Meet Joe. For six months, you’ve teamed up on an ambitious web‑design project, trading ideas over Slack and brainstorming in endless Teams calls. You’ve both embraced the remote lifestyle: zero commute, flexible hours, and the steady rhythm of moving cards across your Kanban board. Then one morning, Joe vanishes. Questions start pouring in, and with a sinking feeling, you realize that “Joe” was never who he claimed to be. He was actually a North Korean hacker in disguise.

It sounds like something straight out of a spy thriller, but it’s very real and it’s happening right now. Cybersecurity researchers at DTEX and Strider Technologies have traced well over a thousand bogus email addresses and fabricated resumes back to Pyongyang’s clandestine “laptop farms.” These so‑called employees land roles from junior web‑design gigs all the way up to senior developer positions, siphoning funds into North Korea’s weapons and intelligence programs in the process.

---

### How They Pull It Off
You’re probably thinking: aren’t there systems and departments in place to verify that an employee is who they say they are? Of course, right? Yet over the past 20 years, more than 60,000 U.S. security, intelligence, military, and law‑enforcement personnel were charged with major felonies despite passing background investigations, often by using someone else’s name, ID, or Social Security number, or by outright lying about key details. In the private sector, non‑regulated industries lack uniform standards, leaving even bigger gaps in reliable information. [[1]](https://www.shrm.org/topics-tools/news/talent-acquisition/organizations-rely-background-checks-much)

So how exactly are North Korea’s cyber brigades infiltrating companies? They exploit these weaknesses with a coordinated toolkit:

- **AI‑Polished Profiles:** Resumes and LinkedIn pages are often refined with generative AI to showcase flawless English, detailed project histories, and glowing, but entirely fictitious, recommendations.  
- **Synthetic Digital Footprints:** From personal blogs to fabricated GitHub contributions, operatives create online presences that hold up under casual scrutiny.  
- **Shell Companies & Front Entities:** Recruitment firms registered in China, Laos, or Russia act as intermediaries, handling interviews, payroll, and paperwork to obscure the true employer.  
- **Live‑Interview Subterfuge:** For high‑stakes roles, handlers may join video calls using deepfake avatars or voice‑modulation tools, ensuring that even real‑time interviews can’t expose the ruse.  
- **Obfuscated Workflows:** Once onboarded (via VPN or virtual desktop), contractors interleave legitimate tasks with covert activities, exfiltrating data, planting backdoors, or preparing ransomware, while blending into normal traffic.

By layering AI‑driven deception over human‑mediated cover (front companies, forged references, and paid intermediaries), North Korean operatives slip past traditional HR and security controls, transforming routine hires into potent insider threats.

### The Real‑World Fallout

This isn’t just a fancier case of identity fraud, it’s a silent, inside‑attack strategy:

- **Intellectual Property Theft:** One fake developer embedded malicious code that quietly copied client databases overnight and sent them to a server in Eastern Europe, no ransom demand, just silent data exfiltration.  
- **Ransomware & Extortion:** Another contractor pushed a bogus update that encrypted critical files, then demanded seven figures in Bitcoin to restore access.  
- **Backdoor Installation:** Even if they never go loud, these contractors can seed backdoors or inject rogue admin tools, ensuring persistent access even if their cover is blown.

They’re essentially insider threats wearing forged badges, just another employee “living the dream.”

### Remote Work and the Future

Remote work has been a godsend: employees enjoy freedom and lower costs, while employers can cast wide recruiting nets and overcome local talent shortages. But this flexibility also opens the door to new vulnerabilities.

In fact, we’ve already seen a pullback in remote work over the past three years. In 2024, only 20 % of U.S. employees worked from home, down from pandemic‑era peaks above 30 %. For those of us who love the zero‑commute lifestyle, the future of full‑time remote might be less certain.

### Practical Defenses You Can Start Today

You don’t need a multimillion‑dollar security budget to raise the bar. Here are steps you can implement right now:

- **ID‑Checked Video Interviews:** Ask candidates to hold up their government ID next to their face and perform a simple liveness check, blink, nod, or recite a random phrase.  
- **Behavioral Monitoring:** Deploy light‑touch endpoint agents that alert on unusual access patterns, like logins from unlikely time zones or large downloads at 3 AM.  
- **Zero‑Trust Segmentation:** Treat every service call as untrusted. Restrict lateral movement so that even if credentials are compromised, attackers can’t roam freely.  
- **Threat‑Intel Feeds:** Subscribe to DPRK‑specific indicators known aliases, shell‑company registries, and IoCs and integrate them into your SIEM or EDR rules.  
- **HR Awareness Training:** Equip recruiters with cheat‑sheets to spot blank social‑media profiles, mismatched metadata (e.g., GitHub commits predating claimed experience), and candidates unwilling to provide verifiable references.

