Third-Party and Vendor Risk Management: Your Security Is Only as Strong as Your Connections

Organizations rarely operate completely on their own.

They rely on software vendors, cloud providers, contractors, consultants, suppliers, payment processors, managed service providers, and many other outside organizations to conduct business.

These relationships can improve efficiency and provide services that would be difficult or expensive to maintain internally.

They can also introduce cybersecurity risk.

An organization may have strong passwords, multifactor authentication, endpoint protection, security awareness training, and carefully configured networks. But if a trusted vendor with access to organizational systems is compromised, attackers may be able to use that relationship to reach the organization.

This is why third-party and vendor risk management is an important part of cybersecurity and the CompTIA Security+ Security Program Management and Oversight domain.

Cybersecurity does not stop at the organization's front door.

What Is Third-Party Risk?

A third party is an outside organization or individual that provides a product or service to an organization.

Examples can include:

• Software companies

• Cloud service providers

• Contractors

• Consultants

• Managed service providers

• Payroll companies

• Equipment suppliers

• Internet service providers

• Data storage providers

• Payment processors

• Temporary staffing companies

A third party may have access to organizational systems, facilities, networks, or information.

That access creates risk.

For example, imagine a company hires a vendor to remotely maintain an important application.

The vendor receives remote access to the organization's network.

If an attacker compromises the vendor's credentials, the attacker may attempt to use those credentials to access the customer's systems.

The organization is therefore affected by the vendor's security practices as well as its own.

Why Attackers Target Vendors

Attackers understand that large organizations may have sophisticated security controls.

Instead of attacking the organization directly, they may search for another route.

A smaller vendor may have:

• Weaker security controls

• Limited cybersecurity staffing

• Poor password practices

• Outdated software

• Excessive account privileges

• Inadequate monitoring

If that vendor has trusted access to another organization, compromising the vendor could provide attackers with a path into the larger target.

This is sometimes associated with a supply-chain attack.

Rather than attacking the final target directly, an attacker compromises a trusted product, service, supplier, or business relationship.

The Supply Chain Is Larger Than You Think

When people hear the term “supply chain,” they may think about trucks, warehouses, and physical products.

In cybersecurity, the supply chain can include software and digital services.

For example, an organization may use:

• A cloud-based email platform

• Electronic records systems

• Remote support software

• Security applications

• Payroll services

• Collaboration platforms

• Backup services

• Software libraries

• Hardware containing third-party components

Each dependency introduces another relationship that should be understood.

A single application may even depend on dozens of other software components.

This is one reason supply-chain security has become such an important cybersecurity concern.

Vendor Risk Begins Before the Contract

Vendor security should ideally be evaluated before a vendor receives access to organizational systems or information.

This process is sometimes called vendor due diligence.

Organizations may ask potential vendors questions such as:

• What security controls are implemented?

• Is multifactor authentication required?

• How is customer information encrypted?

• Who can access customer data?

• How quickly are vulnerabilities patched?

• How are security incidents detected?

• How will customers be notified of a breach?

• Are security assessments performed?

• Are employees provided cybersecurity training?

• Are background checks performed when appropriate?

• Does the vendor use subcontractors?

• Where is customer information stored?

• How long is information retained?

• What happens to customer information when the contract ends?

The level of review should generally reflect the level of risk.

A company providing office furniture probably does not require the same cybersecurity review as a company storing confidential organizational information.

Security Questionnaires and Assessments

Organizations may use security questionnaires when evaluating vendors.

These questionnaires help

Cybersecurity Risk Management: Identifying, Assessing, and Responding to Risk

 

Cybersecurity is not about eliminating every possible risk.

That would be nearly impossible.

Every organization faces cybersecurity risks from phishing attacks, malware, stolen passwords, outdated software, lost devices, system failures, third-party vendors, human mistakes, and many other sources.

The goal of cybersecurity risk management is to understand those risks, determine which ones could have the greatest impact, and decide what should be done about them.

Risk management is not just something performed by executives, cybersecurity professionals, or auditors. Employees play an important role because they often encounter risks during their everyday work.

Recognizing a suspicious email, reporting an unusual login notification, questioning an unexpected request for confidential information, or reporting a lost device can all be forms of risk management.

Understanding how cybersecurity risk works can help everyone make better security decisions.

What Is Cybersecurity Risk?

