Perimeter
11/27/2011
09:33 AM
Commentary
Commentary
Commentary
50%
50%

Partner Management: Assessing Compliance Capability And Willingness

The first step is to determine the partner's understanding of its responsibility and ability to comply

Regulations like HIPAA and state privacy regulations and contracts like PCI DSS require organizations to ensure that any partner or service provider with access to data covered under the regulation or contract complies with the data protection requirements. In my previous post, I discussed the need to assess and control the risk associated with these relationships. However, it is can be a challenge to assess an organization’s ability to protect the data.

In fact, there is an important aspect of compliance that many organizations miss: Does the vendor even understand its compliance requirements?

Before embarking on a detailed assessment of an organization’s compliance and security programs, all organizations considering consuming a service that would be involved in protecting regulated information should ask the vendor whether it recognizes its responsibilities.

It is often surprising to find that service providers that manage protected health information, personal identifying information, and payment card information have no idea what controls what they should have in place. Equally surprising is the fact that consumers of the service have the false impression that the vendor is completely aware of its protection “responsibilities” and has accepted them.

Organizations entrusted with protected information are responsible for the practices of their vendors. Normally, vendors are contractually responsible for protecting the information. In poorly managed relationships, however, the consuming organization doesn’t make the requirement clear and allows the vendor to either be ignorant of the presence of protected information or believe that detailed understanding of regulatory requirements isn’t important.

Service consumers should be aware of an important point: You cannot force a vendor to comply with a regulation it doesn’t understand or hasn’t acknowledged by contract. It is for this reason that data protection regulations require contracts between data owners and service providers. All entities need to understand their requirements.

Once this understanding is established, the service consumer can assess whether the compliance program and security controls will meet its requirements.

In my next post, I’ll describe different methods for assessing partner practices, and the pros and cons of each.

Richard Mackey is vice president of consulting at SystemExperts Corp.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?