IoT opportunities for MSPs in monitoring, management
Partners can extend their existing services into the realm of IoT, but they should brace themselves for massive device populations and gear up for security.
For a while now, the IoT category has been touted as a potentially lucrative business area for IT service providers.
Indeed, partners can engage in IoT opportunities in a few ways, one of which is monitoring and managing IoT devices, a task that includes providing updates and security. MSPs, however, may need to invest in a broader set of services to provide such an offering. They should also prepare themselves to deal with a dramatically expanded device population.
IoT opportunities for partners
MSPs already manage and monitor other devices for clients and IoT sensors are just another endpoint, said Carolyn April, senior director of industry analysis at CompTIA. More than half of MSPs currently see significant revenue opportunities in managed IoT, according to CompTIA.
"What's a little different about IoT is it's collecting quite a bit of data from those sensors and that's where the real lucrative opportunity lies -- in what do to with data that's collected and applying some analytics to it," April said. That gives MSPs more of a consultative role by helping customers determine how to use the findings to improve their business or achieve some goal they've outlined, she said.
However, that requires having more people with analytics skills. "So that will require some investment and frankly, most rank-and-file MSPs don't have that skill set today," April said.
CompTIA job reports have shown there is a lot of need among companies to find people with analytics skills who can apply them to the reams of data IoT devices collect. "There's an overwhelming amount of stuff and if you don't do something with it, that's all it is, April said. "But if you can turn it into something actionable that's gold, and you will be paid a lot more for that."
"With that work-from-home transition came threats of ... unmanaged internet of things devices that permeate our homes on routers, modems [and] personal devices," as well as every imaginable home appliance, said Charles Weaver, CEO of the MSPAlliance. "Until last year, corporate IT didn't factor in home threats from appliances with internet connections," because it wasn't something major organizations considered a potential threat, he said.
The business opportunity for MSPs is working with their customers on services such as secure access service edge, endpoint detection and response, managed detection and response, security information and event management (SIEM) and security operations center. Such offerings ingest data and protect companies when that data resides outside the firewall.
Some of those technologies "will bring the security umbrella right into that corporate user's home ... and start to protect companies from those IoT devices," Weaver said.
Some companies struggle with managing endpoints and, if they don't have enough IT staff, that's where partners can step in and monitor devices and respond in real time, said Sean Tufts, IoT/OT practice director at Optiv, a managed security services company in Denver.
"It's about the speed in which we can react from the managed services [side] because we're always looking," Tufts said.
"We plug into an [industrial IoT] system and typically see scenarios like malware that was installed in 2016 and is moving around and causing some damage," and whoever installed the system has since left the company, he said. "Meanwhile, the attacker has moved on and we can see the remnants of it and still see the devices trying to call home to North Korea. So, it still has the potential to wreak havoc."
IoT monitoring vs. traditional MSP services
Like April, Tufts said managing and monitoring IoT devices is very similar to the other types of monitoring MSPs already do.
"The big tools, from a managed security standpoint, will be the standard network pieces and SIEM," he said. The purpose of SIEM is to collect all security data into one console, he noted.
"Historically, [IT hasn't] been able to see IoT devices, so we're bringing that forward and unlocking a new version of security alerts for the most important things a company does," Tufts said. Right now, if someone were to do a sweep of a home or building "there would be devices that pop into a router and we, as an industry, haven't cataloged them," he added.
Monitoring and managing IoT devices is typically not something a company contemplates, Weaver said. Yet, in a home environment, there are devices that share the same network with potentially sensitive work data.
"The refrigerator that connects to the network was never designed to be implemented on a corporate network or designed with patches and monitoring," he said. "Yet, all these IoT devices are now proximate to sensitive corporate devices."
The scale factor is one important difference between managing and monitoring IoT devices and other hardware, April said. Many IoT engagements are in industrial settings and vertical markets that tend to have enormous device populations, she said. Given that most MSPs tend to be small businesses, they need to determine if they have the resources -- both human and technical -- to manage large installations.
I'm not saying MSPs can't scale, but that is what I would point out as one of the bigger challenges.
Carolyn AprilSenior director of industry analysis, CompTIA
"I'm not saying MSPs can't scale, but that is what I would point out as one of the bigger challenges," she said. "It may be what keeps MSPs from getting into IoT at all."
The security aspect is also something to take into consideration. "We believe that the IoT threat and work-from-home scenario demand a very rapid pivot by the MSPs and their customers to manage what is now" an expansive network perimeter, Weaver said, citing research from MSPAlliance and other organizations.
The traditional corporate network "has been destroyed," he added.
MSPs and companies must put in place technologies that protect devices when employees are working remotely and accessing the network with other devices that are not secured, Weaver said. "That's our reality for the foreseeable future."