### Wrapping Up

We’ve come a long way from “just check their resumes.” Today’s adversaries blend AI, social engineering, and state backing to slip under standard vetting processes. By tightening identity checks, monitoring continuously, and embracing zero‑trust principles paired with smarter HR policies you can flip the script on these covert campaigns. Keep doing remote work, but don’t let your guard down.

Stay curious, stay vigilant, and let’s keep the playing field honest one verified hire at a time.  

Discord how North Korean operatives pose as remote IT works to infiltrate companies, the cybersecurity risks involved, and defenses to protect your organization.

How North Korean Operatives Hijack Your Remote IT Roles

**UPDATED: May 8, 2025 16:15 ET**  

Remember the last time you felt bulletproof because your EDR was running? That sense of security can vanish in a heartbeat, especially when attackers use your own installer against you. A recent revelation shows how adversaries weaponize SentinelOne’s signed installers to knock its agent offline—and then drop Babuk ransomware without a hitch.

#### The Sneak‑In: “Bring Your Own Installer”
Think of it like a Trojan horse built with official markings: you launch the install, it shuts down all SentinelOne processes, and before the upgrade finishes, the bad guys pull the plug on msiexec.exe. Suddenly, your endpoint is stripped of its shield, and the attackers stroll right in.

That's exactly what the Stroz Friedberg Incident Response team discovered recently while investigating [Babuk ransomware attack](https://cybersecuritynews.com/babuk-ransomware-group-claims-attack-on-orange/). 

In this scheme, attackers deployed a legitimate, signed SentinelOne installer packages to trigger an agent upgrade. They then kill the Windows Installer process (msiexec.exe) mid‑update, leaving all SentinelOne services terminated and the endpoint unprotected.

With the EDR agent offline, the threat actors were able to install Babuk ransomware (a sophisticated, AES‑256‑based encryptor available as Ransomware‑as‑a‑Service) to lock files and demand payment.

#### Lock It Down Before the Party’s Over
The fix isn’t rocket science, but it does require a quick policy tweak. To defend against this trick, SentinelOne advises enabling the “Online Authorization” policy, which blocks any local upgrade, downgrade, or uninstall without console approval, and recommends monitoring for unexpected version changes and abrupt service terminations in the Event Logs (EventIDs 1, 93, 1042).

![SentinelOne Online Authorization Setting](/images/online-authorization-s1-edr.png)

#### Wrapping Up
The takeaway? Even the best endpoint defenses can be turned into a liability if left unconfigured. By treating your EDR like a living system—one that demands regular checks and policy reviews—you close the doors on stunt plays like “Bring Your Own Installer.” Because when your tools are locked down, the attackers lose their biggest advantage: stealth.


#### Update
SentinelOne has rolled out several new controls and detections to stop this BYOI bypass in its tracks:
- **Local Upgrade Authorization GA** (available since January 19, 2025): blocks all local agent upgrades by default.  
- **“Potential Bring Your Own Installer (BYOI Exploitation)” detection rule** in Library → Detections: flags aborted MSI installs.  
- **Default enablement for new deployments**: new accounts ship with Local Upgrade Authorization turned on.  
- **Agent anti‑tamper & passphrase enforcement**: built into every agent, preventing unsigned uninstall/upgrade attempts.

**Next steps:**  
1. In the console go to **Settings → Agent Management** and confirm **Local Upgrade Authorization** is enabled.  
2. Under **Library → Detections**, enable **Potential BYOI Exploitation**.  
3. Optionally define maintenance windows for scheduled local upgrades.

For full details straight from SentinelOne, see their official announcement:  
[Protection Against Local Upgrade Technique Described in Aon Research](https://www.sentinelone.com/blog/protection-against-local-upgrade-technique-described-in-aon-research/)

Learn how adversaries exploited SentinelOne’s signed installer to disable EDR and deploy Babuk ransomware—and discover the key policies and log‑monitoring techniques to lockdown your endpoints.

SentinelOne BYOI EDR Bypass Vulnerability

Have you ever had that one computer at a specific customer that always seems broken? If you've ever looked at ticket metrics, you might find these devices poking their heads up. We all have them. Devices that are likely under-specced, abused, or neglected. Over the years I've had the opportunity to build scripts that give time back into the company and add value to customers. One of my favorite scripts takes already built-in reporting on Windows devices and turns it into a monitorable service within N-central. Moving us from a reactive style of support to proactive.

