Businesses today mostly rely on third-party service providers and vendors for outsourcing the various business functions. The risk of cyber-threat from third-party service providers is mainly to large companies as a lot of sensitive data and internal systems to improve service delivery and cost-effectiveness. This interconnectivity leads to changes in data ownership and it’s documentation many times they chances of cyber threats increases. Third-party data breaches can not only do reputational damages but can also disrupt the business, loss of funds in recovery and increase the customers’ risk too. They generally a ruse from vendor security vulnerabilities that us when these organisations have lower security measures. To spot the potential weakness in the third-party partners, running a security check when contracting them is primary. Payroll processors are potential high risky and should always be PCI DSS compliant. Having a compromising of the data in the payroll processor’s systems can be very threatening to the entire business.
The third-party security breaches are increasing in numbers along with the security across all the businesses.
Some of the hazardous situations are –
- The cybercriminal Magecart group hacked manor retailers such as Ticketmaster, Feedify, British Airways and Newegg and exposed records of many customers. The group hacked third-party vendor which provided web-based credit card payment services through Javascript integration.
- Another infamous example is the breach of data of about 2.65 million patients of Atrium Health was breached through a billing vendor.
- An attack on a third-party vendor used for booking travel to the compromise of personal data of about 30,000 U.S. Department of Defense work
What does the data say about the risk?
According to the Ponemon Institute’s second annual “Data Risk in the Third-Party Ecosystem” study of 625 security professionals led to
- 61% of US respondents confirming the experience of a data breach from third-party vendors of their organisation.
- 56% confirming the third-parties direct to some form of a data breach in 2017.
- 49% confirming that a data breach was caused by one of their third-party partners in 2016.
This clearly indicates that companies are ill-suited to manage the security threats and potential risks arising from third parties. So having proper vendor cyber risk management is very essential for organisations.
The regular cyber attacks have become more complicated and access to personal and business information have become more intrinsic. Targeting the weakest entry lint- the third parties through integrated systems have increased.
What can be at stake with exposed data?
Not only the loss of customer base and loyal consumers a ton of penalty is also to be refunded for violation of privacy regulations.
- Failing to comply with regulations of HIPAA can amount to $1.5 million per year for each violation category.
- The fines for violating the EU’s General Data Privacy Regulation (GDPR) can reach up to the one valuing more – €20 million or 4% of annual revenue.
- In the UK Class actions are beginning to transit through the courts with a staggering £1000 – £2000 per record breached.
- California Consumer Privacy Act (CCPA) can demand penalties up to $2,500 per negligent violation and $7,500 per intentional violation if failed to comply with the regulations.
- consumers can individually demand CCPA damages ranging between $100 and $750.
These penalties further reinforce how important and costly failing to have dependable third-party cyber management can be.
Other than the compliance risk there are some other types of risks that vendors can present in businesses –
- Strategic risk – wherein can result in adverse business decisions and probable failure of implementing required business decisions to achieve the organization’s immediate goals.
- Operational risk – it is can direct to losses incurred erred internal processes, people, system and from external incidents.
- Transactional risk – issues related to service or product delivery.
- Reputational risk- can effectively lead to negative public opinion regarding the company.
Solutions to manage the risks from third-party vendors and partners in business
- Mapping the data flow is very essential for understanding the extent of potential threat. Prioritising the data ownership and implementation mechanisms can help in easy data tracking in both physical and digital formats. Assigning data custodians and enforcing system control, regular monitoring of security policies and handling data discipline through auditing can assist.
- Assessing the security system of third-party before the partnership can hell in assessing the risk well. Categorising the third parties according to their volume of transactions, regulated data, and data sensitivity type is the first step. Regular assessment and evaluation of the security control in these organisations and their privacy laws will assist in the management of threats from third-party cyberattacks. Using cyber threat intelligence reports should be used to identify the profiles of third parties. This profiling will help in the assessment of cybersecurity and further mitigation of problems.
- Making a cyber incident response plan to deal with threats. The actions should mainly include training of the broader company, conducting advance planning and rehearsal, and assigning accountability for communicating with media and stakeholders. Having a customer portal which is interactive and will answer queries in threatful situations should be stressed upon.
- Another method to get protection against third party risk is getting a cyber liability insurance policy. Cyber insurance provides cyber liability protections. Traditional Commercial General Liability (CGL) policies do not cover losses occurring due to cyber incidents. Cyber insurance coverage has focused on first and third-party coverages that incorporate revenue and number of records at risk.
For mitigating the third-party risk and accomplishing the security
- Analysis of whether to engage in business with a vendor is essential. The entitled risks and level of integration need to be evaluated thoroughly by the third party’s security gaps.
- The security assessment to identify the lapses in security if the third party will need to be solved. Collaboration and engagement to close and secure the system should be followed.
- The third-party should fix those cyber gaps which can potentially pose a threat to the entire organisation. After verification of the remedial steps and proper risk classification, the company can approve or reject the partner vendor.
- The continuing and regular monitoring of the entire security policy and detection of any new fallacies is essential.
Having a proper system and caretaking of the three from the third party vendors is essential for any business for proper development.
Download our Vendor Evaluation as a Service white Paper Download
