Kaseya: when your IT provider’s tool is the way in
Ransomware spread to around 1,500 businesses through their IT providers’ remote management software.
On 2 July, attackers used flaws in Kaseya VSA, remote management software used by IT service providers, to push ransomware to their customers. About 60 providers and up to 1,500 businesses were hit, many of them small companies that had never heard of Kaseya.
If an IT provider manages your computers, their tools have admin rights on all of them. Their security is your security.
Questions to ask your provider:
- Which remote tools do you use on our systems, and how are they protected?
- Is MFA required for every technician login?
- Can you push scripts to all our machines at once, and who approves that?
- How fast do you patch your own tools?
- Are our backups reachable from those same tools?
And keep one backup the provider’s tools can’t touch.