Posts

The final step in the third-party vendor risk management process handles how we decide to treat the risks associated with third parties. The most objective method for risk treatment in relation to third-party information security risk management is pass/fail, acceptable/not acceptable. Either the S2SCORE meets (or exceeds) the acceptable level or it doesn’t.  This is key to standardization and defensibility.

Acceptable

If the resulting S2SCORE is acceptable, the review of the third-party information security risk is complete for this cycle. Information security risks for this third party should be reviewed again in the future, according to a schedule defined by your organization.

Not Acceptable

If the resulting S2SCORE is not acceptable, the third party will need to improve one or more of their information security controls to bring their S2SCORE above the acceptable threshold. As is true in real-life information security, there are several things that the third party could do to improve their score. The final determination will be negotiated between you and your third-party provider.

As the third party undertakes remediation, new S2SCOREs are calculated, and remediation continues until an acceptable S2SCORE is obtained. Once an acceptable S2SCORE is achieved, the review of third-party information security risk is completed until the next cycle.

Repeat Reviews

Although the review of third-party information security risk is complete, the cycle must repeat because several factors are likely to change over time. Your organization may change the way you use a specific third party, threats change, and vulnerabilities change over time. The review cycle you decide to adopt is entirely up to you and the resources you have available. The SecurityStudio default is annual.

Annual reviews should start again at the beginning of the process, Phase 1 of VRM – Inventory, by validating the accuracy of your third-party inventory.

s2core

Estimate your score or book free demo today

As mentioned in Phase 2 – Classification, High and Medium impact third parties need to be assessed for residual risk. Residual risk is another term that isn’t common to all people, so we’ll define it. Residual risk is the amount of risk that remains (residual) after the consideration of controls that are in place and any applicable threats. Residual risk assessments attempt to validate, qualify, and/or quantify risk related to threats and vulnerabilities, using inherent risk as a base input.

The first place to check for residual risk is an assessment that the third party may have already completed; an assessment that is high quality, fits our definitions of “information security” and “risk,” and represents risk. For SecurityStudio, this is the S2SCORE. The logic is simple: Does the third-party have a current S2SCORE or not?

Current Acceptable S2SCORE

If the third party has a current S2SCORE, then Phase 3 – Risk Assessment is complete for now, and the score is evaluated as part of Phase 4 – Risk Treatment. A threshold for S2SCORE must be set by the organization, and an automated comparison is made.

S2SCORE is calculated on a scale between 300 – 850, with 300 representing an infinite amount of risk and 850 representing no risk at all. Obviously, it’s not possible to have infinite risk or no risk, so all S2SCOREs fall between the range. Organizations that have not defined a specific threshold will typically accept a default S2SCORE of 660.

If the S2SCORE is acceptable, meaning it meets or exceeds your threshold, then the process is complete for you and the third party. That’s it!

If the S2SCORE is not acceptable, meaning it does not meet your threshold, then the process remains in Phase 3 – Assessment for next steps. An unacceptable S2SCORE follows the same process as not having a S2SCORE at all.

No Current Acceptable S2SCORE

Third parties that do not have a current S2SCORE and third parties that do not have an acceptable S2SCORE will receive a questionnaire that is commensurate with the level of inherent risk they pose to the organization. Third parties that are classified as High receive the High Residual Risk Questionnaire, and third parties that are classified as Medium receive the Medium Residual Risk Questionnaire.

All notifications to third parties are managed by SecurityStudio so that administrators don’t need to track and manage follow-up tasks.

All questionnaires are completed via an authenticated and secure online portal provided to the third-party provider.

High Residual Risk Questionnaire

By default, the High Residual Risk Questionnaire leverages simliar criteria* used in calculating the S2SCORE. This is important for (at least) five reasons:

  1. Validation of the questionnaire will result in a genuine S2SCORE that can be reused in other applications.
  2. The common set of criteria allows for better comparisons and consistent baselining across all third parties.
  3. Deliverables from the S2SCORE can be used to build the third-party security program and/or identify the greatest areas of concern accompanied by actionable recommendations. The S2SCORE provides value to the third party in this way.
  4. For the most impactful third parties, a S2SCORE can be validated by personnel who are certified by SecurityStudio® to complete validations. This ensures consistency across organizations who use SecurityStudio and S2SCORE.
  5. Validation of the S2SCORE can be done using in-house personnel, through SecurityStudio, or through any of the SecurityStudio partners. Today there are more than a dozen SecurityStudio partner organizations who are certified to perform validations.

