How To Check Out Suppliers Before You Commit

Organisations are struggling to assess the risk supplier processes pose to their own operations, with many only doing so once a year after they’ve engaged a supplier. Only 13% of businesses assess the risk posed by their suppliers and only 8% of the wider supply chain, according to the UK government’s latest findings in the Cyber Security Breaches Survey 2023.

This is despite the fact that the threat posed by supply chain attacks is growing.

The State of the Software Supply Chain report from Sonatype  found attacks were up 633% in 2021 and Gartner predicts that 45% of organisations will have experienced a cyber-attack that stems from their suppliers by 2025. And, failing to do your due diligence can be costly, leading to loss of reputation, fines associated with failing to meet sector specific compliance obligations and loss of revenue. Gartner found that 83% of legal and compliance leaders had detected third party risks after they had onboarded suppliers, while a survey carried out in February showed 84% of missed third party risks resulted in operational disruption.

So, given these consequences, why aren’t businesses being more proactive over assessing supplier risk?

According to the government survey, most fail to undertake or do a formal review due to lack of time and money (32%) and an inability to get the information necessary from suppliers in order to carry out the checks (31% up from 28% the previous year). Other reasons given included not knowing what to check (25%) and not feeling they had the skills to do so (18%).

Getting The Intel

Extracting information from suppliers is the issue here and it can prove time-consuming, costly and may even jeopardise relations. It can make it much harder to manage the business relationship going forward because without this information, the business is having to make uninformed decisions and guesstimates over risk levels, making it nigh impossible to hold the supplier to account over any breach of the terms and conditions of the Service Level Agreement (SLA).

What many don’t realise is that there are ways to gain this information without needing to approach the supplier at all. There’s a wealth of data that can be mined to provide insights into the security posture of the supplier and this can be used to validate the relationship before the contract is signed, as well as on an ongoing basis throughout the duration of the partnership. 

A number of technologies have arisen that enable the monitoring of the external networks from External Attack Surface Management (EASM) to Digital Risk Protection (DRP) and Cyber Threat Intelligence (CTI). These have coalesced into a new field which analyst house Frost & Sullivan have dubbed External Risk Mitigation and Management (ERMM). 

Using ERMM technologies, it’s now possible to execute automatic searches that inventory the supplier’s digital presence, enabling the business to carry out third party management without the need for consent or input from the supplier. 

Risk Scoring Suppliers

A risk score can be created for each supplier the company is thinking of working with. This evaluates their vulnerabilities, level of exposure, IT hygiene and any instances of misconfiguration related to the supplier’s website, email, IP address and domain, giving a hacker’s perspective on how secure their processes are. As the evaluation doesn’t require the deployment or configuration of any software, it has no impact on either party.

If the business does decide to go ahead and engage with a supplier, the same technologies can be used to monitor any changes to the risk profile. This will look for changes such as chatter about the vendor, for instance, on the deep or dark web, in addition to the areas outlined above. This effectively allows the external monitoring inventory to be updated on a daily basis to give a continuous risk score so that, in the event of a breach, the business can quickly determine if any liability lies with the supplier.

The external risk score can be supplemented with an assessment of the supplier’s internal security through the usual method of a questionnaire submitted to the supplier. But the real risk will always tend to be external, because, like most organisations, suppliers have focused security resources on securing their internal networks and perimeter.

Going forward, there’s little doubt that organisations are going to need to become more proactive over how they risk assessing suppliers. The current economic climate is seeing more and more organisations outsource, with 71% saying their third party network now contains more suppliers than it did three years ago, according to Gartner.

But, relying on suppliers will always result in delays and missed information. By taking the matter into their own hands, organisations can gain better visibility and control over the risks posed and their third party management. 

Abdullah Mirza is Director at CTM360                                 Image: Cybrain

You Might Also Read: 

A 'Golden Pipeline' To Secure The Supply Chain:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« LinkedIn Accounts Hacked & Ransomed
Enrolment In Computing Degree Courses In Britain Increases »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Morgan Lewis Law

Morgan Lewis Law

Morgan Lewis is an international law firm with offices in North America, Europe, Asia, and the Middle East. Practice areas include Privacy and Cybersecurity.

NextLabs

NextLabs

NextLabs provides data-centric security software to protect business-critical data and applications.

Masergy Communications

Masergy Communications

Masergy delivers hybrid networking, managed security and cloud communication solutions to enterprises around the globe.

Ministry of Defence Georgia - Cyber Security Bureau

Ministry of Defence Georgia - Cyber Security Bureau

The aim of the Cyber Security Bureau is to establish and develop stable, effective and secure Information and Communication Technology systems for the Civil Office of MoD of Georgia.

Conscia

Conscia

Conscia provides IT infrastructure solutions and 24/7 services in network, data center, security and mobility.

Blue Ridge Networks

Blue Ridge Networks

Blue Ridge offers a suite of solutions that enable secure remote access to the enterprise network with protection and control of endpoints.

Quick Heal Technologies

Quick Heal Technologies

Quick Heal Technologies is a leading IT security solutions provider focused on endpoint and network security solutions.

Shape Security

Shape Security

Shape Security provide best-in-class defense against malicious automated cyberattacks on web and mobile applications.

BA-CSIRT

BA-CSIRT

BA-CSIRT is a center which is dedicated to assist and raise awareness among citizens and the Government of the City of Buenos Aires in everything related to information security.

Corsa Security

Corsa Security

Corsa Security is leading the transformation of network security with a private cloud approach that helps scale network security services with unwavering performance and flexibility.

Blue Cedar

Blue Cedar

Blue Cedar's mobile app security integration platform secures and accelerates mobile app deployment for enterprises and government organizations around the world.

Cohesity

Cohesity

Cohesity radically simplifies the way businesses back up, manage, protect, and extract value from their data—in the data center, at the edge, and in the cloud.

Olympus Sky

Olympus Sky

Olympus Sky has created a complete security system that is specifically designed to meet the challenges of IoT, including all of the deficiencies currently challenging Public Key Infrastructure.

Cyberwatch Finland

Cyberwatch Finland

Cyberwatch Finland's services improve decision-makers’ strategic situational picture and enable successful holistic cyber risk management.

White Tuque

White Tuque

A new way to protect your organization. White Tuque is your partner in identifying threats, understanding your risk, and ensuring your business remains resilient.

Semgrep

Semgrep

Semgrep is a fast, open-source, static analysis tool for profoundly improving software security and reliability.