What MSPs Can Learn From the Sony Hack

Passwords Matter

It has been revealed that Sony's passwords, along with other sensitive data, were unencrypted. This meant that once the hackers successfully penetrated Sony's network, they were able to grab raw passwords, leading the hackers further into the network and to more valuable treasure. MSPs should be at least advocating some form of password management for their customers, including the practice of encrypting passwords.

Encrypting Data Is The New Normal

In addition to passwords, Sony kept much of the really sensitive data in an unencrypted state. Had this data been encrypted, the hack, while still bad, would not have been as damaging to Sony as it has been. Data breach notification laws generally state that hacked encrypted data does not have to be disclosed as part of customer notifications. MSPs should be advising their customers to encrypt and protect (via other mechanisms) their sensitive data, both to hide it from hackers as well as to render it useless in the event a hacker does penetrate a network and gain access.

All Your Eggs In The Same Basket

Whatever the hackers were after they apparently made off with several valuable assets. The films stolen can now be copied and sold on the black market. The same is true for all the social security and other personally identifiable data breached. The potential for blackmail against Sony and its celebrity partners is considerable.

As we have previously written on this site, MSPs need to advise their customers on protecting different types of data differently. Because not all data is the same, some data needs more aggressive privacy and security protections.

Anytime these noteworthy hacks occur MSPs should take the time to educate their customers. Any chance to speak with your customers is a good opportunity and should not be wasted. Whether it is a discussion about making changes to the network or just advising them on the new threats, public hacks are very useful opportunities and must be used.