#### WinSAT: A Forgotten Tool or a Hidden Gem?
Back when Windows Vista was making its debut, Microsoft tucked in a lesser-known tool called the Windows System Assessment Tool (WinSAT). It didn’t get much fanfare, and like many utilities that ship with Windows, it mostly flew under the radar. But if you know where to look, it’s actually a pretty handy way to gauge hardware performance.

WinSAT was developed in the early 2000s as part of Microsoft’s push to better understand how different PC components stacked up. The result was the Windows Experience Index. That numerical score you used to see, rating things like your CPU, RAM, graphics card, and storage. It wasn’t meant to measure reliability, but it did give users and administrators a consistent way to size up a machine’s performance.

In this script, WinSAT is just the beginning. We also hook into Windows’ Reliability Monitor to grab the system’s Stability Index — a value pulled from the Win32_ReliabilityStabilityMetrics class. That number reflects how stable the machine has been lately, based on crash reports, hardware hiccups, and sudden shutdowns. When combined with performance scores, it paints a much clearer picture: not just how fast a device is, but how well it’s holding up over time.

#### Prerequisites
- Windows PowerShell 5.1 or later
- The WinSAT feature installed (built into most Windows builds)
- Elevated (Administrator) session
- N-central agents deployed

#### Script Breakdown
The two steps of the script will be to run a formal WinSAT assessment, retrieving CPUScore, MemoryScore, GraphicsScore, D3DScore, DiskScore, and BaseScore. The BaseScore is actually the lowest score out of all the metrics compiled. However, for this script I wanted to capture each individual score so I can better understand what scored high and those important things that scored low. Typically the score for these metrics goes from 0.0 to 9.9.

```powershell
# 1. Run WinSAT assessment
Write-Host "Running WinSAT Formal assessment..." -ForegroundColor Cyan
Start-Process winsat -ArgumentList formal -WindowStyle Hidden -Wait

# 2. Grab WinSAT scores
$ws = Get-CimInstance Win32_WinSat
```

The third step is to pull the latest SystemStabilityIndex from ReliabilityStabilityMetrics. This index measures the overall stability of Windows over time. Typically ranging from 1-10, tracks frequency and severity of system crashes, errors, and downtime.

```powershell
# 3. Pull the latest Stability Index
$rel = Get-CimInstance Win32_ReliabilityStabilityMetrics |
       Sort-Object TimeGenerated -Descending |
       Select-Object -First 1
```

The fourth step is to pull in total uptime and unexpected shutdowns over the past 30 days. These are typically the low-hanging fruit when troubleshooting issues so I wanted to make sure I can easily track these separately in the same script.

```powershell
# 4. Calculate uptime & shutdowns
$os = Get-CimInstance Win32_OperatingSystem
$uptimeDays = ([int]((Get-Date) - $os.LastBootUpTime).TotalDays)
$shutdowns30d = (Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    Id        = 41
    StartTime = (Get-Date).AddDays(-30)
}).Count
```

Although the Stability index already takes into account event logs that are critical, it's important to keep track of critical event logs both in System and Application logs. This provides us an early warning just in case the Stability index hasn't dropped in score.

```powershell
# 5. Count critical events in the last 30 days
$since = (Get-Date).AddDays(-30)
$critSys = (Get-WinEvent -FilterHashtable @{ LogName='System'; Level=1; StartTime=$since }).Count
$critApp = (Get-WinEvent -FilterHashtable @{ LogName='Application'; Level=1; StartTime=$since }).Count
```

Finally, we need to put all of the results into a single object so we can output the results both to an N-central Custom Service and output to stdout.

```powershell
# 6. Build a typed PSCustomObject
$report = [PSCustomObject]@{
    CPUScore               = [double]$ws.CPUScore
    MemoryScore            = [double]$ws.MemoryScore
    GraphicsScore          = [double]$ws.GraphicsScore
    D3DScore               = [double]$ws.D3DScore
    DiskScore              = [double]$ws.DiskScore
    BaseScore              = [double]$ws.WinSPRLevel
    StabilityIndex         = [double]$rel.SystemStabilityIndex
    UptimeDays             = $uptimeDays
    UnexpectedShutdowns30d = $shutdowns30d
    CriticalSysEvents30d   = $critSys
    CriticalAppEvents30d   = $critApp
}

# 7. Output each metric for N‑central AMP
$outCPUScore = $report.CPUScore
$outMemoryScore = $report.MemoryScore
$outGraphicsScore = $report.GraphicsScore
$outThreeDScore = $report.D3DScore
$outDiskScore = $report.DiskScore
$outBaseScore = $report.BaseScore
$outStabilityIndex = $report.StabilityIndex
$outUptimeDays = $report.UptimeDays
$outUnexpectedShutdowns = $report.UnexpectedShutdowns30d
$outCriticalSysEvents = $report.CriticalSysEvents30d
$outCriticalAppEvents = $report.CriticalAppEvents30d

$report
```

