Vulnerabilities / Threats
9/1/2016
01:00 PM
Linn Freedman
Linn Freedman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Golden Rules For Managing Third-Party Security Risk

Rule 1: know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place.

Third-party vendors have access to valuable, sensitive corporate and government data, yet more than one third of companies don’t believe these vendors would tell them if they had a data breach, according to a recent study from the Ponemon Institute.

Although it's common to include data privacy and security procedures in third-party contracts to ensure vendors have appropriate measures in place to protect company data, it is difficult to evaluate how the vendor is protecting data from unauthorized access, use, and disclosure, and to know whether the vendor has appropriate contractual terms in place with downstream, who may also have access to your data. 

This disconnect creates a high-risk area for all industries as more and more data loss through third-party vendors results in a breakdown of trust and communication. In the Ponemon survey, about half of 600 respondents who were familiar with their organization’s data practices confirmed that at least one of their vendors was the cause of a data breach, and an additional 16% didn’t even know that a breach had occurred. About 60% of respondents said they felt vulnerable because they were sharing sensitive data with third parties that might have weak security policies.

Golden Rule 1: Know where your data lives
Vendor management of data privacy and security is a key component of risk management. As a first rule, you have to know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place to protect it.

Golden Rule 2: Remember Target
The second golden rule, exemplified by the infamous Target breach, is that data security depends on the weakest link in the chain. The 2013 data breach at Target rocked the world when an HVAC vendor in charge of the environmental controls at Target's retail stores was hacked. By gaining access to Target’s IT system credentials, the hacker found an open door to customer data, which was not segregated from its environmental data. Three years after the Target breach, 73% of the Ponemon survey respondents say cybersecurity incidents involving vendors are increasing.

Golden Rule 3: Develop a Plan
If you don’t know where your data sets are, where the data is being transferred, what your primary and downstream vendors are doing with it, or the security measures they have in place, you are overdue for a formal vendor management program. For a comprehensive approach, prepare to:

  • Map your vendors. Data mapping shows you where data resides in your own organization. Use a similar approach to map your vendors, to track who has access to your data, and to uncover areas of greatest risk.
  • Put one department in charge of vendor management. Ask your legal, finance, or compliance department, (not IT or infosec) to be responsible for vendor management. While IT should be involved to follow the data and map data flows to third-parties, an administrative department must oversee that vendor security measures are included in every contract and that internal groups are working together track data that leaves the organization
  • Put it in writing.  Specify in every vendor contract who, how, and why each vendor will access your data.
  • Use financial terms to enforce vendor compliance.  As a condition of doing business with you, a vendor must specify measures that protect the privacy and security of your data, and indemnify you against any breach or loss. It’s not worth the risk to work with a vendor that won’t sign a contract that includes these provisions.
  • Audit, audit, audit. Plan regular data security reviews with your vendors, and review your contractual provisions for trouble spots before they become a serious problem. Using security questionnaires is a common practice to audit vendors.

Companies can significantly reduce their risk of a catastrophic breach by staying a step ahead of the bad guys. The best data security approach includes rigorous risk assessment, prudent planning, consistent internal policies, and regular tracking and review of data access by your vendors and their vendor chain. It is possible to do this well. 

Related Content:

 

Linn Freedman is chair of the Data Privacy + Security practice at the law firm, Robinson+Cole, and is an adjunct professor in Brown University's Executive Master in Cybersecurity program, a program for mid-career professionals with increasing responsibility in cybersecurity. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Practical Privacy Coach
50%
50%
Practical Privacy Coach,
User Rank: Apprentice
9/6/2016 | 12:39:27 PM
Golden tips for all businesess
Great article - these 3 golden rules apply to all businesses - even clubs that we belong to.

If you collect information you are responsible for ensuring the safety and security of that information - especially when you hire third parties to help you do your work.

The more important or sensitive the information that you collect, the higher your standards should be for yourself, your internal and your external team.

Use these 3 golden rules as your starting platform to prevent a privacy breach. 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I've seen worse.  Last week Tim had a dragon."
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.