Getting ready to procure managed services to help support or augment your security team? You’re not alone: 62% of organizations said they plan to outsource some or all of their IT security functions in 2022, according to the Foundry 2021 Security Priorities Study.

Before going down that route, it’s wise to gather your requirements and think about the services you want from a managed security services provider (MSSP).

There are a several basic considerations when choosing your service provider, including: the MSSP’s experience, the types of support and services they offer, and how their service level agreements are structured. You’ll also want to know the MSSP’s specific domains of expertise and how they correlate with your needs.

In addition, small and midsize businesses (SMBs) in particular should pay attention to several factors when evaluating their potential partner. When you’ve got a small IT staff, you’ll need to trust the MSSP is adequately able to address:

• Business continuity: How well does the service provider protect you from different types of business interruptions? Servers, software, and cloud services are subject to outages, and humans make mistakes. Ask the MSSP if they have a disaster recovery site and a strategy for failures in their infrastructure or human errors. Also find out if they have insurance to cover potential liabilities.

• Self-protection: Third-party and vendor security is critical, especially in light of cyberattacks that affect an entire supply chain. How the MSSP protect itself and your data from being compromised, stolen or encrypted? Which best practices or solutions do they employ to protect their own infrastructure? Do they have storage-side and in-transfer data encryption mechanisms? How do they handle access control and multi-factor authentication?

• Data accessibility: You must be able to get your data quickly when you need it. Find out how access to your data is regulated and what level of control you will have over your data? Also ask if there are self-service capabilities that give you greater and faster control.

The steps SMBs must take to prepare internally

Data is the lifeblood of your organization, so in addition to accessibly, ensure you — and your MSSP — sufficiently plan for data protection.

“We recommend five vectors around data protection,” said Alex Ruslyakov, channel chief at Acronis. “The first is that organizations should always keep a copy of their data for recovery in case of a security incident.”

The other four:

• Data accessibility anywhere, anytime
• Data control with visibility into its location and use
• Data authenticity: proof that a copy is an exact replica of the original
• Multiple layers of security for air-tight data protection against bad actors

Although no vendor or service provider can claim 100% protection from cyberattacks, the right MSSP has a plan for when an incident does occur, Ruslyakov said. Ask about their recovery strategy and how they ensure that the data being recovered was not compromised/infected.

Finally, it’s important to have visibility into exactly what you’re paying for. What level of detail can you expect in your invoice? Can the MSSP validate usage for which you’re being charged?

A service provider’s proven track record and use of best-in-class technology goes a long way toward establishing confidence that the MSSP can fill your security needs. However, SMBs should also dig into the details to ensure their data and business are protected.

From applications to infrastructure, click here to see how Acronis can help your organization fill security gaps and protect your business.

Above a desk somewhere at Apple HQ someone has probably pasted the slogan, “Another week, another lawsuit,” and this week seems no different as the EU is targeting Apple Pay, or to be more specific, how Apple constrains use of the NFC chip inside iPhones.

What’s the claim?

The second charge in Europe this year, EU antitrust regulators have alleged that Apple restricts competitors by denying access to the NFC (Near-Field Communications) technology it uses in its mobile wallet.

Apple has been sent a statement of objections in which regulators detailed how it has abused its dominance position in markets for mobile wallets on iOS in contravention of Article 102 of the TFEU.

Apple Pay has access to the NFC Input APIs, which the company does not make available to third-party payment firms. However, other platforms do permit third parties to access NFC tech to make such payments.

The EU statement says it “does not take issue with the online restrictions nor the alleged refusals of access to Apple Pay for specific products of rivals that the Commission announced that it had concerns when it opened the in-depth investigation into Apple’s practices.”

Both the latter matters were part of the investigation when it began in 2020, allegedly in response to complaints raised by PayPal.

The case is different from the proposals within the EU Digital Markets Act, which will also affect Apple’s business. Apple is facing scrutiny and regulation in most of its major markets, including the UK, US, Korea, Europe, Japa,n and elsewhere.

What the EU says

“In our Statement of Objections, we preliminarily found that Apple may have restricted competition, to the benefit of its own solution Apple Pay. If confirmed, such a conduct would be illegal under our competition rules,” Executive Vice President Margrethe Vestager said in a statement.