This script along with a pre-built AMP and service template export can be found on our [Github](https://github.com/chimpsec/N-central-Scripts/tree/main/Windows%20Health%20Score)

#### Importing the Script into N-central
1. Log in to your N-central instance and navigate to the Service Organization Level (purple).
2. On the left-hand navigation, go to Configuration -> Monitoring -> Service Templates
3. At the top of the page you'll see the Import button, click it
4. You'll then want to import the three service templates provided in the GitHub repo
5. Finally, you can build a custom rule for these templates or incorporate them into existing rules

You should see the service on the devices targeted by your rule. Below is an example of the custom service
![Custom Health Score Service](/images/n-central-health-score.png)

Automate Windows health monitoring in N‑central with a PowerShell WinSAT script that reports performance scores, uptime, and critical event metrics for AMP.

Automating Windows System Health Reporting in N‑central with WinSAT and PowerShell

Last year identity-based threats rose to the top of the enterprise risk landscape. Push Security’s latest [findings](https://pushsecurity.com/resources/2024-identity-attacks?utm_campaign=6395777-FY25Q1_Identity-Attacks-Ebook&utm_source=bleepingcomputer&utm_medium=sponsored-content&utm_content=identity+attacks+ebook) highlight a stark truth: attackers are shifting strategies, and legacy defenses are no longer holding the line. What does that mean for the future?

### Identity Has Become the New Perimeter
In 2019 we saw work from home increase drastically causing many IT teams to rethink how exactly they can secure their companies. Fast forward to 2024, with remote work now the norm and SaaS usage exploding, the old idea of a secure network boundary has collapsed. Most day-to-day work happens in browsers, across dozens (if not hundreds) of cloud apps. Oversight is fragmented, and security teams are often in the dark.

Push’s research shows identity isn’t just another attack vector anymore it’s the main one. The rise of decentralized identity systems, inconsistent controls, and overlapping providers has opened the door for attackers. Misconfigured services, forgotten user accounts, and password reuse are being exploited daily.

### Snowflake: The Breach That Shook 2024
Of all the incidents last year, none hit harder than the breach affecting around 165 Snowflake customers. The attackers used credentials stolen by infostealer malware some going back to 2020 to log in without triggering MFA. These long-forgotten, still-valid passwords became skeleton keys for accessing customer data.

In many cases, the attackers didn’t need to hack anything  they simply logged in and ran SQL queries to extract sensitive information. The fallout was massive, sparking debates about shared responsibility, software supply chains, and the future of authentication.

### Smarter Tools, Sneakier Tactics
The playbook has evolved. Phishing tools capable of defeating MFA are now commonplace, thanks to tactics like Adversary-in-the-Middle (AitM) attacks. Tools such as [Evilginx](https://github.com/kgretzky/evilginx2) can intercept tokens in real-time, silently hijacking sessions.

Meanwhile, infostealer malware like [RedLine](https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer) and [Raccoon](https://www.cybereason.com/blog/research/hunting-raccoon-stealer-the-new-masked-bandit-on-the-block) spreads through fake ads, shady downloads, and poisoned GitHub repos. These programs quietly lift credentials, cookies, and even screenshots feeding a booming underground market.

Session hijacking has also grown more efficient. Instead of stealing passwords, attackers steal session cookies, which can give them instant access without MFA. Many cookies remain valid for days or weeks, offering plenty of time for exploitation.

### The Usual Suspects and Some New Faces
Several threat actors stood out in 2024:

- [APT29](https://attack.mitre.org/groups/G0016/) (Cozy Bear): Allegedly tied to Russian intelligence, they used low-tech methods like password spraying and rogue OAuth apps to compromise enterprise accounts often starting with test accounts lacking MFA.
- [Scattered Spider](https://attack.mitre.org/groups/G1015/): English-speaking and highly coordinated, this crew leaned on SIM swapping and helpdesk social engineering to bypass MFA and move laterally through cloud environments.
- [ShinyHunters](https://socradar.io/dark-web-profile-shinyhunters/): Believed to be behind the Snowflake attacks, they automated credential stuffing using data from malware logs frequently from unmanaged devices. When law enforcement caught up, millions in extorted Bitcoin and a trove of stolen data came to light.

