2023 showed that third-party data breaches impacted organizations across all industries. Prevalent’s annual TPRM industry study found that 41% of companies reported a third-party breach, and 71% consider third-party security breaches to be a top concern. Organizations of all types and sizes are taking a more serious look at how they can stay on top of the growing number of third-party cyber risks. The challenge is only growing into 2024.
There is a lot that we as security and risk professionals need to do to improve the state of third-party risk management. Confusion persists about what third-party risk is, what controls to implement, how to assess vendors, how to manage vendors, the impact of regulatory compliance, and so much more. Therefore, it’s not surprising at all that stakeholders across most organizations are confused (yet concerned) about the state of third-party associations. Cybersecurity and risk teams need to develop and implement cohesive, informed plans that help everyone get on the same page in the face of new and growing threats.
In this post, I examine the top third-party cyber risks to watch for in 2024 and suggest a list of 7 priorities to address those risks.
Based on third-party cyber incident trends over the last year, in 2024 we’ll see more of the following types of risks:
However, I’d like to focus specifically on software supply chain risks as the trend is increasing significantly here.
The software supply chain creates and delivers software from its conception to its eventual end-user. It encompasses all the steps involved in creating and delivering software, from the initial idea to the final product. The supply chain can be divided into three main sections:
MOVEit is a classic example of a software supply chain breach. In May 2023, a ransomware gang called Cl0p began abusing a zero-day exploit of Progress Software’s MOVEit Transfer enterprise file transfer solution. Since then, more than 2,000 organizations have reported being attacked and Progress Software has issued numerous patches.
In 2024, security teams must prioritize third-party cyber risk management to get ahead of potential software supply chain attacks. Here are seven places to start:
Third-Party Cybersecurity: Emerging Trends and What to Do in 2024
In this webinar Dave Shackleford, CEO at Voodoo Security and SANS Senior Instructor, shares his insights on the most important steps to prepare your third-party cybersecurity program in 2024.
When talking to cybersecurity and risk management teams, it’s clear that we need some prioritization to get TPRM underway in 2024, but many decision-makers are unclear on where to start and what to prioritize.
To help understand the most important TPRM priorities of 2024, check out the webinar I recorded with Prevalent.
This webinar delivers insights and a roadmap to help you prioritize cybersecurity in your third-party risk management program in 2024. It’s a fast-moving and rapidly changing landscape, but there are some core lessons we’ve learned in the past few years, and some great steps you can take right now to help move third-party risk management in the right direction in 2024 and beyond.
For more on how Prevalent can help you design and implement an agile and comprehensive third-party risk management program in 2024, request a demonstration today.
Effectively manage third-party cybersecurity incidents with a well-defined incident response plan.
09/24/2024
Why third-party breaches are on the rise, who is being affected, and what you can do...
09/20/2024
Use these 6 tips to improve your third-party breach response procedures.
09/17/2024