Introduction

What is third-party information security risk management?
Third-party information security risk management (“TPISRM” or vendor risk management for short) is a critical component for ALL information security programs. You cannot adequately account for information security risk without also accounting for TPISRM.

Background

TPISRM isn’t new. Some organizations have been doing it for a long time. Mostly larger companies (with adequate resources) driven by compliance requirements. In the early 2000s, I worked on TPISRM for a few Fortune 500 companies and saw first-hand how things were done.

In 2013, TPISRM took center stage when Target Corporation became aware of a significant data breach involving one of their third-party providers (Fazio Mechanical). This was one of the most publicized cybersecurity breaches of all time because of the timing (holiday season), the number of people affected (110 million+), and the fact that Target is one of the largest retailers in the world.

One of the many lawsuits that stemmed from the Target breach was a derivative action where shareholders filed suit against Target’s board of directors, essentially Target suing Target. When this happens, the court appoints a special litigation committee (SLC), and this is where I fit in again. I was retained by the SLC to assist and consult them[1] [2]. What does this have to do with TPISRM? A lot! Vendor risk management program (or lack thereof) played a critical role in the breach.

Unfortunately, not enough has changed since then:

  • 66% of security professionals think that it’s possible or definite that they suffered a breach through third-party access[3]
  • Roughly 61% (just shy of two-thirds) of U.S. companies have experienced a data breach caused by a third-party.[4]
  • Third-party breaches and security incidents are more costly than ever, especially for smaller organizations.[5]
  • Only 52% of the companies in the United States have security standards for third-parties.[6]

TPISRM is more important than it’s ever been, and if you’re waiting for someone else to make you do it, it will be too late. Whatever you do, don’t half-ass this.

Three things before we jump into the “must-haves”:

  1. TPISRM can be done right and inexpensively, even in smaller organizations.
  2. You must engage in TPISRM, either now or later. “Now” hurts less.
  3. If you’re going to do TPISRM (which you’d better), make sure you do it right.

[1] https://dandodiaryboutique.lexblogplatformthree.com/wp-content/uploads/sites/893/2016/07/Target-SLC-Report.pdf
[2] https://dandodiaryboutique.lexblogplatformthree.com/wp-content/uploads/sites/893/2016/07/Target-Motion-to-Dismiss.pdf
[3] https://www.bomgar.com/resources/whitepapers/privileged-access-threat-report
[4] https://www.businesswire.com/news/home/20181115005665/en/Opus-Ponemon-Institute-Announce-Results-2018-Third-Party
[5] https://securityscorecard.com/blog/5-ways-to-prevent-data-breaches-caused-by-third-party-vendor
[6] https://www.pwc.com/us/en/cybersecurity/information-security-survey.html

Quick SecurityStudio Introduction

SecurityStudio (or S2) is a community and mission-driven information security solutions company dedicated to simplifying information security management and compliance. We help people and organizations in all industries (public and private) master information security fundamentals by providing practical tools on our best-in-class SaaS platform and through our trusted service partners.

The S2 platform is the premier risk and digital safety assessment tool in the world. Driven through our easy-to-use interface, information security risks can be assessed and managed for individuals (consumers and employees/personnel), the organizations they work for (public and private sector), and their vendors. With more than 3,000 assessments completed, our platform has been proven to be successful in simplifying and improving information security for hundreds of thousands of people.

Our tools:

  • S2Score – our quantitative scoring metric, plotted on a scale between 300-850.
  • S2Org – our organizational information security risk assessment tool.
  • S2Vendor – our third-party information security risk assessment tool.
  • S2Team – our team/personnel information security risk assessment tool.
  • S2Me – our personal information security risk assessment tool.

In this document, we’ll discuss things related to S2Score, S2Org, and S2Vendor, but don’t worry, I won’t get salesy. I want you to get value from reading this more than I want to sell you something.

Alright, the seven “must-haves” for TPRISM.

7 Must-Haves for Effective Third-Party Information Security Risk Management

Must-Have #1 – Adequate Coverage

Your TPISRM MUST account for administrative, physical, and technical risk.