### MFA and SSO: Helpful, But Not Bulletproof
MFA and SSO are widely adopted, but Push’s findings make clear that they’re far from foolproof:

- Not everything supports SSO, and users often bypass it with direct logins.
- MFA might be enabled at the IdP, but many apps don’t enforce it locally.
- Local logins remain open, especially in apps that allow password-based access on top of SSO.
- Shadow SaaS apps often never make it into the SSO system at all.

Even though just 1% of breached credentials are still valid, attackers operate at such a scale that they only need one hit to succeed. It’s a volume game.

### What Comes Next And What Needs to Change
Push’s report closes with a clear warning: as cloud adoption deepens and attackers refine their methods, identity will remain the primary battleground. It’s no longer just a means of access it’s the attack surface itself.

To counter these threats, organizations need to invest in Identity Threat Detection & Response (ITDR). That means:

- Enforcing tighter session controls and reducing cookie lifetime
- Applying MFA consistently at the app level not just at the identity provider
- Gaining visibility into unmanaged devices and unsanctioned apps
- Making credential hygiene like regular password rotation a non-negotiable

In 2024, identity moved from being a point of concern to the very heart of the breach. As cyber threats grow more agile and sophisticated, security teams can no longer afford to treat identity as a routine item on a checklist. It must be recognized as a cornerstone of modern defense. Yesterday’s tools and approaches won’t hold up against the evolving tactics of today’s attackers. To stay ahead, security leaders need to reexamine their approach to identity, reinforce the weak spots, and shift from simply reacting to actively preventing before the next incident unfolds.

Explore the 2024 identity crisis - Snowflake breach, MFA-bypass phishing, and why Identity Threat Detection & Response is critical to locking down cloud apps.

The Identity Crisis of 2024

We don't talk about this enough.

Not in Teams meetings, not in Slack channels, and definitely not in all-hands calls, but every day, in the not-so-quiet moments between tickets, patch rollouts, and end-user escalations, the conversations happen.

Behind the scenes, your techs, engineers, and front-line people are talking. What they’re saying might surprise you.

This isn’t a gripe session or a list of demands. It’s an honest letter from those who spent years in the trenches, directed to those steering the big MSP ships. If your goal is to build sustainable, high-performing teams in this industry, we’ve got to get real about what matters to the people doing the work.

# Truth #1: We Are Not Family

When I hear a company say things like "Our employees are like family", the first thing I think is "What do the employees think?" Typically this saying is masking a poor culture or unrealistic expectations. To be fair, I think some owners and managers say this to foster a sense of camaraderie but families aren't asking you to skip your vacation because someone else quit, or asking you to prove you are working by updating tickets every 15 minutes. There’s nothing wrong with acknowledging what this really is: a professional relationship. We exchange time and energy for money. That’s not cold or cynical; it’s honest. And ironically, honesty creates more trust than pretending we’re something we’re not.

There are 8,760 hours in a year. On average, we spend 2,920 of those sleeping and another 2,080 working. That leaves just 3,760 hours—less than half the year—for everything else: family, hobbies, rest, and simply living. And that’s before we account for things like overtime, commuting, or the time we spend mentally stuck at work even after we clock out. Every working human sacrifices almost a third of their life working so they can live.

Let that simmer for a minute. We spend a third of our lives working, just so we can spend a third of our lives actually living. 

We aren't working for fun, we work to live. The last thing we want in a professional relationship is trinkets, gift cards, and pizza parties. We want fair wages, clear career paths, being heard, and less time wasted. Being a "family" doesn't keep your employees happy; it actually pushes them away. This overuse of "we're a family" can create a sense of obligation that goes beyond a standard professional relationship. Sometimes this leads to situations where the employee's boundaries are constantly tested. This ultimately leads to burnout, resentment, and sadly turnover. If you value your employees then provide them with:

- Clearly defined roles, responsibilities, and performance expectations.
- An environment where they feel comfortable voicing concerns and providing feedback without fear of reprisal.
- Competitive salaries and benefits that reflect the value of the work being performed.
- Opportunities for professional development, training, and career advancement.
- A healthy work-life balance.

