Not Every Breach Is A Critical Breach

| 0 Comments

This week it was revealed that Cisco’s Duo had a vendor breached that handled VOIP & SMS for Duo. Duo does MFA, so this is potentially a big deal. I had a vendor send me this language for our own PR:

The severity of this incident cannot be overstated. The compromised information could be exploited by cybercriminals to launch highly targeted attacks against you and your organization.  

It can be overstated.

It’s estimated that the attack affected 1,000 people.

The exposed data is relatively minor1

The data contained in these logs includes an employee’s:

  • Phone number
  • Carrier
  • Location data
  • Date
  • Time
  • Message type

Bleeping Computer

    MSPs and cybersecurity professionals will undoubtedly fatigue the public if we cry wolf every time something happens in the cybersecurity realm.

    1. I’m sure someone will flame me for saying this. Of course any data can be used for phishing or other nefarious purposes. I’m not saying that it can’t be. But it also isn’t a full set of PII and credentials. Notably, names, addresses, employers and related applications are all missing from this list. ↩︎

    2020 Never Ended

    | 0 Comments

    A surreal street scene with a large, melting clock face hanging from a street lamp post. The clock displays the time as just past 10:10 and the year 2020. The background features foggy city streets with silhouettes of buildings, bare trees, and a snow-covered ground, creating a cold and deserted atmosphere.

    I just finished How to Human by Carlos Whittaker. While, not the point of the book, a thesis within it is that 2020 — and all that 2020 was — made so many of us forget how human.

    We forgot that it is a human instinct to help each other. 

    We forgot to put empathy over politics.

    We forgot how to be generous to everybody, and not just those from our own tribe. 

    It is a very optimistic take on the last few years: the idea that the social and political climate that we live in today — which is more toxic than that any other time in living memory — is an output of the disaster that was 2020.

    Reading this section of the book made me realize that in many ways I feel like 2020 never ended for me.:

    • My primary office is still my bedroom. 
    • The racial discussions that began in 2020 are unresolved and still part of my life.
    • The political environment is crazier, more malicious, more dangerous, and more divisive among friends and close community than it was in 2019 (which is saying something.)
    • The 2020 presidential campaign never actually ended.

    My mind is never too far away from a hair-trigger. I feel like I struggle to ever really embrace the good things coming in the not-near future. I can see good things 4-8 weeks away but anything further out gets demoted by my attention which is more attuned to anything going wrong now, or that might go wrong, or that I just don’t think will go right.

    If a few years ago I had vision to see a mile ahead in life it is now down to a couple hundred yards, past that there is only fog that always looks dark. Not because life is that uncertain, because I am unable emotionally to process what will happen beyond that.

    In my mind, yesterday is always lockdown, George Floyd, January 6th, the Ukraine war, keeping a small business afloat during COVID, getting COVID, up-ending how I do all of life. Today I need to get through today, and I’ll worry about tomorrow, tomorrow because I don’t have any energy left today.*

    Anything good that happened in that time (and there was a lot for me) is somehow moved from the main story line of my life to the appendix as I re-read it in my mind.

    I didn’t even realize how much I thought this way until getting through the first chapter or two of the book. 

    Wow, looking back at what I just wrote, sounds a little like PTSD, eh?

    A few paragraphs ago this post was more of a public-journaling exercise: I did not plan out a conclusion, just a description of my own life and thoughts.

    But if my experience in any way matches yours, then maybe Carlos is right: many of us are still dealing with trauma — not of any one thing but of all the things — that cloud our feelings, our perception and our judgement. 

    I think our deeply inhuman response to everything that happened in 2020 left the deepest mark and, for some, the deepest wounds. The year 2020 jacked up humanity. It threw many of us off course, and the problem is that we can’t seem to rebound… it still feels like most of us got knocked off course and can’t find our way back. I’m still processing. Still working to understand. Maybe you are too? Why? Because 2020 was about so much more than 2020.

    Carlos Whittaker, How to Human

    Maybe in trying to cut through the fog we have forgotten “how to human,” as instead we find ourselves in a low-state of anxiety about everything. 

    Carlos has a prescription for us — if you want it listen to the book, it’s only six hours — but this is my first step. Acknowledging through writing, the effects that 2020 is still having on me. Not just reverberations, a very much right-now-still-in-the-present effects.

    My second step is to end 2020. Maybe not in 2021. Or 2022. Or 2023. More like April of 2024.

    Then I can start a new year.

    *Not like the birds of the air here, it’s just anxiety all around.

    Will Kaseya Make an Industry Shaking Announcement, Is It AI?

    | 0 Comments

    Fred Voccola has been marketing a major announcement at Kaseya Connect.

    …in November, he previewed a Powered By Kaseya branding campaign that would roll out at this month’s Kaseya Connect Global 2024 conference. The CEO said the campaign “will disrupt the entire industry and that’s why end customers are going to start to look for MSPs powered by Kaseya, the same way that we bought a PC 15 years ago powered by Intel. We’re going to make it impossible for people not to be ‘Powered by Kaseya.’”

    At the Kaseya+Datto M&A Symposium for MSPs in London last December, Voccola added that Kaseya would deliver news in 2024 that will make the Datto acquisition “seem insignificant.” He certainly wasn’t talking about layoffs.

