Watch the full episode below or listen on Apple/Spotify Podcasts. (Check out more episodes on our Gone Phishing page!)
00:00:00:12 - 00:00:23:20
Connor Swalm
Welcome to Gone phishing, a show diving into the cybersecurity threats that surround our highly connected lives. Every human is different. Every person has unique vulnerabilities that expose them to potentially successful social engineering. On this show, we'll discuss human vulnerability and how it relates to unique individuals. I'm Connor Swalm, CEO, Phin security, and welcome to Gone phishing.
00:00:29:00 - 00:00:37:17
Connor Swalm
Hey, everyone, we'd like to welcome aboard Kyle Spooner to another episode of Gone phishing. I'm your host, Connor. Kyle, how are you doing today?
00:00:38:01 - 00:00:38:16
Kyle Spooner
Great.
00:00:39:05 - 00:00:54:11
Connor Swalm
You are doing great. That's amazing. So last time we had you on, we discussed I want to say everything MSP, but I'm pretty sure that's a company somewhere. But we talked about MSP. We did an MSP. If you want to give a highlight of what you're talking about.
00:00:55:05 - 00:01:01:19
Kyle Spooner
An MSP is basically it's a company that offers services that they met. That's at the core of it.
00:01:02:12 - 00:01:14:06
Connor Swalm
That is. Yeah. I guess I ask for top level that definition. I got the top level definition. It is somebody who does I.T. infrastructure, other services for businesses, anything.
00:01:14:06 - 00:01:17:19
Kyle Spooner
And everything that they're asked that pretty much sometimes to the detriment.
00:01:18:22 - 00:01:35:18
Connor Swalm
And for those of you who may have not caught the last episode, Kyle works at an MSP and phinn serves MSP. So we have been while Kyle has been around for a little bit longer than I have in the industry. But we are both neck deep in the industry. I'll say neck deep in industry.
00:01:36:00 - 00:01:37:03
Kyle Spooner
Yeah. Thank you.
00:01:37:22 - 00:01:54:11
Connor Swalm
So on the last episode, you're talking about a MSPs and the people who provide the services or a large portion of them are MSP technicians. And you explain an MSP technician, generally speaking.
00:01:54:19 - 00:02:32:16
Kyle Spooner
In MSP technician, as someone who is able to take a problem ticket and resolve that problem. However, being in I.T., not all problem tickets are the same. And a lot of times people, companies will group the tickets into individuals who can solve the the most efficient password reset stuff that can be go into lower end technicians who it doesn't require someone who's very expensive to the managed service provider, they'll need to be doing very it's just not a good use of their time and talent.
00:02:34:14 - 00:02:55:05
Kyle Spooner
But there's it breaks down into individual like there's project engineers who are who can do technical work. There's security engineers. There's a even getting it to the point of data center, cloud security cloud engineers specializations with Microsoft also existing MSP space.
00:02:55:05 - 00:03:09:02
Connor Swalm
There's a bunch of specializations. Sounds like there's a stratification of short. So it's almost like trying to enter levels here. There's a level I've heard of level one, two or three taxes or anything other than level one, two and three.
00:03:09:16 - 00:03:34:05
Kyle Spooner
Yeah, I've heard them going up to level five, four and generally most of the time it's level three. And then you go into a specialization either with a specific category of products, like I'm Azure, like I'm, I work with as you are all the time Active Directory issues that's me or I'm a project engineer, I do projects, I do high level mass projects for clients.
00:03:34:08 - 00:03:47:16
Kyle Spooner
That's me, right? That's, that's whatever that can be. But generally there's level one, level two and level three. And sometimes there's a low level zero can exist as well. Those who are interning or training.
00:03:49:09 - 00:03:53:19
Connor Swalm
That implies the existence of a level Infinity MSP technician, the final boss.
00:03:54:20 - 00:03:58:23
Kyle Spooner
But he's still probably doing password resets.
00:03:58:23 - 00:04:10:18
Connor Swalm
Which unfortunately what's what's the biggest difference between the certain level. So I'm assuming it's at least a little bit more education, maybe a little bit more time on the job. But what else?
00:04:11:03 - 00:04:53:19
Kyle Spooner
This this question is a difficult question to answer because there is no right answer. There's no there's nothing. There's just cert. You get that sense. I'm a level one technician. I'm a level two mission where I'm level 2.5 technician. Right. But generally, as the scale goes up, the ability to solve problems and their ability to think critically and understand what they're doing is how I see them going up a level one technician is very new and someone who can do password resets and who understands the basics of the systems and how to get around and is able to at least start to beginning to think about what they're doing.
00:04:54:00 - 00:05:29:12
Kyle Spooner
Like if they're doing a password reset, is the person on the phone that I'm on the phone with, actually the person I need to reset their password. Right. There's there's that type of stuff to start for level two has that understanding already and can solve more critical issues or more complicated issues where it's not necessarily I need to turn my printer off and on again or reboot the machine, even though they're probably going to do that at the first step anyway, because it's just smart, but they're going to be able to actually diagnose and troubleshoot issues and then level three would be able to solve issues.
