Vulnerabilities / Threats

9/1/2016
01:00 PM
Linn Freedman
Linn Freedman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Golden Rules For Managing Third-Party Security Risk

Rule 1: know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place.

Third-party vendors have access to valuable, sensitive corporate and government data, yet more than one third of companies don’t believe these vendors would tell them if they had a data breach, according to a recent study from the Ponemon Institute.

Although it's common to include data privacy and security procedures in third-party contracts to ensure vendors have appropriate measures in place to protect company data, it is difficult to evaluate how the vendor is protecting data from unauthorized access, use, and disclosure, and to know whether the vendor has appropriate contractual terms in place with downstream, who may also have access to your data. 

This disconnect creates a high-risk area for all industries as more and more data loss through third-party vendors results in a breakdown of trust and communication. In the Ponemon survey, about half of 600 respondents who were familiar with their organization’s data practices confirmed that at least one of their vendors was the cause of a data breach, and an additional 16% didn’t even know that a breach had occurred. About 60% of respondents said they felt vulnerable because they were sharing sensitive data with third parties that might have weak security policies.

Golden Rule 1: Know where your data lives
Vendor management of data privacy and security is a key component of risk management. As a first rule, you have to know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place to protect it.

Golden Rule 2: Remember Target
The second golden rule, exemplified by the infamous Target breach, is that data security depends on the weakest link in the chain. The 2013 data breach at Target rocked the world when an HVAC vendor in charge of the environmental controls at Target's retail stores was hacked. By gaining access to Target’s IT system credentials, the hacker found an open door to customer data, which was not segregated from its environmental data. Three years after the Target breach, 73% of the Ponemon survey respondents say cybersecurity incidents involving vendors are increasing.

Golden Rule 3: Develop a Plan
If you don’t know where your data sets are, where the data is being transferred, what your primary and downstream vendors are doing with it, or the security measures they have in place, you are overdue for a formal vendor management program. For a comprehensive approach, prepare to:

  • Map your vendors. Data mapping shows you where data resides in your own organization. Use a similar approach to map your vendors, to track who has access to your data, and to uncover areas of greatest risk.
  • Put one department in charge of vendor management. Ask your legal, finance, or compliance department, (not IT or infosec) to be responsible for vendor management. While IT should be involved to follow the data and map data flows to third-parties, an administrative department must oversee that vendor security measures are included in every contract and that internal groups are working together track data that leaves the organization
  • Put it in writing.  Specify in every vendor contract who, how, and why each vendor will access your data.
  • Use financial terms to enforce vendor compliance.  As a condition of doing business with you, a vendor must specify measures that protect the privacy and security of your data, and indemnify you against any breach or loss. It’s not worth the risk to work with a vendor that won’t sign a contract that includes these provisions.
  • Audit, audit, audit. Plan regular data security reviews with your vendors, and review your contractual provisions for trouble spots before they become a serious problem. Using security questionnaires is a common practice to audit vendors.

Companies can significantly reduce their risk of a catastrophic breach by staying a step ahead of the bad guys. The best data security approach includes rigorous risk assessment, prudent planning, consistent internal policies, and regular tracking and review of data access by your vendors and their vendor chain. It is possible to do this well. 

Related Content:

 

Linn Freedman is chair of the Data Privacy + Security practice at the law firm, Robinson+Cole, and is an adjunct professor in Brown University's Executive Master in Cybersecurity program, a program for mid-career professionals with increasing responsibility in cybersecurity. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Practical Privacy Coach
50%
50%
Practical Privacy Coach,
User Rank: Apprentice
9/6/2016 | 12:39:27 PM
Golden tips for all businesess
Great article - these 3 golden rules apply to all businesses - even clubs that we belong to.

If you collect information you are responsible for ensuring the safety and security of that information - especially when you hire third parties to help you do your work.

The more important or sensitive the information that you collect, the higher your standards should be for yourself, your internal and your external team.

Use these 3 golden rules as your starting platform to prevent a privacy breach. 
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.