In simple terms, cybersecurity risk is the possibility that a threat could take advantage of a vulnerability and cause harm.

Three important concepts are involved:

Threat – Something capable of causing harm.

Vulnerability – A weakness that could be exploited.

Impact – The damage that could occur if the threat successfully exploits the vulnerability.

Consider a simple example.

An attacker sends an employee a phishing email.

The attacker represents the threat.

If the employee's account does not have adequate authentication protections, that could represent a vulnerability.

If the attacker successfully steals the employee's credentials, the impact could include unauthorized access to email, confidential information, or organizational systems.

Risk management asks an important question:

How likely is this to happen, and how serious would the consequences be?

Risk Is Everywhere

Organizations cannot operate without accepting some level of risk.

Using email creates risk.

Connecting computers to the internet creates risk.

Allowing remote work creates risk.

Using cloud applications creates risk.

Giving employees access to information creates risk.

Even installing security software introduces some operational risk if that software causes compatibility problems or system outages.

The goal is not to avoid technology or prevent employees from doing their jobs.

The goal is to understand the risks associated with technology and reduce them to an acceptable level.

Identifying Risk

The first step in risk management is identifying what could go wrong.

Organizations may identify risks through:

• Security assessments

• Vulnerability scans

• Penetration testing

• Audits

• Incident reports

• Employee reports

• Threat intelligence

• Vendor assessments

• Security monitoring

• Lessons learned from previous incidents

Employees can also identify risks during everyday work.

For example, an employee might notice that confidential documents are being stored in an inappropriate location.

Someone might notice that a shared account is being used by several employees.

Another employee might discover that a former employee still appears to have access to a system.

These observations should not be ignored simply because they have not caused an incident yet.

A vulnerability does not have to be actively exploited before it becomes important.

Reporting it gives the organization an opportunity to address the problem before something happens.

Assessing Risk

Once a risk has been identified, the organization needs to understand how significant it is.

Risk assessments commonly consider two major factors:

Likelihood: How likely is the event to occur?

Impact: How serious would the consequences be?

Imagine two vulnerabilities.

The first affects a computer that contains no sensitive information, is rarely used, and is isolated from important systems.

The second affects an internet-facing system containing confidential information.

Even if the technical vulnerability is similar, the risk may be very different because the potential impact and exposure are different.

This is why organizations prioritize cybersecurity risks rather than treating every issue exactly the same.

Qualitative and Quantitative Risk

Organizations may evaluate risk using either qualitative or quantitative methods.

Qualitative Risk Analysis

Qualitative analysis uses descriptive categories.

For example:

Low

Medium

High

Critical

An organization might determine that a vulnerability has a high likelihood of exploitation and a high potential impact.

This method is relatively easy to understand and communicate.

Quantitative Risk Analysis

Quantitative analysis attempts to assign numerical values to risk.

Organizations may estimate financial losses associated with security incidents.

For example, they might consider:

• Lost productivity

• Recovery costs

• Legal expenses

• Regulatory penalties

• Replacement equipment

• Lost revenue

• Incident response expenses

Security+ also introduces several important quantitative risk concepts.

Single Loss Expectancy

Single Loss Expectancy (SLE) estimates how much an organization could lose from one occurrence of an incident.

The basic formula is:

SLE = Asset Value × Exposure Factor

Suppose an organization has a system valued at $100,000 and estimates that a particular incident would result in a 25% loss.

The SLE would be:

$100,000 × 25% = $25,000

The estimated loss

Cybersecurity Risk: Why Every Employee Plays a Role in Protecting Our Organization

 

Cybersecurity is often associated with firewalls, antivirus software, passwords, and IT departments. While technology is certainly an important part of cybersecurity, some of the greatest cybersecurity risks organizations face involve something much more familiar: people and the everyday decisions we make.

Every email we open, link we click, password we create, file we share, and device we use can affect the security of our organization.

In healthcare, cybersecurity takes on even greater importance. We work with sensitive information, including patient information, employee information, financial records, operational information, and other confidential data. Protecting that information is not simply an IT responsibility. It is part of protecting the people we serve and maintaining their trust.

Understanding cybersecurity risk can help all of us make better decisions and recognize potential problems before they become security incidents.

What Is Cybersecurity Risk?

Cybersecurity risk is the possibility that a cyber threat could negatively affect an organization, its systems, its information, or the people it serves.

A risk does not necessarily mean that something bad has already happened. Instead, risk considers what could happen, how likely it is to happen, and what the impact could be if it does.

For example, receiving a phishing email does not automatically mean an account has been compromised. The risk comes from the possibility that someone might click the malicious link, provide their credentials, or open an infected attachment.

Organizations reduce cybersecurity risk through a combination of technology, policies, procedures, training, monitoring, and employee awareness.

No security system can eliminate every risk. The goal is to recognize risks and reduce them to an acceptable level.

Why Cybersecurity Risk Matters in Healthcare

Healthcare organizations are attractive targets for cybercriminals because of the amount and variety of information they maintain.

Patient records may contain names, addresses, dates of birth, insurance information, medical information, and other sensitive data. Organizations also maintain employee information, business records, financial information, credentials, and access to critical systems.

A cybersecurity incident can therefore have consequences far beyond a single computer.

A successful attack could potentially disrupt access to systems, delay patient services, expose confidential information, create financial losses, damage an organization's reputation, or interfere with normal business operations.

This is one reason cybersecurity and patient safety are increasingly connected.

When technology supports scheduling, communication, documentation, medications, treatment, and other healthcare operations, keeping those systems available and secure helps support safe and effective care.

People Are an Important Part of Cybersecurity

Cybercriminals understand that attacking technology directly can be difficult. Instead, they frequently attempt to manipulate people.

This is known as social engineering.

Phishing is one of the most familiar examples. An attacker may send an email designed to look like it came from a coworker, manager, vendor, bank, delivery company, or technology service.

The message may claim that your password is expiring, an invoice needs approval, a document has been shared with you, or your account will be disabled unless you act immediately.

The attacker wants you to react before you have time to think.

That is why urgency is such a common warning sign.

Before clicking a link or opening an attachment, consider whether the message makes sense. Look carefully at the sender. Be cautious when a message unexpectedly asks for credentials, financial information, confidential information, or immediate action.

If something does not seem right, verify it through a trusted method or report it.

Taking an extra minute to verify a suspicious message can prevent hours, days, or even weeks of work responding to a cybersecurity incident.

Passwords and Account Security

Passwords remain an important part of protecting organizational information.

A strong password should be difficult for another person or automated system to guess. Employees should follow organizational password requirements and avoid reusing work passwords for personal accounts.

Multifactor authentication, or MFA, provides another important layer of protection.

MFA requires another form of verification in addition to a password. This means that even if an attacker obtains someone's password, the attacker may still be unable to access the account.

However, MFA is not foolproof.

Attackers sometimes send repeated authentication requests hoping that a user will eventually approve one just to make the notifications stop. Never approve an MFA request you did not initiate.

Unexpected authentication prompts should be treated as potential warning signs and reported according to your organization's procedures.

Protect Information Based on Your Job Responsibilities

Access to information should be based on legitimate business needs.

Just because information is available through a system does not necessarily mean everyone should access it.

Employees should only access the information necessary to perform their job responsibilities and should only share information with individuals who are authorized to receive it.

This is particularly important when handling protected health information and other confidential information.

Before sending information, check the recipient carefully. Before sharing a file, confirm that the correct permissions have been assigned. Before discussing confidential information, consider who may be able to hear the conversation.

Small habits can prevent accidental disclosures.

Physical Security Is Cybersecurity Too

Cybersecurity is not limited to what happens online.

An unlocked computer can provide access to applications and information. A lost laptop, smartphone, or removable storage device can create a security risk. Printed documents left unattended may expose confidential information.

Lock your computer whenever you step away, even if you expect to be gone for only a few minutes.

Keep organization-owned equipment secure and report missing or stolen devices immediately.

Be aware of your surroundings when working with sensitive information, especially in public or shared spaces.

Physical security and information security work together.

Software Updates Matter

Updates sometimes feel inconvenient, but they serve an important security purpose.

Software vulnerabilities are weaknesses that attackers may be able to exploit. Once a vulnerability becomes known, software vendors may release a security update or patch to correct it.

Delaying required updates can leave systems exposed unnecessarily.

Employees can help by following organizational instructions regarding updates, restarts, and approved software.

Installing unauthorized applications can also introduce cybersecurity risks. Software downloaded from unknown or unapproved sources may contain malware or may not meet organizational security requirements.