00:05:29:13 - 00:05:40:10
Kyle Spooner
Level two can't level one. And they go into deeply complex problems that require generally multiple hour resolutions to troubleshoot, figure out what the actual issue is.
00:05:40:19 - 00:05:51:02
Connor Swalm
It sounds like it's the complexity of the issue goes up, the level of technician you need to go with. I don't think that should be a surprise that much, folks.
00:05:52:02 - 00:06:29:12
Kyle Spooner
The problem is determining when where the cutoff is. And no one has a specific determination of that. And it's always a personal feeling I can get to it. My speeds will not have, if the odds are low that they will have the exact same feeling on a specific engineer. If that's your once you doing your we put in we have a specific questionnaire that we give out that people answer that will allow us to determine pretty close accuracy where someone is on the technical skill level scale.
00:06:31:03 - 00:06:42:01
Connor Swalm
Does that include like actual like a like a technical analysis? You give them a job and they have to perform it or is it just like, are you caught question these things, who are you? What gives you the right? No.
00:06:43:12 - 00:06:49:14
Kyle Spooner
I didn't develop this. I want to be ultimately clear. I'm not that guy, Mindy Green, who I'm sure you know.
00:06:49:22 - 00:06:50:21
Connor Swalm
I know Mandy.
00:06:51:09 - 00:07:14:14
Kyle Spooner
He developed this. It's four questions I have to look up again. But like, one of them is like, can you can you tell me the difference between ftf and if I ntfs file system and a share permission? Do you know what it's it's a network a question about.
00:07:14:14 - 00:07:18:20
Connor Swalm
I only know FAT32 yeah. Okay so instead to find.
00:07:18:20 - 00:07:45:00
Kyle Spooner
Out it basically how they answer the questions is how we determine what they do. If it's a single answer with very little detail, then they're probably going to be a lower end technician. But it's more of the quality of the answer that they provide and what details that they provide is generally how we can tell how their area.
00:07:45:00 - 00:07:58:06
Connor Swalm
Other than like this test that you that you guys have came up with on your own. You said there's no like certification you can go get. Is there something that people use an approximation?
00:07:58:06 - 00:08:37:01
Kyle Spooner
Not that I'm aware of. It's just it's the feeling generally that they that they generally go with. I've known individuals who have said they were level three. That was their title. They're a level three engineer who I would put on password resets and their level one engineers who I would give the most complex issues here. It's just sometimes someone's like, what's if you're promoted to the highest level, like the level above the level you need to be at or something like that of is a quote about it.
00:08:37:01 - 00:08:40:14
Kyle Spooner
I have to look it up pretty good time for that to.
00:08:40:14 - 00:08:41:16
Connor Swalm
Be a good time. But yeah.
00:08:42:05 - 00:08:45:00
Kyle Spooner
But it's that's, it's just a feeling.
00:08:45:16 - 00:09:00:21
Connor Swalm
It's just a feeling. I've heard of some folks trying to use like security and network certs from like comp TIA as a weird stand in. But even then that's not totally level one, two and three.
00:09:00:23 - 00:09:28:06
Kyle Spooner
Fortifications like that aren't indicative of your ability to solve problems. And at an MSP that is your job is to solve problems. Sometime that problem is as simple as resetting a password or putting in a printer, but it's the ability to understand that that's the actual problem. That's the root cause of what the user's complaining about. Because even in a password reset, if you reset that password, that affects multiple thing.
00:09:29:02 - 00:09:57:21
Kyle Spooner
For instance, you have email on your phone that constantly reports back and if it logs in multiple times, it'll lock you back out because it's using the password and the user calls by saying, Hey, just reset my password, I'm locked out again. Can you reset it again? Like and it just this this cycle. But if that you have to be able to determine this is the root cause and what other things might be doing this action are going to also have an effect or I need to look out for.
00:09:59:00 - 00:10:23:03
Connor Swalm
Having like a higher level understanding of you're not just taking a ticket and solving well, that is essentially what you're doing from a task standpoint, but that has real world impacts on real businesses and real people. Yes. How do you know? An MSP is well trained now, obviously. You know, I can stay. They recognize the impacts they're going to have on the businesses and the people that they're doing things for.
00:10:23:03 - 00:10:31:05
Connor Swalm
But is there I already kind of asked about a test and you said there's four questions. But what if it was evidence of someone being trained in these areas?
00:10:33:01 - 00:11:03:06
Kyle Spooner
It's it's difficult to train someone because a lot of times experience it's the best method to train in reviewing your your ticket that you've done and what you did wrong. And even if there's very little you know, you always want to look at improving but and doing stuff on your own. Like if you encounter a problem with setting up a properly, make yourself a home, train yourself, figure out what the issue is, troubleshoot on your own.
