Perimeter
11/27/2011
09:33 AM
Commentary
Commentary
Commentary
50%
50%

Partner Management: Assessing Compliance Capability And Willingness

The first step is to determine the partner's understanding of its responsibility and ability to comply

Regulations like HIPAA and state privacy regulations and contracts like PCI DSS require organizations to ensure that any partner or service provider with access to data covered under the regulation or contract complies with the data protection requirements. In my previous post, I discussed the need to assess and control the risk associated with these relationships. However, it is can be a challenge to assess an organization’s ability to protect the data.

In fact, there is an important aspect of compliance that many organizations miss: Does the vendor even understand its compliance requirements?

Before embarking on a detailed assessment of an organization’s compliance and security programs, all organizations considering consuming a service that would be involved in protecting regulated information should ask the vendor whether it recognizes its responsibilities.

It is often surprising to find that service providers that manage protected health information, personal identifying information, and payment card information have no idea what controls what they should have in place. Equally surprising is the fact that consumers of the service have the false impression that the vendor is completely aware of its protection “responsibilities” and has accepted them.

Organizations entrusted with protected information are responsible for the practices of their vendors. Normally, vendors are contractually responsible for protecting the information. In poorly managed relationships, however, the consuming organization doesn’t make the requirement clear and allows the vendor to either be ignorant of the presence of protected information or believe that detailed understanding of regulatory requirements isn’t important.

Service consumers should be aware of an important point: You cannot force a vendor to comply with a regulation it doesn’t understand or hasn’t acknowledged by contract. It is for this reason that data protection regulations require contracts between data owners and service providers. All entities need to understand their requirements.

Once this understanding is established, the service consumer can assess whether the compliance program and security controls will meet its requirements.

In my next post, I’ll describe different methods for assessing partner practices, and the pros and cons of each.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3653
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

CVE-2014-5406
Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

CVE-2014-9737
Published: 2015-07-06
Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.

CVE-2014-9738
Published: 2015-07-06
Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.

CVE-2014-9739
Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report