Medium Residual Risk Questionnaire

By default, the Medium Residual Risk Questionnaire leverages the same criteria used in the calculation of the S2SCORE Estimator. The S2SCORE Estimator is a freely available assessment provided to anyone online and is also built into SecurityStudio. The important reasons why we’ve chosen to use the same criteria include some of the following:

  1. Any organization, with or without the use of VENDFENSE can get a score that can be leveraged without cost to the third party and be reused for third-party information security risk management if the inherent risk calculation results in a Medium classification.
  2. Ensures consistency within SecurityStudio and all other uses of the S2SCORE Estimator.
  3. The S2SCORE Estimator is an easy, and no-cost introduction to all that S2SCORE is and can be used for.

SecurityStudio S2SCORE

The result of the questionnaire process is a S2SCORE. The score is objective and automatic, and if the third parties are providing accurate and truthful information, the S2SCORE will be a true measurement of information security risk. There are times when you don’t believe that the information provided by the third party is accurate and true. These are times when you might want validation. There are also times when a third party is so critical to the success of your organization that you may want validation too. Regardless of the reason for validation, you are in control.

Now that the third parties have been assessed for residual risk, we move on to Phase 4 of VRM– Risk Treatment.

*Vulnerability scanning data, crime rate index, and natural threat data is not employed in the High Residual Risk Questionnaire but is used in the full S2SCORE and validated S2SCORE.

 

s2core

Estimate your score or book free demo today

Now that you’ve completed your vendor inventory, it’s time to classify them according to the risk they pose on your organization. Third-party classification is about rating your third-party providers according to the amount of inherent risk they present to your organization. The term”inherent risk” isn’t necessarily in everyone’s vocabulary, so let’s explain what it is. Inherent risk is the amount of risk that your vendor poses to your company based strictly on how you intend to use them. It’s a very simple process to classify your third-party providers according to inherent risk.  The point in doing this is to make sure we only spend your valuable time, and the valuable time belonging to your partners, on the risks that really matter.

Inherent Risk Questionnaire

The classification process starts with the Inherent Risk Questionnaire. This is a simple questionnaire that is completed by the person within your organization who is responsible for the third-party relationship.  This is usually the person who relies on the third party to complete certain tasks on behalf of your organization, or it’s the person who arranged for using the third party in the first place.

The questionnaire is very simple and straightforward, consisting of less than 10 questions.

VENDFENSE is very flexible and meant for all organizations. We pre-populate the system with default inherent risk questions to include in the Inherent Risk Questionnaire; however, we can also include custom questions.

Classification

Third-party providers are classified according to the inherent risk they pose to your organization. The classification is automatic, based on objective criteria defined and built into the SecurityStudio Classification Scoring System. The responses provided in the Inherent Risk Questionnaire lead to a classification of High, Medium, or Low. You could choose different words or different classifications, depending on your needs. The point is that the classification criteria should be objective, be a representation of inherent risk, and the classification levels you choose should be simple and logical.

A very important reason for classifying vendors according to inherent risk is to support the reasoning that not all vendors should be subjected to the same level of scrutiny because not all vendors pose the same amount of inherent risk.

High and Medium Impact

High and Medium impact (or inherent risk) third parties require additional review.  The third parties that were classified as High or Medium impact are moved into processing at Phase 3 – Third-Party Risk Assessment.

Low Impact

Low impact third parties are not a significant concern for most organizations. The processing of Low impact third parties is done after the classification. Low impact third parties are usually not reviewed again until the next cycle (quarter, semi-annual, annual, etc.)

In some cases, the percentage of third parties who are Low impact risk is as high as 80%. This is important to note. If an organization has 1,000 third parties that they work with, as many as 800 (or more) of these third-parties don’t need any further review beyond the initial inherent risk classification. This also means that there are 800 less questionnaires to keep track of and 800 less third parties that we need to secure.  Also important is the fact that we have demonstrated our due diligence by ensuring that all third parties were classified according to objective criteria.

Once the Classification step is complete, you’re ready to start  Phase 3 of VRM – Assessment.

