In my work with CDW clients, I often have the opportunity not only to help them select cybersecurity technologies, but also to determine how best to integrate these tools into their operations. That’s deeply satisfying work, and I got to experience it recently when I worked with a major financial services firm on its deployment of next-generation firewall (NGFW) technology.

The firm had relied on traditional port- and protocol-based firewall rules for many years and wanted to migrate to more modern technology to improve its security posture. We identified the right product for the customer by comparing the firm’s unique needs to common NGFW capabilities. We then helped the firm implement its chosen solution in a way that minimized disruptions while advancing the organization’s security posture.

IT is often underfunded in midsize businesses, and for the most part, IT teams focus their efforts on keeping things running, following the old adage, “If it ain’t broke, don’t fix it.” That works well in most areas of infrastructure, but it can lead to disaster when applied to cybersecurity.

Fortunately, I’d encountered this situation before and was able to offer some advice based on my work with other customers. The company’s IT team could quickly ramp up its security capabilities by taking advantage of managed security services. These service offerings would enable the organization to gain the expertise of cybersecurity professionals without increasing the size of its own IT team. Instead, the company would depend on a managed service provider to augment its technology staff. The MSP would be able to spend more time on security than the company’s in-house professionals, and it could provide specialized expertise.

We looked at four areas where managed services could have an immediate impact on the company.

Earlier this year, I broke into the network of a large teaching hospital located in a major U.S. city. It wasn’t difficult, and I did so without using any sophisticated technical skills. My weapon of choice? A dress shirt and a pair of khakis.

Dressed like your typical IT professional, I walked the hallways of the hospital carrying a laptop, looking for a target. I found a maintenance technician repairing a section of the floor and approached him, saying, “Hi there, I’m Mike from IT, and I’m trying to fix the network. I left my badge downstairs, and I really don’t want to walk back there. Is there any chance you could let me into this network closet?”

“Sure, buddy, no problem,” he replied. He stood up, walked over to the door and swiped his ID card, letting me into the network closet. Once I was in, I quickly attached a small device to the network switch that opened a reverse connection, giving my entire team remote access to the hospital’s internal network. Now, let me explain myself. I’m not a criminal — I’m a penetration tester with CDW’s Amplified Security services team, and organizations around the country hire me to perform tests just like this one. I work to help business and technology leaders understand the risks facing their organizations and develop strategies to better secure their networks, systems and people from attack.

As a member of CDW’s cybersecurity incident response team, I spend much of my time working with organizations in the heat of a crisis.

Whether they’re in the middle of an active network compromise or they’ve fallen victim to a ransomware attack, my team steps into emergency situations and helps companies get back on their feet as quickly as possible. In that respect, our team is much like a battalion of firefighters.

The most exciting part of my job occurs when I have the opportunity to visit with a new client organization and help its leaders assess their security infrastructure and remediate any vulnerabilities. I enjoy being able to examine the current state of their cybersecurity programs and help them redesign elements to better address the modern threat environment.

Recently, I had the opportunity to engage in this type of work with one of CDW’s customers — the government of a midsized county. As we worked through the assessment, we identified two core issues that required immediate attention. First, the county’s network firewall platform was quite outdated, running technology that was over a decade old. The devices still functioned, but they were designed to protect against the threats of 10 years ago, not today’s advanced persistent threats. Our first core recommendation was that the county replace this aging firewall infrastructure with a modern next-generation firewall (NGFW) designed to stymie today’s attackers.

We also realized that the core of the county’s network lacked essential security controls. If someone gained physical access to the building and connected any device to the network, the attacker would have open access to all types of resources. There was no internal access control restricting the devices that could connect to the network and limiting the authorization of those devices based on the identity of the user. The county urgently needed a network access control (NAC) solution to address these risks and protect its network.

A lot of attention gets paid in the press to “zero-day” threats — attacks that wreak havoc on organizations while they’re still completely unknown to the cybersecurity community. But the truth is that 60 percent of breaches are the result of known vulnerabilities that have been left unpatched.

The problem is that patching practices in many organizations are slow and disorganized. Too many teams are in charge of patching too many different systems, and security leaders typically lack visibility into who is staying on top of patching and who isn’t. The good news is that many organizations already have a powerful tool to help streamline vulnerability management — the service management platform ServiceNow. Although some organizations use the platform primarily to manage help desk tickets, it’s capable of much more. The solution can also help organizations shore up vulnerabilities across their IT environments.

Here’s how.