00:11:03:06 - 00:11:14:08
Kyle Spooner
I mean, I have a home lab. I've had a home lab since I was able to afford one on a tiny desktop from an obtained copy of Windows Server 2012, maybe 28 hour to.
00:11:15:10 - 00:11:16:06
Connor Swalm
What's a home lab.
00:11:17:04 - 00:11:38:16
Kyle Spooner
It's basically just a setup of either that actual server that you're able that's a hand-me-down. If someone was going to crash or a desktop that's running a server OS allows you to just play and mess around and to to do things that you can't necessarily do on a production machine. And it's generally not the companies, it's yours. So that's my goal at home lab.
00:11:39:13 - 00:11:53:01
Connor Swalm
That makes sense. Is, is there anything you're doing personally at Insert MSP to help educate MSP techs?
00:11:53:01 - 00:12:19:14
Kyle Spooner
Yes. We are having a conference that's specifically designed to educate technicians of managed service provider. It's an area that's not that. There's there's no single rule to allow you to do so. We decided to start teaching thing at this conference that we want to do. They want to provide. And a lot of MSP business owners are struggling to hire, hire and technicians.
00:12:19:14 - 00:12:46:09
Kyle Spooner
Right. So we took the path of instead of finding that one unicorn, why don't you make one right? We're not handing out a certification like a microsoft CC that that engineer can go and shop around that you may be worried about or the business owner might be worried about. We're teaching them the korvac, the core skills to be able to do their job more effectively and more efficiently, hopefully faster.
00:12:46:09 - 00:12:57:06
Kyle Spooner
It's something that hasn't been done before either, which is fantastic and worrisome. As someone who is throwing the conference, I want to make sure it lands properly.
00:12:58:06 - 00:13:03:19
Connor Swalm
It'll be exciting to watch. It's like go into somebody else's wedding. You get to eat all the food, drink all the drink and then leave.
00:13:04:08 - 00:13:04:15
Kyle Spooner
Yeah.
00:13:05:03 - 00:13:10:05
Connor Swalm
That'll be me for you. It's. Yeah, you know, you got to show up. You're the you're not only the bride and groom, you are the officiant as well.
00:13:10:08 - 00:13:12:20
Kyle Spooner
Yep.
00:13:12:20 - 00:13:13:11
Connor Swalm
That'll be fun.
00:13:14:08 - 00:13:34:12
Kyle Spooner
I'm honestly looking forward to it. It's going to be a real good time. We have a lot of we handcrafted. We took the what we wanted to do and we built out a plan of what we wanted to teach. And we architected that plan. And then we went to a bunch of different speakers that we felt would be good talking.
00:13:34:14 - 00:13:49:03
Kyle Spooner
We wanted to make sure they had expertize in the topic. We were talking to them and then they could eloquently deliver what we wanted them to talk about. And so it's all handcrafted. Like this is it's something that says, I want to talk here. No, we went to them and said, Hey, we want you to talk about this.
00:13:49:03 - 00:13:58:09
Kyle Spooner
Can you give us let's do some back and forth to see if this works out. And it is. So it's going to be fantastic that the lineup is going to be great. Okay.
00:13:59:04 - 00:14:01:07
Connor Swalm
When when is speaking kind of happening.
00:14:01:22 - 00:14:06:00
Kyle Spooner
May 21st of the 23rd in Orlando.
00:14:06:00 - 00:14:13:22
Connor Swalm
All right. So everyone should go buy their tickets or should they just find a way to damn you on LinkedIn with fake profiles to get online?
00:14:14:18 - 00:14:33:10
Kyle Spooner
I mean, you can do that. I will happily provide you like but you can go to MSP geek corncob all the information is there, the agenda, the overview that you can provide your supervisor if you'd like. For those who are owners as well as the full program, you're talking about it, who's talking awesome?
00:14:33:10 - 00:14:56:16
Connor Swalm
And I will be there as well along with I don't think we've identified how many team members, but a bunch of us then people will be there as well. So it'll be a lot of fun. I believe we're having you on next time as well. So next episode we're going to be talking about automation. So the hint is in order to make an MSP tech way more valuable, they automate the tasks that are eatable.
00:14:57:00 - 00:15:05:23
Connor Swalm
It's just a little sneak peek for everybody. But. But, Kyle, thank you so much for being here, sir. Any last words you'd like to say to everyone before catching you next time?
00:15:06:18 - 00:15:11:14
Kyle Spooner
No, don't put me on the spot, because that.
00:15:11:14 - 00:15:36:23
Connor Swalm
All right, you heard it. His words were, no, don't put me on the spot. So everyone, I am Connor. We had Kyle Spooner today on the podcast and I will see you on the next episode of Gone phish. Thanks so much for tuning in to go on phishing. If you want to find out more about high quality security awareness training campaigns, how to launch them in ways that actually engage employees to change their habits.
00:15:37:05 - 00:15:52:01
Connor Swalm
Then check us out Phin security at phinsec.io. That's in some scenario or it's all of the wonderful links in our show notes. Thanks for phishing with me today and we'll see you next time.