![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.
What Are Some Basic Ways to Protect My Global Supply Chain?
Assessing supply chains is one of the more challenging third-party risk management endeavors organizations can take on.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blta56822346ecad316/64f0d11f474ec1735b4a1b0e/602x250_supplychain.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Question: What are some foundational ways to protect my global supply chain?
Rick Holland, CISO, Digital Shadows: Assessing supply chains is one of the more challenging third-party risk management endeavors organizations can take on. A global company can easily have more than 1,000 firms in its supply chain. In the age of digital transformation, much of the supply chain consists of SaaS providers that are easier to replace than the traditional on-premises vendor. The result is a transient supply chain that continually evolves. To add even more complexity, the more mergers and acquisitions activity a firm undertakes, the more complicated its supply chain becomes. All of these factors make supply chain risk management a daunting task.
Two common deficiencies of cybersecurity supply chain programs are a lack of understanding of the types of data and access the third party possesses, as well as a prioritized list of suppliers. This is why security teams need to have robust processes in place that include both the lines of business that leverage supply chain providers and the procurement teams that handle the logistics of assessing and onboarding the vendors. The security and privacy teams must have questions that can be inserted into assessments. They should include items that give insights into what data a third party has access to, where that data resides, and who has access to it. Once an organization understands the criticality of the data a third party has access to, it can then prioritize the risk around a supplier based on the classification of that data.
With today's technology and complexity, it isn't pragmatic for a cybersecurity supply chain program to monitor "all the things." However, it becomes more feasible with a prioritized list of vendors that have data or access to data that could represent a material risk to the business if stolen or abused.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024