Businesses must pay greater attention to third-party risk

Roles and responsibilities must be agreed on now to avoid blindspots and recriminations

Third-party relationships can pose a significant security challenge for businesses, with a clear delineation of responsibility needed to help avoid pitfalls, IT Pro has been told.

Speaking at EMC World 2016, Rob Sadowski, director of market insight at RSA, told IT Pro that while the supply chain has always been a potential vector of attack for businesses, the number of connected devices in use in any organisation is making it more complex to deal with.

"I think that fortunately this is an area where people are starting to at least recognise that this is a challenge, so it's not that they are completely blind to this idea. But, how do they really wrap their heads around it?" said Sadowski. "What third party relationships do they have? Just cataloguing that is a tremendous challenge."

Even once the number and nature of each third party relationship is established, however, there can still be confusion over who is responsible for certain areas. Indeed, this is something that could go unnoticed for years until one party suffers a breach and each believes it was the other's responsibility to ensure it didn't happen.

"I think that's often the most challenging part - who are the third parties I work with, what are they supposed to be doing, and are they actually doing it?" said Sadowski.

"It becomes a very difficult task and one that, especially as things get more reliant on service providers, really requires a bit of automation and a good process, because third-party risk is really growing significantly as part of the organisation's overall risk profile," he said.

Help is at hand, however, and this issue is being increasingly recognised by standards bodies, which are beginning to incorporate it into their guidelines.

"I think you see in some of the more progressive standards that are out there," said Sadowski. "Take, for example, the PCI Data Security Standard -- in the most recent revisions of the standard, there haven't been a lot of changes to core control objectives and things like that.

"Where some of the evolution has been is in how covered organisations deal with third parties [such as] clearly asking them ... [to] define who is responsible for what requirement and get acknowledgement from them that they are responsible."

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021
How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
Weekly threat roundup: Microsoft Defender, Adobe, Mimecast
vulnerability

Weekly threat roundup: Microsoft Defender, Adobe, Mimecast

14 Jan 2021
Mimecast admits hackers accessed users’ Microsoft accounts
Security

Mimecast admits hackers accessed users’ Microsoft accounts

13 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021