The MOVEit breach was the big ransomware story of last year. According to reporting, more than 60 million people were affected.
Numbers alone don’t explain its significance, though. In targeting an enterprise file transfer tool in the first place, perpetrators of the attack highlighted a significant risk to an organization’s operational and cyber resilience. That risk is third-party vendors.
Indeed, so many people were affected by the breach precisely because of the number of organizations using the tool. More than 2500 organizations are said to have been impacted, running the gamut from private business, government agencies, to even HR and payroll solutions.
What’s worse, the incident wasn’t a one-off. These types of attacks on third parties are becoming far more common.
According to last year’s Apple-sponsored study, 'The Continued Threat to Personal Data: Key Factors Behind the 2023 Increase', 98% of organizations reported having a relationship with a vendor that experienced a breach within the last two years.
With organization’s striving to bolster their own operational and cyber resilience, it's likely that cybercriminals will increasingly turn their attention to vulnerabilities in vendor systems to gain access to the data stored by organizations reliant on the vendor.
What can organizations do? Well, acknowledging that there’s a problem with third-party risk is the first step. Here are some other strategies companies can take to mitigate third-party ICT risk:
This type of vendor due diligence is most important when forming contractual arrangements concerning your critical or important functions. In this circumstance, organizations should take due consideration that vendors use the most up-to-date and highest quality information security standards.
Indeed, organizations will have to do the hard work of prioritising how much third-party ICT risk they are willing to tolerate. Controls, then, should be implemented based on the nature, scale, complexity, and importance of the ICT-related dependency, taking into account the criticality or importance of the respective service, process, or function.
These reviews should be undertaken at the highest levels of the organization. The managing body, whether a board or a senior leadership team, should regularly review third-party ICT risk. This should be reviewed with respect to the services supporting critical or important functions on the basis of an assessment of the overall risk profile of the company, as well as the scale and complexity of business services.
These interventions are by no means exhaustive. They are, however, apiece with the third-party risk management lifecycle.
The purpose of this lifecycle is to help organizations manage their third-party risk by ensuring that vendors meet the same standards and expectations (be they for cybersecurity, data privacy, or any other matter) as their internal teams.
Fortunately, firms don’t need to approach the third-party risk management lifecycle with the same manual processes and methodologies as they might have once used for the risk management lifecycle.
This is because advances in digital technology have led to third-party risk management platforms being purpose-built to streamline activities throughout the third-party lifecycle.
Solutions, such as using automated workflows to invite vendors and gather due diligence information using questionnaires and documents can simplify the onboarding process for third parties. Once onboarded, service details, contracts, and risk assessments are set up in collaboration with vendors to ensure alignment between parties.
Further capabilities include:
What other digital capabilities and best-practice measures are needed to mitigate third-party ICT risk? Read Noggin’s Guide to the Strategies and Digital Tools Needed to Manage Third-Party Risk to find out.