The most tempting place in TPISRM to take shortcuts is to treat it like it’s a technical or IT issue. DON’T! It’s not! It’s a business issue and to treat it as anything else will be done at your own peril.

Effective TPISRM practices MUST account for administrative, physical and technical risks. Isn’t it easier (and more likely) for an attacker to go through a secretary (or another person) than it is to go through a firewall, and who cares about a firewall when an attacker can just steal the server? This is truth. I know it. You know it. Certainly, attackers know it too.

Technical controls are part of TPISRM. Technical controls are not TPISRM in its entirety. Slight, but significant difference. Scans are good, but they won’t tell you squat about a third-party’s employee training program, asset management practices, onboarding/offboarding processes, access control procedures, server room security, etc., etc.

DO NOT TAKE SHORTCUTS

Must-Have #2 – Automated Workflows

Using manual processes with spreadsheets and calendars is error-prone, costly, and ineffective.

The only people who claim spreadsheets are the way to do TPISRM have either never done TPISRM or they’re stuck in the dark ages (“this is the way we’ve always done it”). Not only is using spreadsheets a pain in the butt, it’s expensive and ineffective.

There’s a much better way! Use an automated workflow where TPISRM processes (inventory, classification, assessment, remediation, etc.) are programmatic. If you’ve got money to waste, you could build your own automated workflow tool, but a better choice is probably using a commercial tool. Automated workflows ensure that everything is tidy and easy to manage. If you’re handling any more than one or two third-party relationships, an automated workflow is a must.

Another fact; there is a demonstrable ROI in using an automated workflow versus using manual processes.

USE AN AUTOMATED WORKFLOW-ENABLED TOOL

MUST-HAVE #3 – Distributed Workloads

No single person knows enough about all vendor relationships to be effective.

The wrong way to handle TPISRM is to name a “TPIRSM Manager” or “Vendor Risk Manager” and leave everything to them. It’s unlikely that this person engaged the third-party in the first place, understands how the organization uses the third-party, and/or maintains the relationship with the third-party.

For each third-party relationship, there’s someone who’s responsible for the relationship. We sometimes call this person the “relationship manager”. These people must be involved in the TPISRM process. The best place for this person/group to be inserted into the TPISRM process is usually:

  • Third-party inventory management – validating that the third-party is still engaged by the organization.
  • Vendor contact maintenance – validating that the third-party’s contact information is valid.
  • Inherent risk determination (or classification) – validating how the organization uses the third-party, including the nature of the products or services provided.

If you’ve addressed the first two “must-haves” in our list, ensure that the tool you use will enable or facilitate participation from other people and groups. A shared workload makes everything better.

DO NOT TRY TO TACKLE TPISRM ALONE

MUST-HAVE #4 – Quantification

It’s easier to defend a process or system than it is to defend your judgment.

Regardless of how good you get at TPISRM, a bad thing (breach, disruption, or whatever) will eventually happen. No matter what you do, you cannot prevent all bad things from happening, but that’s not the point anyway. Risk elimination is impossible. Risk management IS possible, and it’s the objective.

The truth is, at some point you’ll need to defend your TPISRM program from someone, and they’ll probably question your judgement. It might be the board of directors, a regulator, a customer, or (God-forbid) opposing legal counsel. Somebody, somewhere, is going to question what you’re doing.

Quantification helps take your judgement out of the equation, and quantification comes through measurement. Quantification allows you to make comparisons between third-parties and set thresholds of acceptable risk. Setting a threshold of acceptable risk is easier to defend because you hold all third-parties to the same standard. One-off and arbitrary decision-making will be much harder to defend.

I have trouble remembering what I did last weekend let alone a decision I made in February of last year.

Adding to defensibility is using a tool, process, and/or risk threshold that’s used by others. There’s (some) safety in the herd.

QUANTIFY/MEASURE EVERYTHING

MUST-HAVE #5 – Objectivity

Binary (1 or 0) decisions are more efficient, easier to defend, and scorable.

