By Shanna Utgard, Cybersecurity Success Manager, Defendify
We’ve seen a significant increase in organizations falling
victim to the latest cyberattack, resulting in a costly trove of compromised business
and customer data. Any breach requires significant time, resources and money to
remediate, not to mention the unintended costs like legal fees and the potential
loss of customer trust and new business opportunities. Recent studies have shown that the
average cost of a data breach to businesses can range from $120,000 to $1.24
million, and that’s strictly looking at the non-enterprise market.
How does this happen when organizations are seemingly
following all the right steps to ensure their data is secure? The culprits can
often be the organizations you trust and willingly gave keys to your data: your
partners and vendors.
The Ramifications of Cyber Threats Are Far-Reaching
Cyber threats have grown in sophistication in today’s
increasingly hyper-connected world, so it’s critical to scrutinize all
potential entry points. External partners
and vendors are important to your business, but if left unchecked, they could unintentionally
compromise the security of your data.
In fact, before granting access to your data, you hold
the burden of responsibility to ensure your business partners have healthy
cybersecurity practices in place. Consider, for example, the confidential
documents or files detailing intellectual property (IP) that a law firm might
store about their clients and business partners. Not only could exposing this
type of data have far-reaching consequences, but an undetected cyber breach may
allow bad actors to gain access to other integrated systems, networks, or applications
and cause further damage.
So how can you properly vet your partners and vendors? Start
with a thorough cybersecurity risk assessment.
The Cybersecurity Risk Assessment
Larger enterprises
have been conducting cybersecurity risk assessments on their external partners
and vendors for years, but this is an important practice for organizations of
all sizes. Cyber attackers may use external providers to “island hop”. This
catchy term is a play on the military strategy of World War II where the United
States utilized smaller islands to get to their larger targets. Threat actors
use organizations with less advanced cyber protections to gain access to other
entities. A breach of your systems may lead to infecting a vendor, or your
third-party may cause a breach of your systems.
From the Target breach to the Solarwinds attack, we continue to be
reminded how important it is to understand the security weaknesses of your
vendors and partners and how they could put your data at risk.
A cybersecurity risk assessment will require your vendors
and partners to disclose the policies,
procedures, and tools they use to protect data across their organization, and
what potential security gaps could potentially lead to a compromise.
The assessment should include questions about technology
solutions and cloud applications used, data storage and protection methods, employee
cybersecurity training tactics, and data use policies and incident response plans,
company cybersecurity testing processes and more.
This task might
seem daunting to some, but consulting key security frameworks like the NIST Cybersecurity Framework will guide what you should look for. You can
reduce the complexity of assessing the cybersecurity posture of your third-party
providers by using a cybersecurity
assessment tool. The tool
should map assessment questions to security frameworks like NIST, CIS, HIPAA, or
GDPR. The result should be a detailed report that includes an overall
cybersecurity “grade”, a list of security gaps, and recommended next steps on remediating
vulnerabilities.
Remember, it is
not just your organization’s data you need to be mindful of, but also your
customers’ data. Requiring regular cybersecurity assessments from your external
partners and vendors not only reduces the risk of a breach but can show your customers
and prospects that you go above and beyond to protect their data – a nice potential
value-add that differentiates you from your competition.
##
ABOUT THE AUTHOR
Shanna Utgard, Cybersecurity Success Manager, Defendify
CRN Women of the Channel winner, Shanna Utgard, has been helping organizations without security teams, including IT service providers, build stronger cybersecurity programs beyond traditional methods. As an accomplished training professional, Shanna frequently speaks on a broad range of cybersecurity topics, from prevention tips to scaling revenue through cybersecurity.
Leave a Reply