 

s2core

Estimate your score or book free demo today

The topic of vendor risk management (VRM) is on the lips of nearly every CISO, IT Director, CTO/CIO and business owner in the country, and with good reason. Security breaches have reached near epidemic proportions and businesses don’t need to just worry about data being stolen. The real issue is what happens after the breach occurs when regulators, lawyers, and your own customers come after your business, trying to determine who is at fault for the breach.

Using third-party vendors adds another layer of complexity to finding the source of the breach, but even though it may have been the fault of the vendor, your business could still be liable. It’s critical to both track and monitor all vendors with a good VRM program and also classify them as low, medium or high risk so you can focus on those vendors that pose the most risk to your business. This business-critical process can help keep you out of hot water in the event of a third-party breach, but how do you know if your business is ready for a VRM program?

Use our quick guide below to determine if you should invest in a VRM program:

For a free demo of SecurityStudio, the vendor risk management tool that can help your business become simplified, standardized, and defensible, sign up.

 

s2core

Estimate your score or book free demo today

Information security programs are around to protect the data of the businesses they are a part of. Understanding risk is an important part of that, but ultimately it’s the business’s job to make decisions on what types of risks they are willing to accept. It’s the information security program’s job to make informed recommendations about those risks. Sometimes, though,  those recommendations are ignored.

While it’s important to make decisions that are best for the business, deviating from security recommendations can pose challenges. It’s important that you maintain a simple, standardized, and defensible information security program (and vendor risk management specifically). Certain business decisions detract from that.

Simplify

 

We fully understand that a business’s first goal is to make money. That’s why businesses exist. Security programs are meant to create efficiencies that align with your business objectives to be a driving force for profit— not the other way around. However, if you chose to make decisions independent of our security teams’ recommendations, you can actually do the opposite.

Information security programs (and their vendor risk management initiatives in particular) can have a monumental impact on the efficiencies of an organization— especially as it pertains to employee time.

People in information security programs are often required to chase down vendors. You need to have an inventory of all of our vendors so that we know who poses threats to you. In order to do that, your security team will start at accounts payable, get a list of the current vendors your business works on, and then spend ludicrous amounts of time trying to understand the level of risk that vendor poses.

Because your information security professionals have a limited understanding of what each vendor does, they have to get an idea from the person who works with them most closely how their interactions may pose security threats. You now have two employees taking up their time to get this information figured out.

Once this is finally determined, the information security employee is going to send out a questionnaire or spreadsheet to the vendor in hopes that the person on the other end is the right contact, that they’ll fill it out correctly, and that they won’t have to be chased down every three weeks to see if it’s been completed yet.

Do you see how time-consuming this can be?

A vendor risk management tool automates many of these processes. It eliminates the chasing, the back-and-forth, and the manual entry your information security employees would otherwise go through. Because of this, their time can instead be used on the things that will make the most positive impact on your bottom line. The same is true with the non-security employees that have to assist.

You may decide that you don’t want to spend the money on an automated solution to help you smooth down these processes. Doing these things without systems, though, creates unnecessary complexities— and complexity is the enemy of security and business.

Standardize

 

Standards are crucial when it comes to information security. There are rules, guidelines, principles, and best practices that should help feed your information security decision-making.

Information Security Industry Standards

Certain industries have requirements and regulations they are asked to follow with regards to information security. If your organization fits their threshold, you likely have no choice but to comply. While these standards don’t necessarily provide the perfect example of what security is, they do provide good foundational rules to follow. Deviating from the rules of industry standards can have two effects.

This is actually an example of where deviating from rules and standards can be a good thing. As mentioned before, security standards often provide a good foundational base for your security programs, but they are often just that— a minimum requirement that helps you get started. Businesses can (and should) deviate from industry standards by adding to them. Adding measures on top of what the industry standards suggest you accomplish in your security program is an important step in bolstering your protections.

The opposite side of that coin is choosing to skip or ignore standards that are required by your industry regulations. Doing this can severely damage your business. Payment card industry (PCI) compliance is a good example of this. Many small businesses choose not to go through the steps of being PCI compliant because of the time, effort, and money that goes into complying. However, a breach that impacts your customers’ credit card information often creates irreprehensible financial and reputational losses that could end up forcing you to close your doors permanently.

