Trust But Verify: The Challenge With Outsourcing Security Of Your Storage & Backups To MSPs

Organizations are increasingly outsourcing their storage and backup operations to managed service providers (MSPs). While this strategy can offer cost savings, it also introduces severe risks, particularly when it comes to the security of sensitive data.

To ensure the security of your most mission-critical systems: storage and backups, organizations are increasingly adopting a rigorous approach to verify the integrity, effectiveness of these external services, and are leveraging independent security configuration audits as part of this approach.

The principles of “Inspect What You Expect” and “Trust but Verify” are crucial in navigating these complexities and safeguarding your data.

It is our opinion that the state of storage & backup security is significantly lagging behind that of compute and network security. This opinion is supported by research from The State of Storage & Backup Security Report. The report analyzed 245 environments with 8,589 storage and backup systems from leading providers including Dell, NetApp, Veritas, Hitachi Vantara, Pure, Commvault and others. Here’s what we discovered:

The State of Storage & Backup Security Report, 2023

One of the main concerns with outsourcing storage and backup operations is inexperienced personnel being assigned to your account. Some MSPs, in an effort to increase profits, may hire less qualified staff who lack some of the necessary skills and experience. These individuals might not be fully equipped to handle the complexities of your storage & backup environment, increasing the risk of security misconfigurations and vulnerabilities.

Another significant drawback of outsourcing is that the same personnel often manage the IT needs of multiple organizations. This multi-tasking can lead to human errors and security oversights, as attention is divided among various clients. The result is an elevated risk of data breaches and other security incidents.

Implementing the “Trust but Verify” approach by independently auditing the work performed by your MSP at a set interval/cycle enables your team to identify and remediate critical security flaws before damage is done and it’s too late. Regular audits can ensure that your MSP prioritizes your security standards and requirements

MSPs may lack the initiative to proactively improve and mitigate risks beyond the minimum requirements stipulated in the contract. This lack of proactive measures can leave your storage & backup systems exposed and vulnerable to evolving threats. By clearly defining expectations and regularly inspecting the efforts made towards risk mitigation and configuration baseline adherence, you can hold your MSP accountable and encourage a proactive approach to security.

A crucial issue with outsourcing IT infrastructure is the reduced security visibility and control over your storage & backup systems. Being far removed from the day-to-day administration and operations means that you might not have a comprehensive understanding of the security posture of your storage and backup environment.

This lack of visibility can lead to a false sense of security. Therefore, it’s essential to insist on maintaining security visibility on your storage, backup, and data protection systems, via detailed and transparent configuration audit reports from your MSP.

Regularly-scheduled reviews with your MSP/IT outsourcer can ensure you have a clear picture of your storage & backup security levels.

While outsourcing can allow for cost reduction, the ultimate accountability for data security lies with you. A regulatory requirement cannot be delegated.

To assist in validating the security of your outsourced storage and backup systems, many organizations are choosing to deploy StorageGuard.

StorageGuard audits the configuration of storage and backup systems, examining whether the platforms are hardened, align with industry security guidelines, and have vendor-recommended security settings applied.

By identifying vulnerabilities and ensuring compliance with best practices, StorageGuard provides an important layer of protection, to ensure that your storage and backup environment is actually secure.

Adopting a mindset of “Inspect What You Expect” and “Trust but Verify” ensures that you maintain the necessary oversight in the security processes in this critical pillar of IT infrastructure.