Which question is more efficient, easier to defend, and scorable:

  • Tell me about your information security program? OR
  • Do you have a documented information security program?

How about these:

  • How do you train your employees? OR
  • Do you train your employees?

Binary (1 or 0, “yes” or “no”, etc.) questions are objective and create a much better measurement/quantification than do subjective, open-ended questions. The downside to objective questions is the to ask more of them. Once someone answers “Do you train your employees?”, we’ll need to ask more binary questions about the training.

Using objective criteria will also reduce the need for interpretation where two people can look at the same subjective/open-ended response and interpret in completely opposite ways. Subjectivity steals the efficiency and defensibility out of our TPISRM program.

USE OBJECTIVE QUESTIONS/CRITERIA

MUST-HAVE #6 – Inventory Management

Garbage in, garbage out.

The entire TPISRM process starts with your inventory of third-party relationships. It’s the first step. There’s the initial inventory and ongoing inventory management.

Build your initial inventory by checking who you’re paying, either through invoices, credit card payments, or employee reimbursements. Chances are good that you’re paying your third-parties in some manner, so Accounts Payable (or similar) is a great place to start.

In order to keep your inventory current, the “ongoing inventory”, you’ll need to determine how important it is for you to maintain a live inventory or if a periodic third-party inventory reconciliation is good enough. The answer should be a function of the churn in your third-party relationships. If third-parties come and go often, then there’s more justification for the live inventory approach. In a live third-party inventory scenario, you’ll need to make sure your third-party engagement/procurement/enrollment process is tightly-integrated with your TPISRM processes. Maybe you don’t pay any third-party until they’ve been assessed for cyber risk.

Periodic reconciliation consists of validating your inventory periodically, maybe on an annual basis.

A good TISRM tool accounts for all the “must-haves” here, including assistance with third-party inventory management. Entering third-party information one-by-one is fine but becomes a real pain when you have many third-parties to enter. A great feature is the ability to upload third-party information in bulk and a potential integration through APIs with other enterprise systems.

YOU CANNOT ACCOUNT FOR THIRD-PARTY RELATIONSHIPS YOU DON’T KNOW YOU HAVE

Must-Have #7 – Simplified Processes

Complexity is the enemy of information security.

Your TPISRM process shouldn’t consist of any more than four primary steps. If it’s more than four steps, you might be making this harder on yourself. The four steps are Inventory, Classification, Assessment, and Decision-Making. That’s it.

In some cases, you may need to repeat steps, but it’s still only four steps. For instance, you may decide (Decision-Making) that the risk posed by a third-party is unacceptable. In this case, you could decide to remediate, which will then lead back into the Assessment step.

DO NOT OVER-COMPLICATE THIS

BONUS: Assessment/Questionnaire Re-Use

Everybody hates filling out dumb questionnaires.

I have yet to meet anyone who enjoys filling out TPISRM questionnaires from their customers. If I did, I’d question their sanity. Filling out questionnaires is a waste of time. There are three ways we can make this more enjoyable and usable for everyone.

  1. What if we made the questionnaire into an organization’s information security risk assessment?
  2. What if an organization’s own/internal information security risk assessment could be used in lieu of a questionnaire?
  3. What if we reused a questionnaire that a third-party completed for someone else?

Yes, yes, and yes please!

On the SecurityStudio platform we’ve developed two effective, best practice, and simple tools to enable all the “must-haves” in this document, and significantly reduce wasted time, effort, and money for your third-party friends. By reusing assessments and questionnaires, you’ll get better results in your TPISRM efforts and your third-parties will sincerely appreciate having to do less work!

The tools are S2Vendor and S2Org.

S2Vendor is our best-in-class TPISRM tool for organizations of all shapes and sizes. S2Org is the best organizational information security risk management tool for vendor performance regarding security anywhere. Combined, there are no other solutions that compare!

Let’s demonstrate how these tools work together.

