Blog

Data breach incidents always have a negative impact on consumer confidence. Now companies often use third parties services, giving a certain part of the tasks for outsourcing. This could be a SaaS vendor, a third-party vendor, or a contractor. Some vendors have robust security standards, risk management practices, and strong data protection. But other of them neglect it. These vendors are often outside the company’s control, making it impossible to obtain transparent information about information security controls.

Having a reliable information security system but using the services of a third-party provider with weak information protection, a company risks becoming a victim of cybercriminals and losing data. Confidential company data may be stolen from a third-party provider, as well as their systems may be used to gain unauthorized access to a company system. Each supplier directly or indirectly affects the company cybersecurity. Third party risk management is an important part of an organization’s risk management strategy.

1. Third party providers evaluation. Engaging third-party vendors who will have access to the corporate network and sensitive data has certain risks. It’s possible to evaluate potential partners using the security rating. The tool you to quickly assess and understand the external security status of the supplier, as well as what threats it may be exposed to;
2. Adding risk management clause to the contract. This will not save or prevent data leakage, but providers will be held accountable. It’s also possible to add a requirement for vendors to report or fix any security issues within a specified time period, request a security questionnaire to identify issues;
3. Inventory of suppliers. It should be studied and determined how much information is provided to each supplier. This will help measure the potential risks posed by the supplier;
4. Continuous suppliers monitoring for security threats. The supplier’s security level changes during the period of cooperation. Rare audits and security questionnaires show only the state of security at a given time. For a complete understanding, it is necessary to monitor suppliers security level constantly and quickly respond to changes;
5. Cooperation with suppliers. This will not help to completely exclude and prevent unauthorized access, cyber-attack and security breach. However, it is important to work with vendors to mitigate risk, respond quickly, and fix security issues;
6. Providing information about risks to management. This allows top-management to understand the risks and their consequences. According to the Ponemon Institute’s «Data Risk in the Third Party Ecosystem» report, 53% of respondents from high-performing organizations reported interacting with the board of directors and executive management. This means that management is aware of the potential risks, as well as the importance of protecting sensitive data and implementing effective information security practices;
7. Breaking cooperation with unreliable suppliers. In case of a third-party supplier non-compliance with the requirements and the organization’s standards, cyber-attacks should provide for the option of breaking cooperation. In this case, it is necessary to ensure business continuity. Like the introduction of a supplier into the system, its removal is also an important part of third-party risk management;
8. Measuring third-party providers risks (how quickly they implement multi-factor authentication, information about data exchange with 4 and 5 parties, tracking the process of exchanging confidential information, users who have access to it);
9. Access control. Leaks also occur due to incorrect provisioning of access. Quite often suppliers have more access than it is necessary for their job. Consider implementing a role-based access control system that operates on the principle of least privilege (POLP).