# Truth #2: Your MSP is Not Unique
In 2019, ConnectWise’s then-COO Geoffrey Willison estimated there were over 40,000 MSPs in the United States alone. By 2020, 8,000 of them were expected to dominate the majority of the available revenue. [1]

Most MSPs offer the same promise: to take the weight of technology off their clients’ shoulders. Although the tools, verticals, or branding might vary, the core services are often similar. The hard truth? Your MSP probably isn’t doing something radically different. And that’s okay. What does make a difference is how you treat the people delivering those services.

Profit margins might define success, but an MSP that understands both its customers and employees is truly successful. It's one of the largest key differentiators for any MSPs: how they treat their employees. Good employees don't want to work for bad MSPs just as much as good MSPs won't want bad employees. People will always be your greatest resource as an MSP, inside and out. When employees are treated well and invested in, they provide top-tier services. Those services will make you stand out next to competitors.

# Truth #3: Non-Technical Managers Hurt Good Employees
There is a long list of debates on whether non-technical managers provide value to tech-centric companies. None of us expect upper management to be tech experts. It will certainly help earn the respect of your employees but isn't a requirement. However, when we talk about middle management, nothing throws a wrench in a good process like a non-technical manager. Don't get me wrong, I know some pretty solid non-technical managers who know exactly who to call for technical answers but those are few and far between.
ds
Management skills are essential for managers and let's be honest, it's a very hard skill to learn. Most of the great leaders are just naturals at it. Again, very rare. This lack of technical knowledge creates challenges and frustrations for your technical staff. Non-technical managers tend to struggle in:

- Understanding the complexities of technical issues: This can lead to unrealistic expectations, poor resource allocation, and ineffective problem-solving.
- Make informed decisions: Without a grasp of the underlying technology, managers may make decisions that negatively impact the team's ability to deliver services.
- Communicate effectively with technical staff: Technical staff may feel that their manager doesn't understand their challenges or appreciate their expertise, leading to communication breakdowns and resentment.
- Provide adequate support and mentorship: Non-technical managers may lack the knowledge to guide and mentor technical employees, hindering their professional development.
- Gain the respect of their team: Technical staff may question the credibility and leadership of a manager who lacks technical proficiency.

These things lead to decreased morale, increased stress, and higher costs due to turnover but you can avoid these issues by prioritizing things like:

- Promoting experienced technical staff into management positions. These individuals possess the technical expertise and understand the day-to-day challenges of the work.
- Providing non-technical managers with ongoing technical training to bridge the knowledge gap.
- Encouraging open communication and collaboration between technical teams and management to ensure that technical considerations are factored into decision-making.
- Ensuring that technical staff feel their expertise is valued and appreciated. This can be achieved through competitive compensation, opportunities for professional development, and recognition of their contributions.

# Truth #4: Metrics Aren't Everything
Every MSP help article you find online will mention KPIs in some form or fashion. They play a crucial role in keeping a finger on the pulse of your company. Companies make the mistake of blindly following metrics as the primary source of truth. This can really throw you off the right path. In short, metrics don't tell the whole story and an overreliance on metrics can have negative consequences. A large consequence is tunnel vision. Some employees may focus on only hitting the metrics established which causes them to lose sight of other areas that may not be measured like quality of work, customer service, and team collaboration. These metrics often lead to short-term thinking at the expense of long-term sustainability.

These metrics establish a culture of fear and anxiety, often crippling innovation. We've all had employees "game the system". Some will find ways to boost those metrics, and some may even find ways to bypass them. Metric culture makes managers feel like the needle is moving but in fact, the pressure tanks are about to blow.

The worst of all is when metrics fail to capture the nuances of individual situations. A good manager can identify these mishaps but there are going to be times when you can't trust the metrics. Instead, you invest time in understanding how your employees work, and the common issues they face day to day, and remove those obstacles. If you have an employee not hitting their numbers, your first instinct shouldn't be calling them out. It should be gathering more information to properly gauge the situation.

The real question is how can we avoid these issues altogether. Try to use a mix of quantitative and qualitative measures. Gather feedback through check-ins, employee surveys, and client feedback. Find a way to measure or take into account the impact of an employee's work, not just the volume of their activities. Be open to feedback, don't just ignore their input. Nothing destroys a good employee like management's deaf ears. Acknowledge and reward employees and no that doesn't mean more pizza parties or trinkets. Remember, we work for money. If we provide more value, make sure their paycheck reflects that value. Finally, whatever you do, please don't use metrics as a tool for punishment. You should be framing metrics in a way that shows areas that can improve and provide support to help them grow.