  1. A third-party who completes an S2Vendor questionnaire can use the same information to manage their information security program with a simple click of a button. The click of the button imports their responses into their own (private) S2Org portal where they can track results, print reports, create a roadmap (risk treatment plan), manage the roadmap, and much more! Not only can the third-party use this information to improve their security program in a measurable way, but they’re also more inclined to provide truthful answers to you as their customer.
  2. There are more than 3,000 organizations who already use the SecurityStudio platform and S2Org for information security risk assessments and management. Rather than having to complete another tedious questionnaire, an S2Org user can just choose to share their assessment (or resulting S2Score) with the S2Vendor user (you).
  3. If a third-party has already completed an S2Vendor assessment from someone else, rather than completing another assessment, you can allow them to confirm and reuse one that they’ve already completed. This saves you the headache of dealing with pushback and saves your third-party vendors a lot of time.

In Closing

There you have it. If you want to build a TPISRM practice/program the right way, these are seven things that you must have. Short cuts, manual processes, bottlenecks, subjectivity, gaps, and complexity must all be accounted for and taken out of the equation. If you’re into these things, well, that’s too bad. They’ll eventually come back to haunt you.

All the best.
Evan Francen CEO

In today’s business world, companies are utilizing third-party vendors more than ever before. Naturally, these vendors have a higher level of access to internal systems (containing sensitive data and information) with hopes of increasing the efficiency of services rendered.

The 2018 Ponemon statistics show that at least 56% percent of organizations have experienced a data breach due to a vendor’s security shortcomings.

We’ve reviewed numerous research and media publications to better understand the impact third-party vendors play in companies information security. In this article, you`ll find:

  • The definition of a data breach
  • An overview of key statistics related to data breaches
  • An in-depth look at the top 7 vendor related data breaches to date

Buckle up, this is going to be an eye-opening ride!

The ever-growing reality of data breaches

First, it’s vital to define a data breach.

The term data breach refers to a confirmed incident, in which sensitive, confidential, or otherwise protected data has been accessed and/or disclosed to unauthorized third parties. Data breach exposures may involve personal information, intellectual property, trade secrets, and any other sensitive information.

Collaborating with third-party vendors as trusted partners, creates an increased risk of exposure to a potentially serious data breach. Surveying across diverse industries, the Ponemon Institute concluded that cybersecurity incidents related to third parties are increasing (see the figure below).

Cybersecurity Incidents are Increasing and difficult to manage

65 % of respondents say that it’s hard to manage cybersecurity risks associated with third-party vendors. Also, a significant number of respondents admit they are sharing sensitive data with third parties, while not truly knowing their security policies (see the figure below).

The numbers don’t lie

The issue of vendor related data breaches is in constant flux. Numerous surveys have set out to explore the impact. Let’s review some of the key findings and highlights.

  • On average, Companies allow 89 vendors to access their networks weekly. (Bomgar survey)

The survey adds that 71% of respondents are expecting their companies to become more reliant on third parties in the next two years. In turn, this leads to growing security threats to both businesses and employees.

  • The number of data breaches related to third-party vendors has increased by 22% since 2015 (PwC survey)

PwC’s inaugural Digital Trust Insights survey exposes the growing problem and emphasizes the need for building lasting trust around data.

  • 74% believe that third-party vendor selection overlooks potential key risks, with 64% saying that their organization focuses more on cost than security when outsourcing  (Bomgar survey)

The report reveals that many businesses find costs more important than security; however, the authors of the survey argue that “the cost of not taking a potential threat seriously will be far greater than the cost of preventing third-party security risks.”

The numbers don’t lie: companies are impacted daily by breaches involving third-party vendors, threatening the financial stability and reputation of companies across all industries.

While the numbers are alarming and the threat is real, there are proactive steps you can take to be defensible. Why? Read to learn more.

The top 7 vendor-related breaches in history

After carefully examining a myriad of press releases, media and research publications, we compiled a list of some of the most noteworthy data breaches related to a vendor or a third-party. Our ranking considers factors like:

  • The scope of the breach.
  • The impact of the breach on the company and/or the compromised customers.
  • The nature of exposed data (financial and medical data, for instance, is more sensitive).
  • The recency of the incident.
Equifax Breach Meme

1. Equifax

When? 2017

What was leaked? The data ofapproximately 147 million consumers. The hackers accessed sensitive information like names, social security numbers, birth dates, addresses, and in some cases, driver`s license numbers, as well as the credit card numbers of about 209,000 US consumers.

