Policies, Prevention, and Promises: How to Protect Your Organization from Third-Party and Supply Chain Risks

Partnering with external suppliers and vendors is necessary for almost every business and can provide competitive advantages, but third-party and supply chain vendors can also increase your cyber risk. By outsourcing some of your business functions to one or more third-party vendors, your data becomes a part of a web that leaves more entry points and weaknesses for threat actors to exploit. Regardless of how well planned your layered cybersecurity defenses are, it’s important to remember that your vendors may not be as vigilant about their own approach to cybersecurity.

It's no surprise that cyber threat actors are taking advantage of the external vendors’ lack of cybersecurity maturity and targeting their customers. In a 2018 supply chain cyberattack discovered by eSentire against Kaseya, an IT Management Software company, an unknown threat actor tried to leverage a zero-day vulnerability in Kaseya’s Virtual System Administrator (VSA) agent to gain access to our customers’ network. The goal of this was to deploy the Monero cryptocurrency mining malware to multiple eSentire customers.

Kaseya also faced a supply chain cyberattack after it was discovered that their VSA platform was being used by cybercriminals to deliver ransomware through an auto-update. This breach impacted 60 customers and close to 1,500 downstream businesses.

The reality is that third-party vendors with access to your data may not meet the same standards of cybersecurity procedures and policies that your organization has implemented. So, it is up to you to ensure that you are conducting the due diligence needed to protect your company from third-party vendor risk.

The Three Ps of Third-Party and Supply Chain Risk: Policies, Prevention, and Promises

In order to effectively address third- party risk, you need to pinpoint any vulnerabilities and weaknesses present in your vendor’s systems or processes. One way to approach this is to consider the three Ps of third-party and supply chain risk: policies, prevention, and promises:

Policies: Minimize your cyber risk

While many third-party partners rely on your data to deliver their services, you should understand what information they need, and what information you are willing to share prior to establishing partnership. It is also important to consider who can access this information and the process of granting them this access.

The end goal here is to minimize the number of third-party and supply chain risks by proactively defining supply chain policies, developing the necessary due diligence tools, setting validation meetings on a consistent basis, raising the overall security awareness around the policies being set at your organization, and encouraging your team and suppliers to improve.

Prevention: Measure your cyber risk

The core objective here is ensure that you understand if there are any threats and risks that may arise once you’ve set up your policies. From here, you can work with your third-party vendors to set expectations and requirements with their cybersecurity processes that mitigate your organization’s cyber risks.

Therefore, the most critical steps you can take from a prevention standpoint are to start by identifying your assets and obligations, defining your organization’s tolerance for risk, conducting a vendor risk assessment (or at minimum, a due diligence questionnaire) and defining the defensive requirements to address them.

Promises: Mitigate your cyber risk

Once you’ve set up your policies and preventative measures, the last thing to consider is how you’ll mitigate third-party risk by establishing and following contractual obligations, documents, and standards in the event of a cyberattack. Therefore, any contract you sign with your third-party vendor should extend from simple things like service definitions and pricing to the minimum cybersecurity requirements.

Here you should consider what to do when your vendor faces a cybersecurity incident, ranging anywhere from detecting unauthorized activity to a successful data breach. Both parties should agree on what activity is worth flagging, who works to resolve it, and what information should be logged for forensic analysis. Another important factor to consider – who is responsible if damages occur?

Any business or organization, regardless of their size, is a potential target for a cyberattack. However, trusted vendors who serve a larger client base are especially at risk as threat actors may have access to a downstream client base in the event their attack is successful.

How can organizations protect themselves from third-party risks?

The key to mitigating third-party risk lies in taking proactive measures prior to finalizing business partnerships. Ask yourself, how susceptible are your third-party partners to phishing attempts? What potential zero-day vulnerabilities could be present that would allow threat actors to access your data?

Our Due Diligence Questionnaire can help your team highlight which third-party and supply chain risks your organization may be susceptible to.

However, while a due diligence questionnaire is a good starting point for this discussion, what your team will really benefit from is conducting a thorough Vendor Risk Assessment.

The assessment will help you answer questions regarding your third-party and supply chain risk such as:

• What criteria should I follow to assess my third-party partners and vendors?
• How effective are my current third-party risk policies and controls to mitigate against risk?
• What measures do my third-party partners need to implement to address their risk profile?

Given the explosive growth of supply chain cyberattacks globally, a vendor risk assessment will give you the peace of mind you need since it provides:

• A customized questionnaire designed to measure vendor risks that are unique to your business environment
• Rapid third-party data collection to evaluate and ensure response accuracy
• Comprehensive examination of responses and corrective action against your businesses’ level of risk tolerance

Based on data findings and security program recommendations that a vendor risk assessment provides, you can plan your cybersecurity defenses around your vulnerabilities to ensure you have the tools, technology, and people you needed to successfully mitigate your third-party risks.

When creating a cybersecurity plan that addresses your third-party risks and vulnerabilities, it is important to review “the 3 Ps” of third-party and supply chain risk to maximize your cybersecurity defenses and leave no loose ends for potential zero-day attacks.

Good things come with time. By going through a vendor risk assessment with your partners, both parties will come out with stronger defense measures, a clearer understanding of their cyber risks, and a detailed response plan that gives peace of mind.

Ready to mitigate your third-party risk with a Vendor Risk Assessment? Book a meeting with an eSentire cybersecurity specialist to get started.