Regulators argue that Apple has significant market power in the mobile device market and dominates mobile wallets. The Commission argues that the company is abusing this power by reserving access to NFC tech on its devices to Apple Pay, to the detriment of competitors and consumers.

Apple will now have time to examine the allegations and respond to them as part of the ongoing investigation.

The Statement of Objections should not be confused with being a final judgement — though Vestager has already rejected counterarguments concerning security and regulators seem deaf to the need for user privacy.

What Apple says

In a statement provided to me, Apple defended itself, saying: “We designed Apple Pay to provide an easy and secure way for users to digitally present their existing payment cards and for banks and other financial institutions to offer contactless payments for their customers.

“Apple Pay is only one of many options available to European consumers for making payments and has ensured equal access to NFC while setting industry-leading standards for privacy and security. We will continue to engage with the Commission to ensure European consumers have access to the payment option of their choice in a safe and secure environment.”

It is worth noting that Apple recently opened the NFC chip to Apple developers for use with Apple’s Tap to Pay feature, which turns iPhones into card readers. This does not yet allow rivals to use the NFC chip to make payments from iPhones. Apple also recently published a report that showed how successful third-party apps could be on its platforms.

What’s the history?

Apple really began laying the foundations for payment tech in iPhones years before the 2014 introduction of Apple Pay. In 2010, it acquired contactless/near field communications tech firm, VIVOtech and soon recruited industry expert Benjamin Vigier as its product manager of mobile commerce.

Vigier was likely a key hire to enable Apple’s plans; he also led development of mobile payment systems for Starbucks and Paypal. That hire wasn’t random. Apple had already filed patents for use of NFC tech by then, and speculation concerning Apple’s plans to hold flight tickets on iPhones had already begun.

When Apple did launch the service, it did so long behind everyone else, but Apple Pay soon eclipsed that of similar services from Samsung, HTC, and others. It turned out that people making mobile payments wanted brand trust, security, and biometric identity to seal these transactions.

Since then, Apple Pay has possibly become the most widely used NFC-based payment system in the world; it’s arguable that the iPhone maker has done more than most to break down initial consumer resistance to mobile payment systems.

Why is this happening?

Apple is a victim of its own success. When the company introduced the iPod and launched its iTunes ecosystem, it was a small company fighting for survival against Microsoft and others.

The same basic business plan Apple used with iTunes was subsequently transposed around iPhone and the App Store. Today the company has become the world’s most valuable tech company, which means it is under a different set of rules.

While before it was a small player fighting for position, today it has become a major firm and must anticipate scrutiny. It must also develop a new approach to this side of its business, while shoring up revenue elsewhere.

It seems inevitable the mobile payments space would become messy.

Arguably, most mobile payment systems have failed amid suspicion about the entire sector that emerged in 2010. Apple has built a far deeper currency of trust across its customer base and seems to have bigger ambitions in the financial services space. These ambitions inevitably pit the company against incumbents in the space, so it’s of little surprise to see the regulators getting involved.

What’s at stake?

Money. If the EU finds Apple guilty, it could be fined up to 10% of its global turnover, though it is unlikely to be punished to that extent. Apple Pay is used by more than 2,500 banks in Europe along with over 250 challenger banks and fintech services.

In the background, we also have continued speculation around Apple’s plans to introduce new payment services and to extend Apple Card availability outside the US. Associated with this, we also hear rumors the company may intend to launch an Apple-as-a-service plan.

What might happen?

Apple seems ready to fight tooth and claw to protect its strategy of making some features platform specific. Total control of its ecosystem has always been part of its approach, so this is philosophically in keeping with that strategy.

All the same, the shades of tech regulation cast heavy shadows on the company at this time, and as in any conflict resolution will eventually be reached through a combination of negotiation and regulation.

This could take years, but the arguments being made elsewhere concerning its ecosystem probably also apply here.

I think the ultimate question will be how much Apple can charge third-party companies for access to profitable parts of its system without being seen as anti-competitive. And to what extent will regulatory activity dilute the user experience?

During the course of events, I imagine Apple will attempt to say that those complaining about its business practices in mobile payments are attempting to capitalize on its work, given other attempts to create systems as popular as its own have already failed.

That argument likely won’t win regulators over to its position, but may help the company justify a right to demand a slice of any future transactions made using its platforms on services provided by third parties. I doubt the latter will get a free ride.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.