Is Your Vendor Secure? Because It Could Be the Door to Your Organization

An organization can invest in a firewall, MFA, EDR, backups, procedures and training. And then give an external vendor direct access to a critical system.

Business reality is built on vendors, and that is fine. But it means the organization's cyber boundaries are no longer the same as its physical ones.

How many companies hold part of your data today?

The payroll system. CRM. The cloud provider. The development company. The IT provider. The payment processor. The mailing platform. The accountant. Support services. Backups.

Each of them can be part of the organization's data chain. Some only hold data. Some also get access. Some are critical for the business to be able to work.

Outsourcing does not transfer all of the risk

When a company moves an activity to a vendor, it gains expertise, efficiency and service. But in an incident, your customer will not always care which external company was responsible.

• If data leaked, it is still the business's data.
• If the service went down, your business may be the one that cannot work.
• If a vendor holds administrator permissions, an attack on them can become an attack on you.

Not every vendor is the same risk

This is one of the most important points. There is no sense in running the same review for a cleaning company and for the vendor that manages your entire Microsoft 365 environment. It is worth understanding:

• What does the vendor do?
• What data can they see?
• What permissions do they have?
• How dependent is the organization on them?
• What happens if they stop operating?

The more critical the vendor, the deeper its oversight should be.

The vendor connected three years ago. Do they still need access?

This is a common weak spot. A vendor received VPN access for an installation. The project ended. The contact person changed. Nobody asked to remove the account. The access stayed.

It is not a dramatic scenario, and that is exactly the problem. Many risks come from an accumulation of small decisions that made sense at the time they were made. It is the same principle that applies to employee access permissions.

And what happens when the engagement ends?

The end of a contract is not necessarily the end of the risk:

• Does the vendor still hold data?
• Was access revoked, and do accounts still exist?
• What about backups held by the vendor, and what about equipment?
• What about specific users at the vendor who were given permissions?

A vendor's lifecycle should include the exit as well.

A contract is not a substitute for management

An information security clause in the contract is important, but it does not always tell you what happens in practice. You can write that the vendor uses appropriate security measures, but what counts as "appropriate"? You can write that they will report an incident, but within how long? To whom? And what do they do with the data when the engagement ends?

The contract is one layer within a broader system, which in many organizations is owned by a role such as an external CISO.

Even a large vendor can be hit

A well-known name is not immunity. The reason to choose a professional vendor is usually that they can run the service better. But any organization can experience an incident.

So the decision is not whether to "trust" or "not trust" the vendor. The question is how to manage the risk according to its importance, and a cyber risk assessment is a good place to start.

Third-party risk with Marom Cyber

Marom Cyber helps organizations identify and assess risks that come from vendors and third parties, as part of the overall cyber program. It is part of our information security and cyber advisory services.