Third-Party and Vendor Risk Management: Your Security Is Only as Strong as Your Connections

Organizations rarely operate completely on their own.

They rely on software vendors, cloud providers, contractors, consultants, suppliers, payment processors, managed service providers, and many other outside organizations to conduct business.

These relationships can improve efficiency and provide services that would be difficult or expensive to maintain internally.

They can also introduce cybersecurity risk.

An organization may have strong passwords, multifactor authentication, endpoint protection, security awareness training, and carefully configured networks. But if a trusted vendor with access to organizational systems is compromised, attackers may be able to use that relationship to reach the organization.

This is why third-party and vendor risk management is an important part of cybersecurity and the CompTIA Security+ Security Program Management and Oversight domain.

Cybersecurity does not stop at the organization's front door.

What Is Third-Party Risk?

A third party is an outside organization or individual that provides a product or service to an organization.

Examples can include:

• Software companies

• Cloud service providers

• Contractors

• Consultants

• Managed service providers

• Payroll companies

• Equipment suppliers

• Internet service providers

• Data storage providers

• Payment processors

• Temporary staffing companies

A third party may have access to organizational systems, facilities, networks, or information.

That access creates risk.

For example, imagine a company hires a vendor to remotely maintain an important application.

The vendor receives remote access to the organization's network.

If an attacker compromises the vendor's credentials, the attacker may attempt to use those credentials to access the customer's systems.

The organization is therefore affected by the vendor's security practices as well as its own.

Why Attackers Target Vendors

Attackers understand that large organizations may have sophisticated security controls.

Instead of attacking the organization directly, they may search for another route.

A smaller vendor may have:

• Weaker security controls

• Limited cybersecurity staffing

• Poor password practices

• Outdated software

• Excessive account privileges

• Inadequate monitoring

If that vendor has trusted access to another organization, compromising the vendor could provide attackers with a path into the larger target.

This is sometimes associated with a supply-chain attack.

Rather than attacking the final target directly, an attacker compromises a trusted product, service, supplier, or business relationship.

The Supply Chain Is Larger Than You Think

When people hear the term “supply chain,” they may think about trucks, warehouses, and physical products.

In cybersecurity, the supply chain can include software and digital services.

For example, an organization may use:

• A cloud-based email platform

• Electronic records systems

• Remote support software

• Security applications

• Payroll services

• Collaboration platforms

• Backup services

• Software libraries

• Hardware containing third-party components

Each dependency introduces another relationship that should be understood.

A single application may even depend on dozens of other software components.

This is one reason supply-chain security has become such an important cybersecurity concern.

Vendor Risk Begins Before the Contract

Vendor security should ideally be evaluated before a vendor receives access to organizational systems or information.

This process is sometimes called vendor due diligence.

Organizations may ask potential vendors questions such as:

• What security controls are implemented?

• Is multifactor authentication required?

• How is customer information encrypted?

• Who can access customer data?

• How quickly are vulnerabilities patched?

• How are security incidents detected?

• How will customers be notified of a breach?

• Are security assessments performed?

• Are employees provided cybersecurity training?

• Are background checks performed when appropriate?

• Does the vendor use subcontractors?

• Where is customer information stored?

• How long is information retained?

• What happens to customer information when the contract ends?

The level of review should generally reflect the level of risk.

A company providing office furniture probably does not require the same cybersecurity review as a company storing confidential organizational information.

Security Questionnaires and Assessments

Organizations may use security questionnaires when evaluating vendors.

These questionnaires help