Third Party Risk

Third-party Risk Assessment

Every organization works with vendors

  • Payroll, customer relationship management, email marketing, travel, raw materials

Important company data is often shared

  • May be required for cloud-based services

Perform a risk assessment

  • Categorize risk by vendor and manage the risk

Use contracts for clear understanding

  • Make sure everyone understands the expectations
  • Use the contract to enforce a secure environment

Penetration Testing

Pentest

  • Simulate an attack

Similar to vulnerability scanning

  • Except we actually try to exploit the vulnerabilities

Often a compliance mandate

  • May include a legal requirement

Regular penetration testing by a 3rd-party

  • Very specialized
  • Third-party experts are well-versed

Rules of Engagement

An important document

  • Defines purpose and scope
  • Makes everyone aware of the test parameters

Type of testing and schedule

  • On-site physical breach, internal test, external test
  • Normal working hours, after 6 PM only, etc.

The rules

  • IP address ranges
  • Emergency contacts
  • How to handle sensitive information
  • In-scope and out-of-scope devices or applications

Right-to-audit Clauses

Common to work business partners

  • Data sharing
  • Outsourcing

Third-party providers

  • Can hold all the data
  • Manage internet access
  • Are they secure?

Right-to-audit should be in the contract

  • A legal agreement to have the option to perform a security audit at any time
  • Everyone agrees to the terms and conditions
  • Ability to verify security before a breach occurs

Evidence of Internal Audit

Evaluate the effectiveness of security controls

  • Have a third party perform an audit

May be required for compliance

  • It’s a good idea, even without industry standards

Check for security controls and processes

  • Access management, off boarding, password security, VPN controls, etc.
  • There’s always an opportunity for improvement

Perform at a reasonable frequency

  • A single audit isn’t very helpful in the long-term

Supply Chain Analysis

The system involved when creating a product

  • Involves organizations, people, activities, and resources

Supply chain analysis

  • Get a product or service from supplier to customer
  • Evaluate coordination between groups
  • identify areas of improvement
  • Assess the IT systems supporting the operation
  • Document the business process changes

Software update installs malware: March-June 2020

  • Announced December 2020 by SolarWinds
  • Malware deployed with a valid SolarWinds digital signature
  • At least 18,000 of 300,000 customers potentially impacted

Independent Assessments

Bring in a smart person or team to evaluate security and provide recommendations

  • An outside firm

Specialists in their field

  • They do this all day, every day

They’ve seen it all

  • And can provide options you may not have considered

Vendor Selection Process

Due diligence

  • Check a company out before doing business
  • Investigate and verify information
  • Financial status, pending or past legal issues, etc.
  • Background checks, personnel interviews

Conflict of interest

  • A personal interest could compromise judgment
  • A potential partner also does business with your largest competitor
  • A third-party employs the brother of the CFO
  • A third-party offers gifts if a contract is signed

Vendor Monitoring

Ongoing management of the vendor relationship

  • This doesn’t end when the contract is signed

Reviews should occur on a regular basis

  • Financial health check, IT security reviews, news articles, social media posts

Different vendors may be checked for different indicators

  • Quantitative and qualitative analysis

Assign a person to be in charge of the vendor relationship

  • They will manage the monitoring process

Questionnaires

An important part of due diligence and ongoing vendor monitoring

  • Get answers directly from the vendor

Security-related questions

  • What is the vendor’s due diligence process?
  • What plans are in place for disaster recovery?
  • What secure storage method is used for company data?
  • And more

Results are used to update a vendor risk analysis

  • Updated during the life of the vendor relationship

Agreement Types

Common Agreements

Service Level Agreement (SLA)

  • Minimum terms for services provided
  • Uptime, response time agreement, etc.
  • Commonly used between customers and service providers

Contract with an Internet provider

  • SLA is no more than four hours of unscheduled downtime
  • Technician will be dispatched
  • May require customer to keep spare equipment on-site

Memorandum of Understanding (MOU)

  • Both sides agree in general to the contents of the memorandum
  • Usually states common goals, but not much more
  • May include statements of confidentiality
  • Informal letter of intent; not a signed contract

Memorandum of Agreement (MOA)

  • The next step above a MOU
  • Both sides conditionally agree to the objectives
  • Can also be a legal document, even without legal language
  • Unlike a contract, may not contain legally enforceable promises

Master Service Agreement (MSA)

  • Legal contract and agreement of terms
  • A broad framework to cover later transactions
  • Many detailed negotiations happen here
  • Future projects will be based on this agreement

Work order (WO)/Statement of Work (SOW)

  • Specific list of items to be completed
  • Used in conjunction with an MSA
  • Details the scope of the job, location, deliverables schedule, acceptance criteria, and more
  • Was the job done properly? Let’s refer to the SOW.

Business Partners Agreement (BPA)

  • Going into business together
  • Owner stake
  • Financial contract

Decision-making

  • Who makes the business decisions?
  • The BPA lists specific individuals and scope

Prepare for contingencies

  • Financial issues
  • Disaster recovery

Non-disclosure Agreement (NDA)

Confidentiality agreement between parties

  • Information in the agreement should not be disclosed

Protects confidential information

  • Trade secrets
  • Business activities
  • Anything else listed in the NDA

Unilateral or bilateral (or multilateral)

  • One-way NDA or mutual NDA

Formal contract

  • Signatures are usually required