Defend, Govern & Prove:
Managed endpoint security

Hi all, welcome back to the managed endpoint security part of the defend improve series. This is episode three, transforming endpoint agents chaos to unified device defense. This topic for me is really important. I can't really stress it enough. I think it really adds value when we talk about removing all of the tools, all of the agents we've had, that overload that we've been putting and start that consolidation piece. Being part of inforcer, I'm very much a big believer in the centralizing of a serious amount of tools, restructuring ourselves as an MSP and looking at where we sit on that landscape of endpoint security in this episode, but just across the board in terms of the tools and the products that we use, I think it's time that MSPs start to restructure that.

We need to start defining what we need and what we want embedded into the platform. We've got RMM solutions that are offering third party antivirus. That just doesn't cut it anymore when we talk about the bigger picture. Microsoft's introduced this new XDR solution which allows us to do Defender for Office, Defender for Endpoint integration into Microsoft Sentinel and really start to build some really good models of information. This episode is just talking about specifically endpoint security.

And I really want to go to town on identifying where things sit here. So let's start with the agent overload. It isn't a security strategy. Everyone thinks it is.

Everyone thinks the more agents we have and the different information and the different platforms just allows us to be a bit more spread across what we look to manage. The truth is we need to be a bit more aligned. We are all over the place with multiple platforms, multiple portals, multiple login with very little kind of single pane of glass to look at. And that's part of the reason why Microsoft's injected $20 billion into security and protection is to allow us to have that single pane of glass in the security center.

So security.microsoft.com really is that central point for us to start seeing incidents, threats, response and start that encompassed XDR-based solution. Endless adding security agents like antivirus, EDR, VPNs really does lead to overwhelming endpoint loads. And this is true. CPU hitting 100% maxed out because our antivirus, our third party antivirus is running at the same time, our VPN's running at the same time and EDR is running. We've got ourselves to the point over the last 10 years where we've gone from 4 gig of RAM is enough, 8 gig of RAM is enough, 16 gig of RAM to now almost 32 gig is required when we use too many agents that are managing and monitoring and connecting to the network.

It's becoming an over overload. We don't need more agents. We really do need to start looking at alignments, strategic security alignments and best practices. And again, this is the reason why inforcer's here is starting that conversation, driving that change for us to be focused on security alignments and baseline management. Most of the protection that we take or we need to look at implementing starts with identity, which is part of the next episode, but it's all about protecting the Microsoft data, the data that we're using.

And 90% of businesses nowadays utilize and leverage Microsoft 365 in some level of capacity if not all the time in their business. And we've got to make sure that we're utilizing the products that are there. And Microsoft have done a good job in making sure the licenses are up to date with the right information. It's taken them a while but they have got there in the end. So where does that look like? And this is where this whole series has started as a modern MSP stack problem.

The MSP stack problem. The issues that we have as tools. Well, we now need to look at modern endpoints needs to start that unification and solution. We need to start removing the junk that we have the jumbled up management and conflictions that we have in place for different antiviruses, EDR encryptions, MDM solutions and we need to start that consolidation. So what was the original model? How did it look like before? Fragmenting tooling. I think it's safe to say I've already said it.

Separated AVs, EDR solutions, encryptions, different MDM vendors, but guess what? Not a single one of them communicated properly. Unless we had a PSA integration and a platform and a dashboard and you had one hell of an architect who can come up with a brilliant solution, and there's plenty of them out there, it was just all over the place. No cohesion, no communication between the lot. It was all over. It was a nightmare. The other one that I really find interesting when I talk about this is the blind spots.

There's no cross signal correlation that allows threats to slip through. It's just it's just a no-brainer. It's that breaching the gap. We need to start securing that gap of areas. And the next episode on identity really talks about identity being the new perimeter. And I'll be mentioning that again in the future. So, watch out for that episode that'll be dropping soon. Update issues, desynchronized updates, create vulnerability windows. We have to make sure that we remove those CVE alerts and events that come in and we keep things up to date.

And this was a big problem. Guess what? We were adding another RMM solution, another layer, another agent that comes from our RMM tool that then started dealing with updates rather than leveraging what was already pre-built and ready to go. Reporting headaches for me was the biggest one. Cons inconsistent reports across multiple different tenants and dashboards drives me mad. Back before we started consolidating our own services at my last job, everything was all over the place. We'd be running a report in one RMM, then we'd be going over to a reporting solution somewhere else and we'd be utilizing bright gauge, then we'd be jumping into cloud radial.

It was just everywhere. Power BI dashboards being created so that we can consolidate actually just created more noise for us. Managing multiple tours for a single alert often ends up with conflict. Endpoint security shouldn't be a Frankenstein monster. I think it's a really good statement. We shouldn't be at the moment and back in the day. Our legacy architecture really had everything all over the place. It really was a Frankenstein monster. And it's time that we look at the modern model.

Where do we want to go? How do we want our endpoints that we support day in and day out to be centralized and unified across the board? And that brings me nicely to Microsoft the Microsoft way. What does that look like? And this is obviously where I'm driving this conversation. It's defender.

Intune unification, Microsoft's endpoint stack unifies what others attempt to integrate. So where we've got other competitive endpoint advantages or competitive products, they're trying to integrate into a platform and it's taken them quite a while to get there. Well, Microsoft's taken that 20 billion that they've injected and guess what? They've done it now. It's ready to go. So those unified components are architectured to be embedded with each other across the board. So what does that look like?

What are those layers that I'm talking about? Well, it's defender for endpoint. It's Intune. It's Microsoft security baseline delivery. It's configuration of templates predefined. It's entry ID join. It's defi device identity. Its identity being that new perimeter. And those functions are so critical. But guess what? They're all embedded into one another. So where do we go about that visibility and that centralization? And this is kind of where I see inforcer tagging itself on. And I know I've spoken about other vendors integration but it's taking a product that can do this at scale for you.

