5 Steps to Manage Third-Party Security Risks

This post was originally published on KCNext.

Networks were once the fences that protected businesses from external threats – a barrier only employees could access, fully controlled by the company.

The rise of telecommuting, virtual private networks and BYOD initiatives has changed it all. Businesses are increasingly reliant on third-party applications and business partners, from cloud storage providers to payroll systems, that have access to sensitive information. Many third parties use other third parties themselves, leaving companies with little control over  their information security protocols.

Bad outsourcing decisions are responsible for 63 percent of data breaches, and 53 percent of organizations who are victims of a data breach are vulnerable to another attack because service providers come with third party security problems.

Even with solid security practices, no company is immune to insecure protocols. Risk management offers a way to face the challenges that come with third-party vendors:

1. Establish a vendor management program. It should begin with an initial assessment that can be reviewed at regular intervals.

2. Rank vendors according to risk. Comprehensively catalog all third-party risks and rank them according to severity. A rules-based due diligence test will ensure a systematic approach. Also try leveraging existing vendor risk assessments, such as the Shared Assessments Program, to keep up-to-date with industry standards.

3. Ensure third-party apps employ proper protocols. With more apps hosted on the cloud, properly integrated security is imperative. The Cloud Security Alliance recently launched an open API group to standardize APIs, which should help to ensure core business systems communicate securely with other applications.

4. Practice endpoint security. Every computer is an endpoint, and each terminal must be responsible for its own security. Commercial cloud systems have significantly increased endpoint risk, and systems must be in place to combat this threat. Enforce a network-wide usage policy, and find an endpoint security product that offers strong real-world protection.

5. Keep current with third-party vulnerabilities. Ironically, some great third-party big data tools are available that can provide vulnerability intelligence. The National Vulnerability Database is the biggest and best one.