![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt530eb1f4e672eb44/653a71690e92cc040a3e9d6d/Dark_Reading_Logo_TheEdge_0.png?width=700&auto=webp&quality=80&disable=upscale)
Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.
What Are Some Red Flags in a Vendor Security Assessment?
The last thing you want is a vendor that lies to you about its security practices.
![Pink highlighter checking off items on a checklist. Pink highlighter checking off items on a checklist.](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt5b53ac9ed0967bda/64f114e1875cc96962065df5/checklist-pixabay.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Question: What are some red flags to look for in a vendor security assessment?
John Bambenek, principal threat hunter at Netenrich: The problem with security assessments given to vendors is there is often no good way to verify the information. Third-party risk firms may tell you and give you insight into the general security posture of an organization, and we have far too often see compliance regimes are insufficient to ensure any reasonable level of security. There is also an inherent conflict when relying on third parties to certify compliance … they are being paid by the person they need to certify.
I like including security “requirements” that a vendor would either not be able to do or would not be cost-effective to implement. I use this as a check for honesty. Sales teams will, by default, tell a customer they do everything and anything even when they don’t to ensure a sale. Absent doing third-party verification or sending in an audit team, there is no way to evaluate every vendor in a cost-effective manner.
This is why I try to include a “validity check” question in the requirements where an honest vendor would tell you, no, they don’t do “X” and give you a good reason why they don’t (not cost-effective, outside a reasonable risk model, etc.). It shows you the vendor is at least reading the requirements instead of button-mashing until they get a PO. It also shows me that I can have a conversation with that vendor peer-to-peer about reasonable ways we can protect our respective organizations.
In the end, if a vendor lies to you during the sale, they’ll lie to you after the sale.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024