# Truth #5: Retention is the New Recruitment
The recruiting landscape is getting scarce. The economy is tanking and we all feel it. MSPs can't afford to lose good employees right now. SHRM's 2024 Talent Trends says that "over 3 in 4 organizations have had difficulty recruiting for full-time regular positions while nearly half have had difficulties retaining full-time regular employees in the last 12 months." [2]

Losing good employees is an early indicator you are doing something wrong. That could be due to culture, payroll, bad management, you name it. I sat in many meetings during COVID-19 talking about customer churn and how it had the ear of every upper management member. I don't remember sitting in meetings talking about employee churn. That churn in my opinion is far worse than losing customers. You are going to lose customers, that is completely normal. When you lose good employees, I'd argue you are losing so much more. Things like institutional knowledge, invested time and training, recruiting investments, and the happiness of existing employees.

Hiring is a pain. It typically takes new employees up to two months to get their footing. These new employees have to be trained which takes away key employees from their day-to-day work. In reality, these employees will never be fully trained. At least not to the level of your existing employees. It'll take them much longer to provide a return on investment. During that time, both the new employee and existing employees may get frustrated. In some rare cases, those new employees could even rage quit. Feeling they were set up for failure.

By prioritizing employee retention, MSPs can create a more stable, engaged, and productive workforce, leading to improved client satisfaction and business success. Investing in your people isn't just the right thing to do; it's the smart thing for your business. Which of these truths resonates most with you? Let us know how you're prioritizing your team's well-being and seeing the positive impact on your MSP's success.

### Sources:
- [1] [Which Major Forces Will Disrupt the MSP Market in 2019?](https://www.connectwise.com/blog/managed-services/which-major-forces-will-disrupt-the-msp-market-in-2019#:~:text=By%202020%2C%20just%208%2C000%20out,most%20of%20the%20available%20revenue)
- [2] [SHRM 2024 Talent Trends](https://www.shrm.org/content/dam/en/shrm/research/2024-talent-trends-research-overall-findings.pdf)

MSP insiders open letter shares 5 hard truths — family culture fails, metrics mislead & retention beats hiring—to build happier, high-performing teams.

5 Truths Every MSP Owners Need to Hear: An Open Letter from the Trenches

Last time, we talked about how SSL/TLS certificates are getting shorter and shorter, with lifespans potentially dropping to just 47 days by 2029. Sounds like a headache, right? Who wants to manually renew certs every month and a half?

In this follow-up, we’re diving into how you can automate the process using ACME (Automatic Certificate Management Environment), and we’ll check out some of the tools already available to make cert renewals something you don’t have to think about.

---

#### What is ACME?

ACME was created in 2016 by the Internet Security Research Group. It was originally created to power certificate services for [Let’s Encrypt](https://letsencrypt.org/about/). 

The original ACME version was groundbreaking, even though it only supported single domains. In 2018, ACME v2 took things to the next level by adding support for wildcard certificates, multiple subdomains, and domain ownership verification. Adoption skyrocketed when the Internet Engineering Task Force (IETF) officially standardized the protocol in RFC 8555 in 2019. With v2 paving the way forward, ACME v1 was officially phased out in June 2021.

#### How Does It Work?

An easy example would be hosting a web server like IIS or Nginx and you want to serve content over HTTPS. To do that, you’ll need a valid SSL/TLS certificate. In a manual process, you'd typically generate a CSR, go to your favorite web hosting company, and purchase a certificate. You'd then need to take that certificate and add it to your web server. This wasn't always a pain if you had a cert that was multiple years old. Could you imagine doing that process every 47 days? 

An ACME client can run on that web server and handle certificate-related tasks like issuance and revocation. The client talks directly to a Certificate Authority (like Let’s Encrypt), handles domain verification, and retrieves your certificate. Some tools even go a step further, automatically applying the new certificate to your web server configuration saving you from manual steps.

#### What Tools Are Available?

A quick [GitHub search](https://github.com/topics/acme-client) shows over 130 public repositories tagged with "acme-client." Some of the more popular tools you might’ve heard of include Certbot, Certify, and others each built with a specific use case or platform in mind. The best part? Most of them are completely free.

Of course, there are also paid tools that offer enhanced features and support often well worth the investment in the right environment. One solid example is [Certify The Web](https://certifytheweb.com/home/features), a Windows-based application that simplifies ACME automation. It can directly update IIS, Remote Desktop Services, and other Windows-based web services with freshly issued certs no manual effort required.

