Some Vendor Cyber Risks Are Worse than Others

These days, vendor data breaches, PII/PHI exposures, and supply chain disruptions are constantly in the news, so it’s no wonder that risk and security teams are paying closer attention to third parties than ever before. However, taking on responsibility for evaluating third-party risk can be daunting for teams that are already overtaxed with handling internal security policies, controls, infrastructure, and training.

But let’s face it – third-party relationships are here to stay, and third-party ecosystems are expanding rapidly for most organizations. NOT focusing on these risks isn’t really an option, so what’s the answer? While I can’t prescribe a panacea for TPRM in a single blog post, I can share a strategy for prioritizing third-party cyber risks based on my experience working with clients.

Credential Exposures

Right at the top of the list is the theft of credentials, which are often exposed and posted for sale on the dark web. You need to focus on not only those credentials entrusted to third-party providers for direct access to your systems, but also on those credentials third parties use to access your organization’s data – including customer or patient data – regardless of where that data is housed.

With the proliferation of cloud storage like AWS S3 buckets, credentials and other sensitive data are now potentially exposed in more places than most people realize. For instance, the 2017 exposure of U.S. Department of Defense credentials by Booz Allen Hamilton is a just one striking example of credentials being ill-protected in a cloud service environment.

Data Breaches and Confirmed Incidents

Another area that requires significant attention includes security incidents, validated attacks, and data breaches affecting your third parties. How do you find out about them and take action before they impact your organization? The perfect example of this is with the SolarWinds breach, where the software supply chain was wholly compromised before the software was distributed to unsuspecting customers.

Make sure your organization is conducting cyber risk monitoring for “chatter” about incidents and breaches involving your third parties on the dark web or other forums, particularly when sensitive data has already been accessed by attackers and is available or imminently available for sale.