Why Third-Party Security Is your Security

Depending on third parties is inescapable. Every organization needs software, hardware, Internet connectivity, power, and buildings. It's unlikely they're going to do all those things themselves. That means that organizations must be dependent on others outside themselves. With that dependence comes risk.

F5 recently partnered with Ponemon Institute to survey CISOs. In the report, The Evolving Role of CISOs and their Importance to the Business, CISOs were asked: Are your organization’s business partners, vendors, and other third parties held to high security standards? The responses:

While 54% percent of the same survey respondents say they monitor third parties to ensure continued compliance with contractually required security requirements, only 21% say they hold third parties to a high security standard. Yet, interestingly, Beazley Insurance, in their breach insights blog from July 2017, reports that third-party suppliers account for 30% of breaches overall.

So, 28% of CISOs are ignoring 30% of their risk?

As my kids would say, "Seriously?"

To get some perspective, let’s look back at these serious security incidents from the past few years that involved third-party vendors:

Who Are Third Parties?

Compliance Requirements on Third Parties
Managing third-party risk isn't just a good idea, in many cases, it's the law. Your organization is required to contractually obligate security and privacy measures of third parties’ access to sensitive data if you:

These are just the direct regulations, there are many more that specify third-party security oversight but don’t get into specific detailed requirements like American banks and publicly traded companies.

Third-Party Controls
What to do about controls? Let’s learn from our fellow CISOs, per the same F5 and Ponemon report. To start, you will need to establish a third-party security policy. This policy should always begin with a statement that  communicates to the entire organization (and regulators) what your official stance is regarding a particular risk. In this case, you need a policy that says that your organization recognizes risk from third parties and will measure and control it to an acceptable level. Here’s how the surveyed CISOs defined the baseline:

Set a Standard for Evaluating Third-Party Security
Now that you have a policy, which is a general statement, you need to bolster it with some details. This third-party standard establishes the baseline that third parties must meet, so communicate it to them before you have to rely on them. The standard also serves as the benchmark that your organization will use to measure the third-party security. According to the survey, 57% of respondents  suggest establishing a process for evaluating the security protection capability of third parties before engaging in business activities, while 52% recommend establishing a vetting process to ensure all third parties are evaluated and screened against objective security requirements.

Monitor Third-Party Security
With a policy and standard in place, now you can set up on-going processes to do that measuring and feedback. Survey results show that 54% of respondents monitor third parties to ensure continued compliance with contractually required security requirements while 44% say they periodically review third parties to objective security requirements.

Enforce Violations from Standard
It’s one thing to set policies and measure against standards, but you need to something with those results or it’s all a waste of time. According to the survey:

Hopefully we’ve spelled out the specifics you need to put together a complete third-party security framework for your organization. Note where your peers are going and make it happen.

Get the latest application threat intelligence from F5 Labs.