Businesses must pay greater attention to third-party risk

Roles and responsibilities must be agreed on now to avoid blindspots and recriminations

Third-party relationships can pose a significant security challenge for businesses, with a clear delineation of responsibility needed to help avoid pitfalls, IT Pro has been told.

Speaking at EMC World 2016, Rob Sadowski, director of market insight at RSA, told IT Pro that while the supply chain has always been a potential vector of attack for businesses, the number of connected devices in use in any organisation is making it more complex to deal with.

"I think that fortunately this is an area where people are starting to at least recognise that this is a challenge, so it's not that they are completely blind to this idea. But, how do they really wrap their heads around it?" said Sadowski. "What third party relationships do they have? Just cataloguing that is a tremendous challenge."

Even once the number and nature of each third party relationship is established, however, there can still be confusion over who is responsible for certain areas. Indeed, this is something that could go unnoticed for years until one party suffers a breach and each believes it was the other's responsibility to ensure it didn't happen.

Advertisement
Advertisement - Article continues below

"I think that's often the most challenging part - who are the third parties I work with, what are they supposed to be doing, and are they actually doing it?" said Sadowski.

"It becomes a very difficult task and one that, especially as things get more reliant on service providers, really requires a bit of automation and a good process, because third-party risk is really growing significantly as part of the organisation's overall risk profile," he said.

Help is at hand, however, and this issue is being increasingly recognised by standards bodies, which are beginning to incorporate it into their guidelines.

"I think you see in some of the more progressive standards that are out there," said Sadowski. "Take, for example, the PCI Data Security Standard -- in the most recent revisions of the standard, there haven't been a lot of changes to core control objectives and things like that.

"Where some of the evolution has been is in how covered organisations deal with third parties [such as] clearly asking them ... [to] define who is responsible for what requirement and get acknowledgement from them that they are responsible."

Featured Resources

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

How do vulnerabilities get into software?

90% of security incidents result from exploits against defects in software

Download now

Delivering the future of work - now

The CIO’s guide to building the unified digital workspace for today’s hybrid and multi-cloud strategies.

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/business-strategy/digital-transformation/354201/boston-dynamics-dog-like-robots-sniff-out-bombs-for
digital transformation

Boston Dynamics dog-like robots sniff out bombs for Massachusetts police

26 Nov 2019
Visit/business-strategy/mergers-and-acquisitions/354191/xerox-threatens-hostile-takeover-after-hp-rebuffs
mergers and acquisitions

Xerox threatens hostile takeover after HP rebuffs $30bn takeover

22 Nov 2019
Visit/security/data-breaches/354192/t-mobile-data-breach-affects-more-than-a-million-users
data breaches

T-Mobile data breach affects more than a million users

25 Nov 2019
Visit/mobile/google-android/354189/samsung-galaxy-a90-5g-review-simply-the-best-value-5g-phone
Google Android

Samsung Galaxy A90 5G review: Simply the best value 5G phone

22 Nov 2019