Third party vendors are incredibly useful. They allow businesses to automate certain processes they can’t do themselves, like implement payroll services to compensate employees, and bridge gaps in their technology. But while the money, time, and brainpower freed up by outsourcing tasks is a huge positive, third party vendors have their downsides. There must be a mutual agreement between all parties involved regarding security best practices. And sadly, that’s rarely a main focus, causing high risk to creep in where you least expect it.
As security concerns skyrocket, with data breaches happening to organizations of all sizes in all industries, IT and security teams are searching for ways to be proactive in their cybersecurity plans. Security awareness programs and carefully documented policies are a good start. But there’s no better way to prevent future security vulnerabilities than by starting with one of the biggest risks a company can have: careless outside players.
READ MORE: The Benefit of Empowered Employees: Why a Good Security Awareness Program Matters
“Security breaches attributed to third-party partners are increasing,” explains Paul Dusini, Information Assurance Manager at business management consulting company NuHarbor Security. “The number of data breaches attributed to third-party vendors increased by 22% since 2015.” And such frequency only continues to rise.
“Security breaches attributed to third-party partners are increasing. The number of data breaches attributed to third-party vendors increased by 22% since 2015.”
In fact, one of the biggest data breaches of this decade, Target Corporation in 2013, was thanks to unsecure third party vendors. A recent news report from American Banker states that “hackers first breached one of the retailers’ heating and air conditioning vendors, and from there, through a billing system, broke into Target’s servers to steal data on 40 million credit and debit cards and personally identifiable information of 70 million shoppers.”
Why aren’t third party vendors reviewed more often to prevent these kind of breaches? Shockingly, third party vendors are often considered an afterthought, since they provide services to an organization without being a part of their daily business goals. “Only 52% of companies have security standards for third-parties,” NuHarbor Security writes, yet an average of 90 vendors touch company data on a weekly basis. That’s a large number of players and access points a hacker could use to steal information—and part of the reason why third party vendors should be taken more seriously.
The good news is, organizations don’t have to quit third party vendors all together, a feat that’s likely impossible in this day and age anyway. Even better, data breaches and other vulnerabilities through third party vendors can be avoided.
Third Party Vendor Assessment Programs
Kathryn Anderson of Backbone Consultants has worked alongside many businesses, giving her the unique ability to observe how their IT teams practice data security and obtain valuable insight into where they regularly have security gaps. One of the best ways to close these gaps, she urges, is to start with third party vendors … and implement a third party vendor assessment program to minimize risk.
READ MORE: Introducing Kathryn Anderson of Backbone Consultants
“I have helped grow 3rd party risk programs at multiple organizations across different industries,” Anderson explained in an interview with us. “From a compliance standpoint, third party (and fourth party) risk is becoming a key area for auditors. The reason why is that it’s high risk having third parties, parties that are under different cultures and employee policies, allowed access to your information by providing you with services. So it’s understanding and vetting those third parties that’s blowing up right now—for a very good reason.”
Implementing a third party vendor assessment program is an important step toward properly addressing third party risk and keeping it the way it should be: low and under control. Part of the work, Anderson said, could include creating a questionnaire for vendors based on the services they’re providing, using IT governance and risk management frameworks, discussing the value of the program with your organization, and sitting in on any approval meetings departments have for the new applications or cloud-based services they want to use.
Unfortunately, while these programs have a plethora of benefits that lessen the possibility of security vulnerabilities, they aren’t always easy to get off the ground. But the time and resources it takes to look at an organization and “figure out what you should really care about, what matters, and what are the triggers that say ‘this is a high risk vendor,’” she said, come with incredible benefits. And it can be done with a culture shift and proper stakeholder buy-in.
“The program is not about people sitting in the back corner looking at logs to identify anomalous activity in your environment, it’s being part of the business. Because security is a business risk. It’s not an IT risk,” Anderson explained, discussing how important it is get key players to want to work with you and your program. A vendor assessment program enables security to integrate with the rest of the organization and help it (rather than hinder it) achieve business goals in a safe and positive manner.
“The program is not about people sitting in the back corner looking at logs to identify anomalous activity in your environment, it’s being part of the business. Because security is a business risk. It’s not an IT risk."
“Security shouldn’t be a ‘no’ group. It should be a proactive partner. If the company has some sort of business need, it’s not up to security to say no,” she continued. “They can offer suggestions on how a desired vendor can improve their controls, identify gaps, or point out vendors that have better security controls, but IT and security should not be a ‘no’ group.”
In fact, Anderson said, a third party vendor assessment program is an ally in the quest for company success, not an obstacle to be overcome. “IT and security are like the security on a race car. The business is going super fast around the track, and it’s our job to make sure the airbags work and that they have a parachute. If anything, we put the security in place so they can go faster. We should be an enabler, not a road block.”
How to Implement a Third Party Assessment Program
If you’re ready to implement a third party assessment program in your organization, here are four steps you can take to get started.
#1. Identify Your Third Party Vendors
Organizations often don’t have a firm understanding of every third party vendor they use. Different departments use different vendors to get their work done. For example, Marketing uses an application to streamline their design goals or Development uses a web service to track project hours. Identifying these vendors and making a list of who you’re using pieces together the big picture, and leads to step 2.
#2. Review Your Current Third Party Vendors
Once you have a list of the third party vendors you’re using, review them to make sure they are up to standard. Do they have good cybersecurity practices? Are they accessing internal networks, and are those access points secure and monitored? How strict is their access; are they only allowed into the areas they need? Is the way they handle your data secure? Have there been odd discrepancies in the way they’ve worked with your organization, such as delays, inconsistent staffing, or spotty communication?
These areas of review can help you determine what level of risk your company currently faces. Then, you can make informed decisions on whether to keep these vendors, terminate the relationship, or discuss ways they should improve their controls.
#3. Create a Questionnaire for Potential Vendors
As Anderson suggested, using a questionnaire that addresses the specific services offered by a vendor (so asking a point-of-sale vendor retail-related questions) gives you insight into areas of weakness or concern before you create a relationship with them.
Ask questions like:
- What sort of information will you need access to?
- Do you have updated security policies and procedures in place?
- Are you compliant with privacy laws/regulations regarding confidentiality and customer data? If so, which ones?
- How often do you update your OS security?
- What sort of controls do you have in place to secure your data?
- What security software do you use to scan for viruses?
You can find several example third party vendor questionnaires online and use them to create your own.
#4. Assess which Meetings You Should Attend (then Attend Them)
With the beginnings of a third party vendor assessment program in place, you should start to anticipate the third party vendors that are added to your organization. If certain departments hold review meetings to discuss which vendors they should add to their arsenal, ask to sit in on them and speak up if you detect any problems or red flags that might cause high risk.
Just remember, security should be a proactive partner, not a nay sayer. The point of a third party vendor assessment program is to close vulnerability gaps and work with the organization to meet business goals and needs, not police what they can and cannot use.
These four steps serve as great starting points in creating a preliminary vendor assessment program, but they’re not all-inclusive. If you want to take your planning further, consider contacting a certified cybersecurity consultant. They’ll work with you to produce a detailed risk assessment for your organization, including reviews of your overall third party risk, reviews of proposed and existing contracts, and execution of a dynamic risk assessment questionnaire.