When it comes to vendor risk management, the same concern applies. You can choose to deviate from acceptable industry norms, here too. Some organizations choose to change up the assessment questions that they ask their vendors to complete regarding their risk. Doing so may push you outside the compliance threshold within your industry standards and it also requires someone to justify the changes. Justification relies on subjectivity, rather than objectivity, and makes it significantly more challenging to explain if you needed to defend your decision.

Internal Standards

Standards are one way to get everyone within your business on the same page about things like acceptable risk levels, information security spending, incident response measures, and more. Implementing a set of policies and procedures that are standard across your organization, and across organizations similar to yours, ensures that you’re taking the appropriate measures to mitigate risks and protect your business.

Deviating from your internal standards proves that they aren’t the right standards. If you feel that you need to make decisions that go against the standards of your organization, they clearly aren’t working for your business. And you won’t be able to expect others to follow them if you aren’t either.

Your risk increases as you deviate from standards too. Take the S2SCORE for example. You can use risk assessment metrics like S2SCORE to set a risk threshold you want your organization and vendors to uphold. You might make a decision that everyone needs to be above a 650 in order to continue working with them. Sometimes, though, the business might feel the need to make a decision outside the standards set in place. You may work with an organization whose business is critical to the success of yours. Therefore, you may want to accept them as a vendor despite their S2SCORE being 550 instead. While it’s important you make these kinds of decisions if you feel they’re critical to the business, it’s also important to understand that this increases the likelihood your data is compromised.

Defend

 

Ultimately, creating standards and sticking to them is all about making your organization more defensible in the event that something does go awry and your data is compromised. Breaches do happen. Often. It’s impossible to prevent all breaches.

Deviating from standards makes your business less defensible when a breach happens.

If your business feels they need to make exceptions to rules for its benefit, that’s fine. If you make a system standard, you just have to defend the standard. Make sure you’re taking a logical and objective approach to all of your exceptions before implementing them. This will help you stay defensible (and help you ensure that your decisions aren’t going to have a negative impact on your security).

If you make decisions that deviate from standards, customize systems too much, etc., it becomes increasingly more difficult to explain your case to those who are asking. Unfortunately, a breach’s impact stretches beyond your boardroom. Customers, news outlets, lawyers, and more will be asking questions about how and why things happened the way they did— and what you plan to do about it.

Particularly on the legal side and the industry regulator side of this, you’re going to have to explain why this incident happened. If you make exceptions to rules, you have to defend the logic behind the exception. Why you didn’t go with your standard? This is important to think about as we consider making decisions that extend beyond the scope of industry and internal standards that have already been implemented.

Conclusion

While it’s important for businesses to take information security recommendations seriously, it’s also important to remember that information security programs are around to supplement the business’s objectives. For that reason, businesses should be allowed to make decisions outside the scope of industry and internal security regulations. If they do though, there can and will be consequences. Weighing those consequences can be challenging, and it can be difficult to defend the logic behind any deviations. At the end of the day, make if you’re going to make decisions outside the recommendations of information security standards, ensure they still help your business simplify, standardize, and defend.

 

s2core

Estimate your score or book free demo today

Despite vendor-caused breaches being common, organizations still struggle to handle vendor risk management practices properly. We can use organizations who have experienced vendor breaches to improve our own information security programs and strategies. Here is how the Target breach from 2013 can provide a roadmap for your organization.

Vendor risk management is a critical portion of every organization’s information security program. The number of vendors the average business works with is growing, and the amount of sensitive data we let them have access to is as well. Despite this, many organizations still struggle to effectively manage the risk of their third-party vendors. By not understanding and handling these potential risks well, your organization is more prone to experiencing an information security incident through one of these vendors. Do you know where you stand in protecting your data from vendor risk breaches?

Almost all organizations fit into one of four categories when it comes to managing the data risk their vendors pose— none, painful, partial, or good. Let’s find out where you fit.

None

The largest category of the four is the “None” category, in terms of the number of organizations. According to our estimate, more than 50% of organizations in the United States do not have a third-party information security risk program.

Some of the reasons you may end up in this category include:

  • Not knowing any better.
  • Not knowing where to start.
  • You’ve tried before and failed or gave up.
  • You don’t see the value in establishing a good third-party information security risk management program.