Cost: A total cost of about $1.38 billion, according to the settlement documents (page 1) as quoted by The New York Times.

Vendor breached: The open-source software Apache Struts.

What happened?

Credit monitoring company Equifax reportedly discovered the breach on July 29 but waited for more than a month to warn its shareholders. The hackers exploited a vulnerability in the open-source software Apache Struts, which is a tool used for building web applications. Equifax used Apache Struts to support its online dispute portal – the place, where the company’s customers log issues with their credit reports.

As part of the settlement, you can file a claim to be compensated for the costs of recovering from the security breach — including any costs associated with the theft of your identity and freezing and unfreezing your account– and compensation of unauthorized charges to your banking accounts. The agreement caps payouts at $20,000 per person. Information about how to file a claim is available at Equifax`s website.

2. Target

When? 2013

What was leaked? The payment accounts of about 41 million customers and the personal details of around 70 million. Resulting in an estimated 110 million affected parties.

Cost: About $236 million in total expenses and more than 140 lawsuits filed against the company.

Vendor breached: A third-party HVAC vendor.

What happened?

According to the state`s investigation, the cyber attackers managed to access Target`s computer gateway by stealing credentials from a third-party HVAC vendor. These credentials helped the hackers exploit weaknesses in the company’s system, enter the customer service database, and install malware. The attackers accessed sensitive data such as full names, emails, credit card numbers, verification codes and more, as USA Today and other media outlets reported at the time.

The retailer had to pay an initial multi-state settlement of $18.5 million to cover state-specific costs associated with their investigations of the breach. Additionally, Target agreed to pay up to $10,000 to consumers who could prove their data was compromised.

3.  Home Depot

When? 2014.

What was leaked? The incident compromised the credit card data of roughly 56 million customers, as well as separate files containing approximately 53 million email addresses. An estimated 109 million consumers were affected.

Cost: About $179 million.

Vendor breached: The attackers used a Home Depot`s third-party vendor’s login credentials to install memory scraping malware on over 7,500 self-checkout POS terminals.

What happened?

According to Home Depot`s official announcement, the hackers used the username and password of an undisclosed third-party vendor to enter the Home Depot`s environment. Then, the cybercriminals acquired elevated rights that helped them deploy unique, custom-built malware on the retail company`s systems in the US and Canada.

The Target and Home Depot incidents expose two areas of information security that retailers generally struggle with. They often times have a lack of integration between inventory and internal systems, in addition to poor vendor risk management practices. Each data breach was successfully deployed by stealing third-party vendor credentials and RAM scraping malware, according to SANS research on the subject.

4. Marriott International

When? 2018.

What was leaked? Sensitive information including credit card details, passport numbers, names, gender, and dates of birth of roughly 500 million guest accounts.

Cost: About $72 million.

Vendor breached: The Starwood guest reservation database in the USA.

What happened?

Marriott International hotel chains, the parent company of prominent hotel chains like Sheraton, W Hotels, Westin Hotels, and Le Méridien, became aware of the massive hack on September 8, 2018.

The company received an alert from an internal security tool regarding an attempt to access the Starwood guest reservation database in the USA. Further investigations revealed that there had been unauthorized access to the Starwood network since 2014. The unauthorized party had reportedly copied and encrypted information before taking steps to remove it. Prior to being acquired by Marriot in 2016, Starwood was a third-party vendor used for booking reservations.

“We deeply regret this incident happened,” commented Arne Sorenson, Marriott’s President and Chief Executive Officer in Marriott`s press statement, which shed light on the breach.

The company was subject to several lawsuits for failing to protect its guests` accounts.

5.  Under Armour

When? 2018

What was leaked? Around 150 million MyFitnessPal accounts compromised. The leaked data included usernames, hashed passwords, and email addresses.

