
PR.AC-2: Physical access to assets is
managed and protected.
PR.AC-3: Remote access ismanaged.
PR.AC-4: Access permissions andauthorizations are managed,
incorporating the principles of leastprivilege and separation of duties.
PR.AC-5: Network integrity isprotected (e.g., network

Project Description: Improving Cybersecurity of Managed Service Providers

11

Information Protection Processes andProcedures (PR.IP): Security policies(that address purpose, scope, roles,
responsibilities, management
commitment, and coordination amongorganizational entities), processes, andprocedures are maintained and used to
manage protection of information
systems and assets.
DETECT(DE)

Anomalies and Events (DE.AE):
Anomalous activity is detected, and thepotential impact of events is understood.

segregation, network
segmentation).
PR.AC-7: Users, devices, and otherassets are authenticated (e.g.,single-factor, multi-factor)
commensurate with the risk of thetransaction (e.g., individuals’
security and privacy risks and otherorganizational risks).

PR.IP-4: Backups of information are
conducted, maintained, and tested.

DE.AE-3: Event data are collected
and correlated from multiple
sources and sensors.

Project Description: Improving Cybersecurity of Managed Service Providers

12

225

APPENDIX A REFERENCES

226
227
228

[1]

Framework for Improving Critical Infrastructure Cybersecurity, V1.1, National Institute ofStandards and Technology (NIST), Gaithersburg, Md., Apr. 2018. Available:
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf.

229
230
231

[2]

C. Paulsen and P. Toth, Small Business Information Security: The Fundamentals, NIST Interagency
Report 7621, Revision 1, Gaithersburg, Md., Nov. 2016. Available:
https://csrc.nist.gov/publications/detail/nistir/7621/rev-1/final.

232
233
234

[3]

Security and Privacy Controls for Federal Information Systems and Organizations, NIST Special
Publication (SP) 800-53 Revision 4, Gaithersburg, Md., Jan. 2015. Available:
https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final.

235
236

[4]

P. Grassi et al., Digital Identity Guidelines, NIST SP 800-63-3, Gaithersburg, Md., June 2017.
Available: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf.

237
238
239

[5]

R. Ross et al., Protecting Controlled Unclassified Information in Nonfederal Systems andOrganizations, NIST SP 800-171 Rev. 1, Gaithersburg, Md., December 2016 Available:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf.

240
241
242

[6]

K. Waltermire et al., Privileged Account Management for the Financial Services Sector, NIST SP
1800-18, Gaithersburg, Md., Sept. 2018. Available:
https://www.nccoe.nist.gov/sites/default/files/library/sp1800/fs-pam-nist-sp1800-18-draft.pdf.

243
244
245

[7]

U.S. Department of Commerce. Security Requirements for Cryptographic Modules, Federal
Information Processing Standards Publication 140-3, March 2019. Available:
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf.

246
247
248

[8]

J. Banoczi et al., Access Rights Management for the Financial Services Sector, NIST SP 1800-9,
Gaithersburg, Md., Aug. 2017. Available:
https://www.nccoe.nist.gov/sites/default/files/library/sp1800/fs-arm-nist-sp1800-9-draft.pdf.

249
250

[9]

Gartner IT Glossary. Managed Service Provider (MSP). 2019. Available:
https://www.gartner.com/it-glossary/msp-management-service-provider

Project Description: Improving Cybersecurity of Managed Service Providers

13

251

APPENDIX B ACRONYMS AND ABBREVIATIONSFIPS

Federal Information Processing Standard

IT

Information Technology

MSP

Managed Service Provider

NCCoE

National Cybersecurity Center of Excellence

NIST

National Institute of Standards and Technology

NISTIRNIST Interagency or Internal Report

SMB

Small and Medium Business (or Organization)

PSA

Professional Services Automation

RMM

Resource Monitoring and Management

SIEM

Security Incident and Event Management

SME

Subject Matter Expert

SP

Special Publication

Project Description: Improving Cybersecurity of Managed Service Providers

14

252

APPENDIX C GLOSSARY
Multifactor
Authentication

An authentication system that requires more than one distinct
authentication factor for successful authentication. Multifactor
authentication can be performed using a multifactor authenticator orby a combination of authenticators that provide different factors.
The three authentication factors are something you know, something
you have, and something you are.

Managed Service
ProviderA managed service provider (MSP) delivers services, such as network,
application, infrastructure and security, via ongoing and regular support
and active administration on customers’ premises, in their MSP’s data
center (hosting), or in a third-party data center. The term MSP
traditionally was applied to infrastructure or device-centric types ofservices but has expanded to include any continuous, regularmanagement, maintenance and support. [9]Project Description: Improving Cybersecurity of Managed Service Providers

15