    At Robin Robin’s Bootcamp in Nashville in April of 2024 he said:

    We’re announcing in Vegas and three or four weeks, we believe we will fundamentally alter [the industry]. That’s a big statement. [This is a] 20, $16 billion bet, and this is my career bet — that we will fundamentally alter our industry for the better, change the dynamics of it, so this will be one of the most lucrative and rewarding industries on this planet period. 

    I think we found the way to do that, it’s a combination of a lot of things… it’s a culmination of everything we’ve done over the last decade. 

    I think the most interesting portion of those two quotes is “this is my career bet.” A $16bn bet would be a career bet for Vocolla for sure. A few months ago it would have been the Datto acquisition. With a valuation of nearly 10x ARR, it was a big bet that Datto would significantly outperform the market.

    Let’s talk about why it can’t be anything special, and then how it could be ground-breaking AI.

    The Pessimist

    Of course, for those of us in the industry, it is not remotely clear how “Powered by Kaseya” could “fundamentally” alter the Channel. Kaseya has a mixed reputation in the industry and virtually no reputation outside of it, except for those who remember its mammoth cybersecurity incident a few years ago.

    Honestly, it isn’t clear how any single announcement from any single company could “fundamentally” alter the MSP industry. AI has the biggest potential to transform how things are done — as in take tens of thousands or hundreds of thousands of low and mid-level tech jobs — but that will be a transition with incremental progress made by multiple companies.

    The second most interesting thing is him throwing out $16 billion dollars. Kaseya does $2 billion in ARR1, which means it isn’t anywhere near a $16 billion company,2 and nearly a third of that ARR came from the Datto acquisition3. It also doesn’t seem likely that this is simply more acquisitions, if for no reason than there are no rumors of deals remotely that big circulating, at least that I am aware of.

    The Optimist

    Let’s take two of the pessimistic ideas and flip them on their head: Kaseya doesn’t have that kind of money and AI doesn’t move that fast. In fact, the two of these together make more sense than other options, AI still attracts lots of money and high valuations, and Insight Partners has (or can raise) the money.

    I believe the biggest challenge to applying a general AI to IT is data: you need a lot of data to train on from a wide variety of industries, and Kaseya has that.

    • Kaseya owns two PSAs, full of 10+ years of tickets, solving processes and the ultimate solutions, from hundreds or thousands of MSPs serving probably every industry in the US (or the world?)
    • Kaseya owns two RMMs, also full of 10+ years of information
    • Kaseya owns the industry-leading IT documentation platform — IT Glue — which is full of documentation and SOPs for tens of thousands of IT environments

    In fact, Kaseya is probably one of only a handful of companies globally that has this much IT data from such a wide variety of sources. ConnectWise would be the only competitor here. Not even Microsoft has this kind of data.

    If Vocolla was talking about $16-$20in in R&D over several years both the total expense would make sense, and why he wasn’t sure if it was $16bn or $20bn, kind of a big gap to not know otherwise.

    Critically, Kaseya also has all of the pieces needed today. An interface for customers and AI (PSA), an interface between the AI and the endpoint (RMM), and documentation including passwords (IT Glue). And all of these are already validated tools. If you use Datto (Kaseya) Networking or are using their M365 RMM plugin, Kaseya also has network and cloud visibility into client platforms.

    Finally, Kaseya doesn’t need to invent a model from scratch. It’s possible to take an open-source model and fine-tune it, or partner with OpenAI/Microsoft to fine-tune a general LLM to work for IT. If you had a multi-model model you could ingest screen captures and, possibly, return keyboard and mice commands in an RPA-like product.

    It would be slow to start, sure, but well within the realm of possibility. It would also be expensive, but probably less expensive than a tech.

    It would also be one of the few products that might attract enough attention that “Powered by Kaseya” could mean something to a general audience.

    Now use your imagination and start tying all of these together: a client sends in a ticket to a PSA. KaseyaAI looks at the ticket and responds, possibly scheduling a remote session. Next, KaseyaAI remotes in with the RMM. It has access to passwords in IT Glue, along with client documentation. Between specific documentation, general IT knowledge and publicly available KBs it can solve most low level issues by itself. Finally, validating with the client that the issue is solved and closing the ticket.

    Kaseya could also automate RocketCyber (their SOC) this way. Get an alert, research it, and automatically remediate on the endpoint.

    Insight Partners currently lists 82 investments in ML/AI/Data on their portfolio page, and their news is absolutely dominated by AI stories. They have 99 investments in IT Infrastructure companies, although some of those overlap with AI.

    We’ll see in four weeks if my predications hold water.

    The second quote is my transcription, as always, I’ve lightly edited it for clarity.

    1. Per Robin Robins at the 2024 TMT Boot Camp. I’m pretty curious how Kaseya got to that level. ↩︎
    2. At least not shy of massive valuations ↩︎
    3. From the December 2021 Datto annual report: “As of December 31, 2021, our ARR was $658.4 million and our revenue for the year ended December 31, 2021 was $618.7 million, of which approximately 93% was recurring subscription revenue.” ↩︎

    Kaseya Layoffs

    | 0 Comments

    From CRN, Kaseya laid off 150 employees last week in Miami. Whether it was a layoff or a “performance based termination” depends on which side you believe.

    It always sucks to be fired, regardless of the reason. If you are an MSP that doesn’t like your account manager (I love mine, FTR) then maybe this is good news; except I expect that performance-based terminations is a euphemism for not meeting quota.

    As Yahoo Finance noted, there are dozens of openings for new account managers on Kaseya’s website, (Archive) which would fit with the theory of current (now former) AM’s not making quota.

    Most Read