Request Demo

Third-Party Breach Response: 5 Immediate Actions to Take

Use these tips to improve your third-party breach planning and response procedures.
By:
Dave Shackleford
,
Owner & Principal Consultant, Voodoo Security
November 02, 2023
Share:
Webinar 1101 incident response

Third-party breaches are occurring with increasing frequency. One recent example is the security breach at identity service provider Okta, where a malicious actor leveraged stolen credentials to access the company’s support management system. Okta acts as a broker and intermediary for vast amounts of authentication and authorization sessions for applications used by thousands of customers. Therefore, the number of companies that could be impacted – directly or indirectly – is significant.

How would your company respond if one of your critical vendors experienced a breach?

This post offers suggestions for readying your third-party incident response program and shares five actions to take when one of your vendors is affected by a breach.

Tips for Readying Your Third-Party Incident Response Program

Maintain Awareness of Vendor Risks

First, it’s essential to continually monitor critical third parties for new and emerging cyber threats (as well as for potential operational, financial and reputational risks). While this may seem obvious, is can be a monumental task for organizations with a large vendor ecosystems. Instead of trying to manually stay on top of security news and community postings, look for threat intelligence providers that can automate and scale the monitoring process for you.

Review Basic Security Controls

Do any of your third-party vendors have access to your infrastructure, users and/or data? If so, then be sure to implement behavioral analysis tools to detect any anomalous activity. Also, stay on top of any software that’s being used, ensuring that it is current and patched to address any vulnerabilities. Microsegmentation and privileged user management tools can also help here.

Have a Communications Plan

Communications after a third-party breach or suspected incident are different from in-house incident management communications. Make sure you have vendor contact information readily available, and implement protocols for information gathering and escalation paths for when incidents occur. If the third party is a software or services vendor (see the 2020 SolarWinds breach), then there may be a “waterfall” effect that necessitates communications with customers and other stakeholders.

Consider Containment Strategies

How much access does the vendor have? This is a critical question when considering containment strategies. For instance, if the vendor has access to your data but not to your infrastructure, then you may be able to simply stop using the service or platform until more is known. However, if the vendor has any level of access to your IT environment, then you should have a plan to immediately quarantine and isolate that access.

Ask the Right Questions

When a third-party breach occurs, asking the right questions will help you to efficiently understand and mitigate the impact on your organization. Here are a few recommendations with guidelines for possible responses (to be tailored based on the specifics of the incident):

  • Has the vendor been impacted by a breach or utilize a product/service impacted by breach? (Yes/No)
  • What is the nature of the impact on the vendor? (High/Med/Low impact to systems, applications and/or data)
  • Does the incident affect critical services delivered to your organization? (Yes/No)
  • Has the vendor taken the following remediation steps? (List recommended steps, such as patching or updating affected systems)
  • Has the vendor amended existing controls or implemented new controls to resolve and mitigate the impact of the breach? (Identified and already implemented; identified and in process of implementation; not identified and/or not able to be implemented)
  • If controls are unable to be implemented, then what compensating controls or workaround methods are being implemented?
  • Who is the point of contact for additional inquiries?

Webinar: 5 Immediate Actions After a Third-Party Breach

Dave Shackleford, CEO at Voodoo Security and SANS Senior Instructor, shares the most important steps you need to take in the first 24 hours of a third-party security incident, as well as his strategies to prepare your incident response plan now.

Five Immediate Actions to Take After a Third-Party Breach

Building on the tips above, here is a quick list of what to do if you believe that your organization has been affected by a third-party breach.

Please note: This list is should not be considered comprehensive incident management guidance. Be sure to engage with your security operations center (SOC) team, auditors and other internal parties.

  1. Investigate: Reach out to internal contacts to gather information. Assess what data (if any) was accessed; your organization’s potential level of exposure; the vendor’s remediation and recovery plans; and contractual SLAs or obligations that should be addressed. For more on this, see “Ask the Right Questions” above.
  2. Isolate: Where possible, isolate all access and affected systems. To accomplish this, leverage local host restrictions, network access controls, privilege restrictions, and account removal/locks.
  3. Remediate: To reduce the “blast radius” of the incident, internally patch and/or mitigate the issues wherever possible. Collaborate with the affected third party on remediation activities such as documenting what data is affected, executing a communications plan, and assessing any compliance or regulatory implications.
  4. Monitor: Third-party breach response activities should include monitoring internal behavior on affected software/platforms; tracing remote access between affected vendors and any suspect 4th parties; and leveraging continuous threat intelligence services to monitor for subsequent or related incidents.
  5. Track: A focused threat intelligence effort should include tracking internal indicators of compromise (IOCs) or tactics, techniques and procedure (TTPs); data types and sets potentially exposed; changes to reputation or public information related to the third parties; and ongoing tracking and monitoring of any new campaign elements.

Next Steps to Prepare for Third-Party Breaches

It’s clear that third-party breaches and incidents can have significant downstream implications on your organization’s operations. Be prepared by accounting for third-party risk in your incident response playbook. Know who you will contact, what SLAs are involved, which questions you will ask, and how you will proceed given the answers. Also, since incident response programs are reactive by nature, be sure to implement a proactive third-party risk management program to head-off threats before they impact your organization!

For more information, scroll up to watch my on-demand webinar (also embedded above), and contact Prevalent for a demonstration of its third-party incident response capabilities today.

Tags:
Share:
Dave Shackleford
Dave Shackleford
Owner & Principal Consultant, Voodoo Security

Dave Shackleford is the owner and principal consultant of Voodoo Security and faculty at IANS Research. He has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering, and is a VMware vExpert with extensive experience designing and configuring secure virtualized infrastructures. Dave is a SANS Analyst, serves on the Board of Directors at the SANS Technology Institute, and helps lead the Atlanta chapter of the Cloud Security Alliance.

Related Posts
  • Ready for a demo?
  • Schedule a free personalized solution demonstration to see if Prevalent is a fit for you.
  • Request a Demo