Cost: Not fully clarified yet. A consumer class action lawsuit was filed against Under Armour, which might face a number of legal claims or investigations by government regulators and agencies. The company may also be required to incur additional expenses to further enhance its data security infrastructure.

Vendor breached: The MyFitnessPal app, which was acquired in 2015 for $475 million.

What happened?

The vulnerability was introduced through the diet and fitness application MyFitnessPal. The app was acquired by Under Armour three years prior to the breach. On March 25, 2018, MyFitnessPal became aware that during February of the same year an unauthorized party acquired data associated with MyFitnessPal user accounts.

Under Armour`s data breach was one of the biggest of 2018, leading to a 4% drop in the company’s shares.

6. Saks, Lord & Taylor

When? 2018

What was leaked? Credit and debit card data of more than 5 million people. Most of the stolen cards were obtained from locations in New York and New Jersey.

Cost: Not fully clarified yet.

Vendor breached: The cash register systems at the Saks and Lord & Taylor stores in North America.

What happened?

A popular group of cybercriminals known as JokerStash managed to obtain the information by implanting a software into an unsecured point of in-store sale system.

The breach was initially reported by cybersecurity firm Gemini Advisory:

“Based on the analysis of the available data, the entire network of Lord & Taylor and 83 Saks Fifth Avenue locations have been compromised.”

The potential impacts of such breaches can be devastating for the reputation of both the parent company (Hudson’s Bay Co) and its subsidiary (Saks, Lord & Taylor). To mitigate such risks, companies need to ensure their divisions have received the necessary security awareness training.

7. Managed Health Services (MHS)

When? 2018

What was leaked? The personal data ofabout 31,000 plan members. The exposed information included names, insurance ID numbers, addresses, dates of birth, dates of service, and descriptions of medical conditions.

Cost: Not fully clarified yet. Managed Health Services has offered individuals affected in both incidents 12 months of free credit monitoring services. The organization has also invested in enhancing its email security and re-training staff on mailing processes and cybersecurity risks.

Vendor breached: The LCP Transportation vendor company (first incident). The second incident is attributed to a mailing mistake.

What happened?

Managed Health Services (MHS), the organization running the Hoosier Healthwise and Hoosier Care Connect Medicaid programs, admitted that personal data of about 31,000 plan members was accessed in two separate breaches.

The first incident was associated with a phishing attack at the LCP Transportation vendor company. The LCP employees received scam emails, allowing hackers to access their email accounts. In contrast, the second attack was attributed to a mailing mistake – notification letters of a future pharmacy change were sent to the wrong recipients, according to a publication published at Becker’s Healthcare.

Meanwhile, in Singapore, the Secure Solutions Group Pte. Ltd. (SSG) vendor was responsible for exposing the personal data of 80,000 blood donors, according to Info Security Magazine. These types of breaches remind us that medical records are a major target for attackers.

Are you still with me?

Let’s face it, the breaches that we have covered here are very large scale, involving enterprise-level companies, and may seem far removed from your business, but the potential risk is real and needs to be addressed. When it comes to hackers, there is a common misconception that only large companies are a target. Companies of all sizes are exposed to potential risk daily and it goes far beyond their internal systems

As we stated earlier vendors can be a vital piece of success for companies of all shapes and sizes, but they are also inadvertently responsible for the majority of the breaches that occur today. Taking all the necessary precautions to make your company defensible might seem like a daunting task, but we are here to help.

Food for thought

What are the measures that your organization currently takes to stay protected from potential vendor risks? Share with us in the comments below.

Securitystudio has taken a common sense approach to information security and we are here to help your business identify potential risks. Feel free to reach out if you would like to have a conversation and learn more about improving your information security program.

free information security risk assessment tool

Despite vendor-caused breaches being common, organizations still struggle to handle vendor risk management practices properly. We can use organizations who have experienced vendor breaches to improve our own information security programs and strategies. Here is how the Target breach from 2013 can provide a roadmap for your organization.