#### Why Should We Automate?

Having worked with various MSPs over the years, I’ve seen more than a few outages caused by certificate issues. When they hit they are inconvenient and these outages come with risks. Be it security, cost, relationships or sanity. It might take you some time to automate the process but that will be time saved in the future. With prebuilt tools at your finger tips, you are closer than ever to fully automating your certificate management.

By automating: 

* Minimize human error
* Improve security posture
* Reduce the risk of service outages
* Enhance your compliance standards
* Have peace of mind

#### Ready to Ditch Manual Cert Renewals?

The shift to shorter SSL/TLS lifespans isn’t slowing down but with the right tools and a bit of setup, it doesn’t have to be your problem. Start exploring ACME-based automation today and take “expired certificate” off your list of potential fire drills. We are here to help, whether you're managing one server or a fleet, automation is the future and it’s never been more accessible.

Discover ACME automation for SSL/TLS - slash manual cert renewal, auto-renew 47-day certs with Certbot, Certify & more—boosting uptime, security, compliance.

SSL/TLS Certificate Automation

Big news just dropped that's making waves across the cybersecurity space: SSL/TLS certificates are on track to have a maximum lifespan of **just 47 days** by 2029. That’s right, less than two months. A drastic change to the current 398-day lifespan. Why the change? What does this actually mean for us?


### A Quick Look at the Timeline

This isn’t happening overnight, but we are heading in that direction. Here's how certificate validity has been trending over the years:

- **Way back when:** Multi-year certificates were common.
- **Then:** We moved to a 2-year limit.
- **Now:** Most certificates max out at around 1 year.
- **Coming by 2029:** A max validity of just **47 days** (according to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/ssl-tls-certificate-lifespans-reduced-to-47-days-by-2029/)).

That’s a pretty steep curve toward shorter and shorter certificate lifespans.


### Why Shorter Certificates?

So, why the push to trim things down? Here’s what’s driving the change:

- **Better Security:** If a certificate or its private key gets compromised, a shorter lifespan means it won’t be valid for long. That minimizes damage.
- **Faster Adaptation:** Shorter certificates make it easier to adopt new encryption standards or respond to new threats quickly.
- **Reduced Risk of Misissuance:** More frequent renewals mean certificate authorities (CAs) have more chances to validate domains correctly and catch anything suspicious.

In short, it’s all about staying nimble and keeping things secure.


### What This Means for You

Whether you’re managing a single website or a fleet of enterprise systems, this change is going to affect you:

- **More Frequent Renewals:** You’ll need to renew certificates much more often, every few weeks instead of once a year.
- **More Admin Work (Unless You Automate):** Without automation, managing certs this frequently could become a nightmare.
- **Automation Becomes Essential:** Tools that can handle certificate requests, renewals, and installations automatically will be your new best friend.
- **Potential Cost Bumps:** Even if certs don’t cost more per unit, the added workload (if manual) could mean more time, effort, or even third-party service costs.


### How to Get Ready

The idea of 47-day certs might sound like a logistical headache, but it doesn’t have to be. Here’s how you can get ready:

- **Start Automating Now:** Whether it’s with built-in tools, scripts, or third-party platforms, now’s the time to build a solid automation workflow.
- **Use Centralized Certificate Management:** Keep tabs on all your certificates in one place. Visibility is key when things start expiring every few weeks.
- **Stay in the Know:** Keep up with security best practices, and watch for updates from CAs and browser vendors.
- **Consider Using ACME:** The [ACME protocol](https://datatracker.ietf.org/doc/html/rfc8555) (used by Let’s Encrypt, for example) is built for automatic certificate issuance and renewal.


### The Future: Shorter, Smarter, Safer

Constantly updating certificates can be a pain, but in the grand scheme of things, this move is a good thing. It means fewer risks, more agility, and a more secure web for everyone.

**So—are you ready for 47-day certs?**  
2029 isn't that far off, we recommend working on this automation now so you can be prepared. If you need help with the automation, feel free to reach out or check out what your automation options are in this [blog post](https://chimpsec.com/posts/ssl-certificate-automation).


###### Source:  
[SSL/TLS Certificate Lifespans Reduced to 47 Days by 2029 – Bleeping Computer](https://www.bleepingcomputer.com/news/security/ssl-tls-certificate-lifespans-reduced-to-47-days-by-2029/)

SSL/TLS cert lifespans plunge to 47 days by 2029 — discover why shorter validity boosts security, the renewal hurdles ahead, and must-have automation tactics.

security

The Identity Crisis of 2024

Brace Yourselves: SSL/TLS Certificate Lifespans Are Shrinking Fast!

SentinelOne BYOI EDR Bypass Vulnerability