How To Check Out Suppliers Before You Commit

Uploaded on 2023-08-22 in TECHNOLOGY--Resilience, FREE TO VIEW, BUSINESS-Services-IT & Telecoms

Organisations are struggling to assess the risk supplier processes pose to their own operations, with many only doing so once a year after they’ve engaged a supplier. Only 13% of businesses assess the risk posed by their suppliers and only 8% of the wider supply chain, according to the UK government’s latest findings in the Cyber Security Breaches Survey 2023.

This is despite the fact that the threat posed by supply chain attacks is growing.

The State of the Software Supply Chain report from Sonatype found attacks were up 633% in 2021 and Gartner predicts that 45% of organisations will have experienced a cyber-attack that stems from their suppliers by 2025. And, failing to do your due diligence can be costly, leading to loss of reputation, fines associated with failing to meet sector specific compliance obligations and loss of revenue. Gartner found that 83% of legal and compliance leaders had detected third party risks after they had onboarded suppliers, while a survey carried out in February showed 84% of missed third party risks resulted in operational disruption.

So, given these consequences, why aren’t businesses being more proactive over assessing supplier risk?

According to the government survey, most fail to undertake or do a formal review due to lack of time and money (32%) and an inability to get the information necessary from suppliers in order to carry out the checks (31% up from 28% the previous year). Other reasons given included not knowing what to check (25%) and not feeling they had the skills to do so (18%).

Getting The Intel

Extracting information from suppliers is the issue here and it can prove time-consuming, costly and may even jeopardise relations. It can make it much harder to manage the business relationship going forward because without this information, the business is having to make uninformed decisions and guesstimates over risk levels, making it nigh impossible to hold the supplier to account over any breach of the terms and conditions of the Service Level Agreement (SLA).

What many don’t realise is that there are ways to gain this information without needing to approach the supplier at all. There’s a wealth of data that can be mined to provide insights into the security posture of the supplier and this can be used to validate the relationship before the contract is signed, as well as on an ongoing basis throughout the duration of the partnership.

A number of technologies have arisen that enable the monitoring of the external networks from External Attack Surface Management (EASM) to Digital Risk Protection (DRP) and Cyber Threat Intelligence (CTI). These have coalesced into a new field which analyst house Frost & Sullivan have dubbed External Risk Mitigation and Management (ERMM).

Using ERMM technologies, it’s now possible to execute automatic searches that inventory the supplier’s digital presence, enabling the business to carry out third party management without the need for consent or input from the supplier.

Risk Scoring Suppliers

A risk score can be created for each supplier the company is thinking of working with. This evaluates their vulnerabilities, level of exposure, IT hygiene and any instances of misconfiguration related to the supplier’s website, email, IP address and domain, giving a hacker’s perspective on how secure their processes are. As the evaluation doesn’t require the deployment or configuration of any software, it has no impact on either party.

If the business does decide to go ahead and engage with a supplier, the same technologies can be used to monitor any changes to the risk profile. This will look for changes such as chatter about the vendor, for instance, on the deep or dark web, in addition to the areas outlined above. This effectively allows the external monitoring inventory to be updated on a daily basis to give a continuous risk score so that, in the event of a breach, the business can quickly determine if any liability lies with the supplier.

The external risk score can be supplemented with an assessment of the supplier’s internal security through the usual method of a questionnaire submitted to the supplier. But the real risk will always tend to be external, because, like most organisations, suppliers have focused security resources on securing their internal networks and perimeter.

Going forward, there’s little doubt that organisations are going to need to become more proactive over how they risk assessing suppliers. The current economic climate is seeing more and more organisations outsource, with 71% saying their third party network now contains more suppliers than it did three years ago, according to Gartner.

But, relying on suppliers will always result in delays and missed information. By taking the matter into their own hands, organisations can gain better visibility and control over the risks posed and their third party management.

Abdullah Mirza is Director at CTM360 Image: Cybrain

You Might Also Read:

A 'Golden Pipeline' To Secure The Supply Chain:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.