When in doubt, contact IT before installing software or connecting unfamiliar equipment.

Reporting Quickly Reduces Risk

One of the most important cybersecurity habits is also one of the simplest:

Report suspicious activity quickly.

Sometimes employees hesitate because they are unsure whether something is actually a security problem.

You do not need to investigate it yourself.

If you receive a suspicious message, notice unusual activity, accidentally click something questionable, lose a device, or believe information may have been sent to the wrong person, report it through the appropriate organizational process.

Early reporting gives security and IT teams more time to investigate and potentially limit the impact.

Waiting can allow a small incident to become a much larger problem.

Cybersecurity Risk Is Also About Governance

Cybersecurity does not operate independently from the rest of an organization.

Governance provides the structure for determining how security decisions are made, who is responsible for those decisions, what policies must be followed, and how risks are managed.

Policies concerning passwords, acceptable use, access control, data handling, software installation, remote access, and incident reporting are not simply administrative requirements.

They are risk controls.

When employees follow those policies consistently, they help reduce organizational risk.

When employees bypass them because a shortcut seems faster or easier, they may unintentionally remove an important layer of protection.

Good cybersecurity governance depends on both leadership and employees doing their part.

Small Actions Make a Big Difference

You do not need to be a cybersecurity expert to improve security.

Every employee can reduce cybersecurity risk by practicing a few important habits:

• Think before clicking links or opening unexpected attachments.

• Use strong passwords and never share your credentials.

• Approve MFA requests only when you initiated the login.

• Lock your computer when stepping away.

• Access only the information needed to perform your job.

• Verify recipients before sending confidential information.

• Use approved software, devices, and storage locations.

• Complete required cybersecurity training.

• Follow organizational security policies and procedures.

• Report suspicious activity and potential mistakes promptly.

Individually, these actions may seem small. Collectively, they create multiple layers of protection that make it significantly more difficult for attackers to succeed.

Creating a Culture of Cybersecurity

Strong cybersecurity is not created by technology alone.

It develops when security becomes part of the organization's culture.

A strong security culture encourages employees to ask questions, report concerns, follow established procedures, and consider security when making everyday decisions.

It also recognizes that cybersecurity is not about creating fear. It is about awareness and responsibility.

Cybercriminals constantly adjust their methods. Technology changes. New vulnerabilities are discovered. New scams appear.

Our defenses must continue to evolve as well.

Technology provides important protection. Governance establishes expectations and accountability. Risk management helps identify where improvements are needed.

But people bring all of those pieces together.

Every time you recognize a phishing email, protect confidential information, lock your workstation, follow an established process, or report something suspicious, you contribute to the organization's cybersecurity defenses.

Knowledge Check

1. True or False: Cybersecurity risk is only the responsibility of the IT or cybersecurity department.

Answer: False. Cybersecurity is a shared responsibility. Every employee's actions can either reduce or increase organizational risk.

2. Which of the following could indicate a phishing attempt?

A. An unexpected attachment
B. A request for your password
C. A message creating unusual urgency
D. All of the above

Answer: D — All of the above.

3. True or False: If you accidentally click a suspicious link but nothing appears to happen, there is no reason to report it.

Answer: False. Report suspicious activity promptly so IT or security personnel can determine whether additional action is necessary.

4. Why should you lock your workstation when stepping away?

A. To save electricity
B. To prevent unauthorized access
C. To install updates
D. To improve computer performance

Answer: B — Locking your workstation helps prevent unauthorized access to systems and information.

5. What should you do if you receive an MFA approval request that you did not initiate?

A. Approve it to stop the notification
B. Ignore repeated requests indefinitely
C. Do not approve it and report the unexpected request
D. Ask a coworker to approve it

Answer: C — An unexpected MFA request could indicate that someone has obtained your credentials and is attempting to access your account.

Together, We Reduce Cybersecurity Risk

Cybersecurity risk cannot be completely eliminated, but it can be managed.

Technology, governance, policies, and security teams provide important protections, but employees remain one of the strongest layers of defense.

The next time you receive an unexpected email, access sensitive information, send a document, approve an authentication request, or step away from your computer, remember that your decision matters.

Think before you click. Protect information. Follow established processes. Speak up when something does not look right.

Cybersecurity is a shared responsibility, and small actions performed consistently can make a significant difference.

Secure today. Healthy tomorrow.