‘We see light at the end of the tunnel,’ says ConnectWise Chief Technology Officer David Raissipour. ‘We believe we have made significant progress in our investigation and remediation activities.’
ConnectWise Chief Technology Officer David Raissipour Monday told CRN that the company has made “significant progress” in its bid to restore ConnectWise Cloud Backup access for Microsoft 365 to more than several thousand MSPs.
“We see light at the end of the tunnel,” said Raissipour. “We believe we have made significant progress in our investigation and remediation activities.”
In fact, Raissipour said ConnectWise has not seen any suspicious activity in its environment for more than 24 hours. “One of the critical steps is to make sure that activity ceases in that environment,” he said. “Not having seen activity in the environment for an extended period of time now is one of those indicators that we see a light at the end of this tunnel.”
Raissipour’s comments come five days after the MSP platform provider initiated an “internal and external” security incident investigation that resulted in ConnectWise Cloud Backup, formerly known as SkyKick, SaaS Security and Cloud Management all being taken offline for more than several thousand MSPs.
The shutdown came after ConnectWise confirmed “unauthorized access to application identities” associated with ConnectWise Cloud Backup.
Raissipour said the incident — which involved unauthorized access to credentials used by the Cloud Backup service to authenticate to Microsoft 365 — impacted several thousand partners worldwide.
“The reason we took the service down is because there was access to that credential and that credential then allows a potential threat actor to go fake their identity as the enterprise application and then use that to directly access Microsoft 365,” said Raissipour.
Raissipour stressed that there is “zero evidence” that ConnectWise MSP customer backup data was accessed by any potential threat actor. “All of that backup data is encrypted and stored separately,” he said. “So it is using identities associated with a service principal.”
Raissipour said there has also “been zero detected activity” to any other ConnectWise product. “This is isolated to a specific service and a specific set of credentials used by that service to authenticate,” he said.
ConnectWise has provided detailed steps for MSPs to take to protect themselves and their customers on its security advisory website.
“I went myself and took step-by-step screenshots for every one of those operations and put them in our trust center for partners” said Raissipour.
ConnectWise has even made its SOC team available to help partners implement the changes.
“We understand this is an uncomfortable time for our partners and we are here to assist them in any way we can whether it is people technology, step-by-step guidance as they go through this to make sure they were not impacted and if they were what are the steps they need to take to prevent this from getting out of hand,” he said.
“I wish I could actually reach into partners’ environments and do this for them but we don’t have access to those environments,” he said. “We can help and we will help. Partners just need to raise their hand.”
ConnectWise is updating its security trust center three times a day to keep partners informed about the status of the security incident, said Raissipour. “Just last night, we found two additional IP addresses in our investigation we believe are malicious,” he said. “We posted those immediately and made sure we identified this for our partners. It is our responsibility to share every piece of information that we can to our partners to help them through this process.”
ConnectWise has brought in a third-party security incident response company to help with the investigation and remediation, said Raissipour. At this point, the investigation is ongoing, he said.
ConnectWise is taking steps to ensure that the Cloud Backup environment is “safe and secure” before bringing it online. “Instead of doing this right now we are going to do it the right way,” he said. “We are continuing down this path.”
Dustin Bolander, founder and managing partner of Austin, Texas-based MSP Clear Guidance Partners, and founder and CEO of Beltex, an MSP cybersecurity insurance provider, said he sees the security incident as a seminal moment in the MSP market that could result in big changes to security architecture.
In fact, Bolander said although it is ongoing, the ConnectWise breach could be more impactful than the historic Kaseya attack over the July 4 weekend in 2021.
“We need to still see the real-world impact,” he said. “But I think this is going to be another massive milestone that causes a change in the way we look at risk and the way that other industries perceive us, especially on the insurance side. After the Kaseya attack it got really hard to get insurance. It is already starting to tighten up a little bit. Historically, I think this is going to be one of the major turning points for the industry.”
As for the economic impact of the incident, Raissipour said the focus is on “doing what is right” for ConnectWise’s MSP customers. “I am not even thinking about economic impact,” he said. “I want to make sure our partners are safe. We will do what is right by our partners. I want us to get to a safe place. We’ll worry about money later. I want this to end.”
Raissipour praised the ConnectWise team for staying focused and responding in force to the security incident. “I’m proud how the team responded to this,” he said. “We stayed focused. We shared information we are certain of. We do not speculate. We have to remain focused and professional and keep going. I am proud of how the team has handled this. These things are always uncomfortable. I am fortunate enough to have a team of folks that don’t get rattled by these things. That is what they do. They focus on facts, investigation, and making sure things are safe and secure.”
