Vulnerabilities / Threats

9/1/2016
01:00 PM
Linn Freedman
Linn Freedman
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Golden Rules For Managing Third-Party Security Risk

Rule 1: know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place.

Third-party vendors have access to valuable, sensitive corporate and government data, yet more than one third of companies don’t believe these vendors would tell them if they had a data breach, according to a recent study from the Ponemon Institute.

Although it's common to include data privacy and security procedures in third-party contracts to ensure vendors have appropriate measures in place to protect company data, it is difficult to evaluate how the vendor is protecting data from unauthorized access, use, and disclosure, and to know whether the vendor has appropriate contractual terms in place with downstream, who may also have access to your data. 

This disconnect creates a high-risk area for all industries as more and more data loss through third-party vendors results in a breakdown of trust and communication. In the Ponemon survey, about half of 600 respondents who were familiar with their organization’s data practices confirmed that at least one of their vendors was the cause of a data breach, and an additional 16% didn’t even know that a breach had occurred. About 60% of respondents said they felt vulnerable because they were sharing sensitive data with third parties that might have weak security policies.

Golden Rule 1: Know where your data lives
Vendor management of data privacy and security is a key component of risk management. As a first rule, you have to know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place to protect it.

Golden Rule 2: Remember Target
The second golden rule, exemplified by the infamous Target breach, is that data security depends on the weakest link in the chain. The 2013 data breach at Target rocked the world when an HVAC vendor in charge of the environmental controls at Target's retail stores was hacked. By gaining access to Target’s IT system credentials, the hacker found an open door to customer data, which was not segregated from its environmental data. Three years after the Target breach, 73% of the Ponemon survey respondents say cybersecurity incidents involving vendors are increasing.

Golden Rule 3: Develop a Plan
If you don’t know where your data sets are, where the data is being transferred, what your primary and downstream vendors are doing with it, or the security measures they have in place, you are overdue for a formal vendor management program. For a comprehensive approach, prepare to:

  • Map your vendors. Data mapping shows you where data resides in your own organization. Use a similar approach to map your vendors, to track who has access to your data, and to uncover areas of greatest risk.
  • Put one department in charge of vendor management. Ask your legal, finance, or compliance department, (not IT or infosec) to be responsible for vendor management. While IT should be involved to follow the data and map data flows to third-parties, an administrative department must oversee that vendor security measures are included in every contract and that internal groups are working together track data that leaves the organization
  • Put it in writing.  Specify in every vendor contract who, how, and why each vendor will access your data.
  • Use financial terms to enforce vendor compliance.  As a condition of doing business with you, a vendor must specify measures that protect the privacy and security of your data, and indemnify you against any breach or loss. It’s not worth the risk to work with a vendor that won’t sign a contract that includes these provisions.
  • Audit, audit, audit. Plan regular data security reviews with your vendors, and review your contractual provisions for trouble spots before they become a serious problem. Using security questionnaires is a common practice to audit vendors.

Companies can significantly reduce their risk of a catastrophic breach by staying a step ahead of the bad guys. The best data security approach includes rigorous risk assessment, prudent planning, consistent internal policies, and regular tracking and review of data access by your vendors and their vendor chain. It is possible to do this well. 

Related Content:

 

Linn Freedman is chair of the Data Privacy + Security practice at the law firm, Robinson+Cole, and is an adjunct professor in Brown University's Executive Master in Cybersecurity program, a program for mid-career professionals with increasing responsibility in cybersecurity. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Practical Privacy Coach
50%
50%
Practical Privacy Coach,
User Rank: Apprentice
9/6/2016 | 12:39:27 PM
Golden tips for all businesess
Great article - these 3 golden rules apply to all businesses - even clubs that we belong to.

If you collect information you are responsible for ensuring the safety and security of that information - especially when you hire third parties to help you do your work.

The more important or sensitive the information that you collect, the higher your standards should be for yourself, your internal and your external team.

Use these 3 golden rules as your starting platform to prevent a privacy breach. 
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1848
PUBLISHED: 2018-12-14
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...
CVE-2018-1977
PUBLISHED: 2018-12-14
IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.
CVE-2018-18006
PUBLISHED: 2018-12-14
Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.
CVE-2018-18984
PUBLISHED: 2018-12-14
Medtronic CareLink 2090 Programmer CareLink 9790 Programmer 29901 Encore Programmer, all versions, The affected products do not encrypt or do not sufficiently encrypt the following sensitive information while at rest PII and PHI.
CVE-2018-19003
PUBLISHED: 2018-12-14
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails...