The number of security breaches attributed to third parties continues to rise – the IRS was hit by a wave of attacks last year and let’s not forget the infamous Target breach of 2013 that saw 40 million debit and credit card details leaked - yet a PwC Global State of Information Security Survey found that 74% of companies do not even have a complete inventory of all third parties that handle personal data of their employees and customers, are completely unaware that they’re over-sharing data and often don’t even know who officially “owns” the third party relationship.
Third parties increase vulnerability...
But third party relationships are a part of doing business in today's globalised world and even the smallest business can have many diverse global business relationships that help the company to grow. However, in working with third parties, your exposure to risk multiplies; IT security risks, regulatory compliance risks (those fines and potential prison sentences are only getting steeper), anti-corruption risks, operational risks, health and safety risks, environmental risks, quality risks and reputational risks. Not to mention additional consequences like increased vulnerability to litigation and depressed market value and share price.
A virtual minefield…
Of course not every third party you work with is going to be corrupt or hiding bribe-swallowing hackers. Some of these trusted third party relationships span decades, but it’s important to know that when talking about third party risk management, you’re talking about a constantly evolving environment; according to a Booz Allen Hamilton report, most third party incidents occur in an existing relationship. Attacks and mistakes happen and consequences are now very costly. It's your company at stake and your CEO’s head on the line, no matter whose fault it is. Organisations today are being held responsible not only for their own activities but also for the actions of customers, suppliers, vendors and partners. To make matters more challenging, regulators are cracking down even harder on potential third-party risks and with the complexity of supply chains and external partnerships often spanning countries with different laws, regulations and governance, businesses need to start protecting themselves and fast.
Some of these risks might have to be assessed during the on-boarding process but after that it’s often out of sight, out of mind, with out-dated contracts that might not reflect developments and trends that have appeared since being written up. Third-party risks that aren’t identified and mitigated can very easily snowball into big issues that damage your reputation and your bottom line, but how to effectively manage and monitor third party relationships still seems to confound many companies, whose approach is usually ad hoc and fragmented. It’s a tough one – businesses want to grow and stay competitive and this involves, to some extent, expanding their third-party network. On the other hand, doing business with a high-risk or non-compliant third party can land you in extremely hot water. In 2009 for example, a healthcare provider in Dallas found that one its contract security guards had hacked into several computers, including systems that contained confidential patient information. Six-figure fines aside, they found out the hard way that customers tend to bolt when something goes wrong; you don’t often get a chance to rebuild that trust. Your customers assume you have these various risks under control when they enter into a relationship with you, so it’s about keeping brand promises and living up to their expectations.
Without effective Privileged Access Management (PAM), it’s impossible to monitor third party activity or be able to proactively unearth potential security breaches, regulatory violations, theft, bribery etc. and those blind spots lead to disaster. These third parties become an extension of your company, so even if you’ve been working together for twenty years, you need to be managing and monitoring them effectively. Many companies are still grappling with increased complexity of third party networks, regulatory compliance pressures, and increased volumes of data, etc, and it’s easy to let things slide. However, with a cyber environment increasingly resembling the Wild West, it’s vital to remember that what was safe a few years ago isn’t safe any longer.
Businesses need to change the way they view security – it should be bespoke, for your environment and systems. And they are starting to see that; a recent WALLIX poll revealed that 70% of businesses thought Privileged Access Management to be very important but only 10% seem aware that a big reason for that is reducing third party risk. By providing full control and visibility of the sensitive, daily tasks of personnel (including third party personnel), an effective PAM solution can greatly reduce the risk of attack and also ensure compliance with industry regulations. Not being able to manage third parties like your own in-house teams was always never ideal, but with PAM, you can.
For more information, visit www.wallix.com or download our whitepaper on Managing Your IT Service Providers below.