So we start with devices we have to enroll them into intune we have to apply those policies we have to add layers of protection. So we implementing defender endpoint Microsoft E365 portal the visibility centralized for us and then the last layer of this is proving the value with the metrics that we have and guess what inforcer offers it for you the ability not only to cover those points one to four but also report on those in the same measurements.

So the ability to push out those policies, monitor any drift detection, all of that integration is available for us to leverage when we look at the consolidation of multiple antivirus spam VPN tools and look at Microsoft being that centralized node. So where does that really sit for us when we talk about and I've been talking about this as part of defend and prove this was just defense. Where do we go on the next level of governance and proving that value afterwards?

Well, governance is the central piece for us. It's all about making sure that we are policy aligned.

Customers are using the standard policies that we've configured. Drift detection top of that list. We need to know when someone's making a change. And again, how intune and defender align baseline deployment validate validates the policy application. Drift alerts flag disabled defender protection. Cross tenant dashboards ensure holistic visibility for you guys. That single pane of glass. And then framework mappings. Building out your policies with the right policy tags allows you guys to make sure you're deploying the correct configurations and the frameworks aligned for your customers.

All of that is available as part of the governance package within enforcement. The ability to defend, then govern, and then finally look at the proof which we'll jump on in just a minute. It's so critical that we look at that governance piece where we did the configured, enforced, and effective webinar. The principles are exactly the same. We have to make sure that we start with our configuration, our baseline deployment validation. Then we focus on the enforcement, the continuous drift monitoring, making sure those real-time alerts of the disable are up and running.

We are modifying anything that comes in with the latest PSA integration that inforcer has is becoming critical. The ability for us to integrate into our key platforms that we use cross tenant alignment, unified dashboards across client environments for consistent security. We need to know what's going on across all of them. So a single pane of glass in inforcer to say everyone is 100% aligned to our baseline deployment of absolute win. And the last one is that framework mapping which I've already said.

So where does that go moving forward? And this parts this comes up next with the proving of the value reporting and ROI is where we look to measure for ourselves.

MSPs win back time and trust when we can provide the right outputs, when we can prove the value that we have for that customer that we're driving that proof, that proactiveness. So, we want the protection coverage. We want to be able to run an alignment report and say you're 100% aligned to our protection, our coverage. We can genuinely say that what we've implemented for you guys stops the gaps and stops the breaches. Compliance scoring again using tenant alignments and policy tagging.

We can make sure they're aligned to the right policies we configure. Leveraging inforcer we can run those reports. Threat intelligence is another big topic. How do we make sure that we are protecting? Well, guess what? We can make sure those policies are configured correctly and prove the value by leveraging Microsoft 365 and the security center directly. And the last one is the response metrics. We want to turn your patching, your policy and your protection information that you are constantly telling them into an actual story of value that you give.

And again, those assessment reports you can run drive those conversations. So let's look to try and wrap up the four security loop. Configure, detect, improve.

Modern endpoint security isn't about adding complexity anymore. It used to be with all those multiple tools. It's about knowing as much information as you can scrape from the barrel on those devices. And that means we need a unified platform that we can do this from. And that is Microsoft. That's Microsoft's embedded solution. What does that look like? Well, we've got our configuration unified intune deployment. We then have our detection defender threat intelligence. And then finally that proof forces measurable outcomes making sure that we can generate and show those assessments and those outcomes directly within the report the customers can take as value.

Defender Intune inforcer completes the entire security loop. And you'll see that with that screenshot in the middle when we're unifying our solutions, leveraging Intune for device management, Defender for the endpoint security, and then that proof on the assessment engine, we've really got a unified outcome, a single pane of glass. Multi-tenant management no longer needs to be a pain. We can really start that centralized piece. So finally key takeaways things I want you guys to walk away with knowing actually we can take this one step further.

We want to replace the agents rule. Start with professional services revenue guys. When you look at this everything you look at here is money you could be making revenue you can be making from your customers. Replace the agent. Consolidate.

Save money on the agents and the money you're spending on those licenses for starters, but provide a professional services cost to provide them with a much better endpoint security solution, which guess what's built into the license baseline alignment core. It's an ongoing service we can offer. Being able to provide an alignment to our core security standards as an MSP is a service we can be offering customers monthly. Microsoft making changes to their platform every single month.

We need to be on the front foot of that. We need to be adapting and managing it immediately. And to do that, we need to make sure they're already aligned to our best practices. And we can report on it monthly. Operationalize inforcer. Transform the raw information you're getting into actionable insights. So use the entry ID dashboard. Run those assessment reports and double check where people are. Look at the opportunities to gain more revenue outcome professional services delivery.

And then finally, turn that data into evidence. Convert the information you're getting. Convert those alignment reports. See it as evidence that you can produce to your customer and insurance providers, cyber insurance auditors proving the value that we really offer customers. Security milestones are achieved when we really start to dig deeper on a unified platform, a centralized opport centralized piece and an opportunity for us to really focus on new revenue margins, new areas of revenue that we can get as MSPs.

We're too far behind the times and we need to start catching up and that starts with revolutionizing AI. So part of the copio series we're doing but also focusing or narrowing our focus on to really looking at those three pillars the defense the configuration the governance the drift monitoring and then proving that value leveraging those assessments. That's a wrap guys. I hope this has been useful. We've got our next episode is managed identity protection.

Highly recommend you guys get involved in that. We've run the webinar already a couple of weeks ago, so this is the next opportunity to really see it. Any questions, just give me a shout. Thank you.