If you’re in this category, what legitimate justification do you have?

If the numbers don’t lie, then you can assume that a data breach will happen by, or through, one of your third-party providers. An estimated 60% of all data breaches are caused by third-parties— directly or indirectly.  Your decision to not account for this significant risk is difficult to defend against in the court of public opinion, the court of law, or the court of regulatory compliance.

The bottom line is; not doing anything to address third-party information security risk is not defensible. It would a difficult defense to claim that you didn’t know. Either you did know and you’re not being truthful about it, or you legitimately were ignorant of how important this is. Both are bad defenses when trying to explain how and why you were breached. You’re admittedly and willingly avoiding one of the most significant information security risks facing your organization.

Painful

This second category is organizations that are doing some type of vendor risk management, but it’s a painful process (a checklist can be handy). This category is typically comprised of organizations that either want to do the right thing or are being forced to do the right thing.

Want to do the right thing

These are mostly well-run organizations that want to secure information because it’s the right thing to do in their opinion.

Forced to do something

These organizations are being pushed or forced into implementing a third-party information security risk management program by one or more regulatory (direct and/or indirect), legal, or contractual requirements.

The Typical Painful Approach

Regardless of why the organization has implemented a third-party information security risk management program, the program is painful. It is usually wrought with subjectivity, inefficiency, ineffectiveness, and disorganization.

Here’s a typical real-world example of a painful program. A person within the organization has been appointed as the “Vendor Risk Manager.” She begins by developing a policy and a process. The process includes vendor on-boarding, some training, and questionnaires. She inserts the first vendor into the newly designed process and quickly finds that there are some serious pain points:

  • She must run and maintain the entire process.
  • She doesn’t know each third-party provider, what they do for the organization, or how much information they have access to. The upfront research she needs to do is cumbersome and disruptive to her other duties. She tries to get the business to help, but the business views the process as a hindrance and isn’t enthusiastic about helping.
  • She sends questionnaires out to third-party providers with the best contact information she can find, but many of the questionnaires end up going to the wrong people. Some questionnaires even go to the wrong third-party provider.
  • Most of the third-party providers don’t really want to complete the questionnaires, and when they do, the subjective nature of the questions is interpreted in the best possible light for the provider, not the company trying to assess risk.
  • Tracking which questionnaires that were sent to which third-parties is difficult.
  • Following up with third-parties to get their questionnaires completed is often inconsistent or forgotten altogether.
  • Addressing third-party questions about the process and about how to complete questionnaires is time-consuming.
  • Reviewing each questionnaire and marking them for remediation is subjective and inconsistent.
  • Fighting with third-party providers for remediation of specific risks (or perceived risks) is contentious and draining.
  • Fighting with the business leaders within the company is useless.

Eventually, the third-party information security risk program falters as employees and vendors think it as more of an inconvenience than a way to improve the organization. If it’s made too painful for the vendors, they may even choose not to do business with our organization.

The painful approach is expensive and a waste of valuable resources. 

Partial

The partial approach is where organizations end up if they either don’t fully understand information security risk or don’t care if they’re not addressing information security risk well. These organizations often ask for things from a third-party that don’t specifically address risk or attempt to employ an easy button that only addresses a part of information security risk.

Ask for Things

Are you an organization that asks for something like a SOC 2 report or maybe ISO certification?

Asking for these things just so that you can check it off a list is not sufficient.  It’s important to read the reports and certification documents to make sure they address which risks are applicable to you and your work with the third-party. The motivation for the third-party in obtaining these things is to do as little as possible to obtain the report or certification. They are motivated to narrow the scope and get to a passing grade as quickly and cheaply as possible.

This may or may not sufficiently address third-party information security risk, and needs to be properly vetted before the box is checked. Businesses who ask for things and don’t vet the responses are only practicing partial vendor risk management.

Easy Button

A popular partial option used by many organizations is to employ an easy button. There are products and services on the market today that pose as third-party information security risk management tools, but only address one or two parts of information security risk. The most popular of these easy buttons are threat monitoring tools, security rating tools based on external and/or internal vulnerability(ish) scans, and continuous monitoring solutions.

Each of these tools are good at addressing one part of information security risk— most often external technical risks.

