Third parties ‘suppliers’ are a necessary part of your business.
They are your suppliers, contractors and your partners. They are a core part of your business, without them, you typically can’t do business. Third parties may also provide cloud services, store sensitive data, and provide other important services.
Unfortunately, third parties are also a major source of cyber risk. Cybercriminals have many times targeted third-party providers to gain access to larger companies IT systems such as the notorious SolarWinds breach at the end of 2020 or Target (retailer) in 2013 and again more recently. To move your business forward and propel growth, you need to be able to trust your third parties and their security posture.
For this reason, Third-Party Risk Management (TPRM) is critical for every organisation.
TPRM is the process of vetting your vendors so that you, can understand the risks they may pose to your organisation and the supply chain itself. Organisations with strong vendor risk management programs systematically identify, assess, and mitigate threats to their assets and data that might be caused by the organisation’s supply chain. Many organisations operate a Zero trust for their 3rd party vendors for this reason.
Most organisations do business with a number of third parties, and those third parties fill many roles. Gartner Consulting Group found that 60% of organisations work with over 1,000 third parties, typically they are the larger SME type. Some are vendors, but many others fall into different categories ; partners, contractors, and or consultants.
Why is third-party risk management important?
It’s never good news when third parties are involved in a data breach;
Ponemon’s 2021 Cost of a Data Breach Report found that if a software vulnerability at a third party causes a data breach, the cost tends to increase by more than $90,000, but most data breaches are already running at an average of $4.24 million.
Third-party breaches are becoming increasingly frequent, however. According to InfoSecurity Magazine, 44% of organisations were found to have experienced a security breach in the last year. Of those companies, 74% said that the breach occurred because too much privileged access had been given to third parties.
That’s the problem, however — often third parties need access to your systems and data to be effective, but you don’t have the same control over your third parties as you do your own employees. You can’t require the employees or contractors of another company to adhere to your own standards — but if your customers’ data is exposed because of a third-party, that breach is still your responsibility. You can utilise the NIST third-party risk management framework forms one publication within the NIST 800-SP, (NIST SP 800-161 aims to reshape supply chain risk management). The paper outlines concerns along the ICT supply chain.
So how can you trust your third parties with your data?
Best practices for third-party risk management
1. Know who your third parties are
Before you can determine risk, you need to know who all your third parties are and understand exactly how much is being shared with each.
This isn’t always easy. While some large vendors — like cloud providers — may be well-known third parties, some departments (and even some individuals) may be working with chain of third parties, and may not have shared their vendor list with other you. They might not even think of some contractors as third-party vendors, so you’ll have to work with each department to develop a list.
Once you know who your vendors are, it’s important to know what data and networks they’re able to access. Do they need the level of privilege they have? If not, you’ll need to set some limits.
One way to begin identifying your third parties is with your finance department. Third parties are typically paid service providers and if you follow the money you will probably uncover vendors you didn’t know about.
2. Prioritise your vendors
Not all vendors were created equal, or at least they don’t all pose the same risk to your assets. Vendors that handle critical business processes will be a much bigger threat to your data than a contractor who works with one department.
You’ll want to be able to see, at a glance, which third parties represent the biggest risks to your organisation. Risk ratings are a tool that can help you do this.
Your first step is a risk analysis for each of your vendors. Use the following formula to understand each third parties’ risk:
Risk = Likelihood of a Data Breach X Impact of a Data Breach/Cost
Then, based on the results, prioritise your vendors by assigning a risk rating of high, medium, or low. Often the vendors who handle the most business-critical operations or the most sensitive data will likely be rated medium or high.
Be aware that this method sometimes won’t give you all the information you need, because sometimes you can’t know the vendors’ likelihood of experiencing a breach. They may not be aware, either — some of their assets may be insecure, or they may have been breached and not yet know.
3. Monitor your vendors continuously
Questionnaires and surveys represent one moment in time. These tools are static, and provide snapshots of a vendor’s security posture, but rarely the whole picture. In many cases, there’s no way to verify the accuracy of questionnaires, and you may simply have to accept a third party’s word that they are compliant.
By using tools that allow you to continuously monitor the security posture of your vendors, you can avoid all of these issues, receiving a notification whenever a vendor falls out of compliance, and scanning for problems the vendor might not know about, like an Amazon Web Services bucket that has been mistakenly configured, chatter on the dark web about breached assets, or other assets that have been left unsecured.
4. Automate the process
When it comes to reducing third-party risk, due diligence can be both tedious and labour-intensive. Large organisations often work with hundreds or even thousands of third parties, ranging from cloud vendors that serve an entire company to contractors that work for just one department. It’s a lot to keep track of — especially since many companies are still using spreadsheets and other manual tools to track TPRM. Estimates vary, but research from Ponemon suggests that 40% of organisations use spreadsheets to track issues with third parties’ risk. This is a manual process that takes a lot of time, and — as with any other manual data-entry project — can be prone to human error.
Automated tools reduce the paperwork and strain on staff by offering a way to easily monitor third parties without having to manually create questionnaires, or update spreadsheets. It’s worth mentioning that vendors often have questionnaire fatigue — they have to fill out many security questionnaires for their clients and may simply be copying and pasting answers to save time.
Automated tools can cut down on the administrative work on their end as well.
5. Collect consistent data
Automated tools can also solve another questionnai rerelated problem. Often, when presented with a questionnaire, third parties may choose to answer a question differently.
Some may take a narrative approach to answering questions, some may answer yes/no, some may attach a screenshot. Those different kinds of data are going to be difficult to store or understand because in many cases you won’t be comparing apples to apples. Nor can a tool automatically process all those different kinds of data instead, someone will have to manually review it.
An intelligence security tool can collect the data itself, only collecting the sort of structured data you need to automatically assess risk. It will also save people on both sides of the client/vendor relationship time and effort on questionnaires and surveys.