Vendor Security Is Your Security (EP 1092)

About this episode

I don’t do websites, so my first reaction to the PHP security headlines was that this probably wasn’t my problem. Then clients started asking what they needed to worry about, and I had to give them an honest answer: I didn’t know yet, but I would find out. This solo conversation follows the questions that sent me digging into vendor notices, client systems, and the applications connected to their Microsoft 365 environments. Between the PHP concerns and the ConnectWise cloud backup incident discussed on the show, the bigger lesson became clear: vendor security is our security. I share what I’m reviewing, where I found gaps in my own processes, and why we can outsource services without outsourcing our responsibility to understand the risks our clients are accepting. === Chapters 00:10 MSP Vendor Security and Client Responsibility 00:22 PHP Vulnerabilities: Beyond Website Security 01:38 ConnectWise Cloud Backup and Microsoft 365 Risks 03:19 Action1 and Vendor Security Communications 07:34 IT Asset Inventory and Patch Ownership 09:55 Patch Verification and Signs of Compromise 12:35 Microsoft 365 App Permissions and Vendor Access 16:07 Backup Restore Testing and Vendor Outages 18:05