But information security risk is more than just external technical risks. Information Security is managing risk to information confidentiality, integrity, and availability, using administrative, physical, and technical controls – all together being security controls.

How do we address physical risk? After all, it doesn’t matter how well our firewall is operating if someone can steal our server.

People are often our biggest risk. It’s important that information security programs take administrative controls into account to mitigate the human error of information securirty.

The easy button solutions work well for the easy parts of information security, but they leave out the most significant risks. Use them for what they’re good at, but don’t assume you’ve got yourself covered if they’re all your using.

The partial approach is incomplete and leads to a false sense of security, which is sometimes worse than no security at all.

Good

A good third-party information security risk program is one that doesn’t compromise any part of our previous definition of third-party information security risk. It conducts its information security program in a manner that is simplified, standardized, and defensible.

Simplified

The simplest approach to third-party information security risk management is one where all third parties are vetted, and where vetting is done in a consistent and objective manner.

Simplified and easy are not the same. Simplified means that there isn’t any waste and everything in the program has a specific purpose. The components must all work seamlessly together and processes must be streamlined.

In the simplest sense, a good third-party information security risk management is made up of five components;

  • Policy (and supporting documentation)
  • Inventory
  • Classification
  • Assessment
  • Treatment

Standardized

A good third-party information security risk management program must be standardized. The same process must be followed every time. It’s not that we don’t continually refine and improve the program, it’s that we do so in a manner that is planned and consistent. In order to ensure standardization, the following must be true:

  • All third-parties must be assessed for the inherent risk in the same way.
  • All third-parties must be assessed for the residual risk in the same way.
  • Inherent and residual assessments must be objective.
  • Risk scoring must be consistently applied.
  • Thresholds must be set for all third-parties; driving risk treatment decisions.

Standardization can be achieved through rigid processes, but that could easily defeat our efforts to simplify. The best way to standardize is to use automation. Automation ensures that specific business rules are applied in a consistent manner, and it removes the non-standardization that often comes with human behaviors and decision-making.

Defensible

No matter what we do, we cannot prevent all bad things from happening. We live with a certain amount of risk, and there is no feasible way to eliminate it all. Organizations must consider how to defend themselves against the potential onslaught of regulatory investigations, civil suits, and loss of revenue.

Nobody expects a perfect approach to third-party information security risk management, but everyone should expect a reasonable approach to third-party information security risk management. Terms like due care, due diligence, and reasonable (or prudent) person are all very important when it comes to defensibility.

We aren’t lawyers, so we’ll borrow from publicly available sources to define these terms.

  • Due care refers to the effort made by an ordinarily prudent or reasonable party to avoid harm to another, taking the circumstances into account. It refers to the level of judgment, care, prudence, determination, and activity that a person would reasonably be expected to do under particular circumstances.
  • Due diligence in a broad sense refers to the level of judgment, care, prudence, determination, and activity that a person would reasonably be expected to do under particular circumstances.
  • Reasonable or Prudent man is a hypothetical person used as a legal standard especially to determine whether someone acted with negligence. This hypothetical person exercises average care, skill, and judgment in conduct that society requires of its members for the protection of their own and of others’ interests. The conduct of a reasonable man serves as a comparative standard for determining liability.

It seems perfectly reasonable for a person to establish a third-party information security risk management program according to the terms that we’ve defined. It’s easier to make the case that you practiced due care, which makes you more defensible.

Doesn’t Compromise

The last characteristic of a good third-party information security risk management program is that it doesn’t compromise what we define as information security or risk.

If we’re going to call it a third-party information security risk management, or something similar, it must account for information security risk. If we’re going to address only technical controls or the technical aspects of information security risk, then call it something like third-party IT risk management or third-party cybersecurity risk management.

These things are different. The differences may seem subtle in wording, but they are monumentally different in practice. There are no shortcuts in third-party information security risk management, we must account for administrative, physical, and technical controls or aspects.

A good third-party information security risk management program accounts for administrative, physical, and technical risk.

Take Action

Almost all organizations fit into one of four categories when it comes to managing the data security risk their vendors pose— none, painful, partial, or good.

If you need assistance in determining where your vendor risk management program sits, and how you can help to make your organization more simplified, standardized and defensible, schedule a demo.

 

s2core

Estimate your score or book free demo today