How To Check Out Suppliers Before You Commit

Organisations are struggling to assess the risk supplier processes pose to their own operations, with many only doing so once a year after they’ve engaged a supplier. Only 13% of businesses assess the risk posed by their suppliers and only 8% of the wider supply chain, according to the UK government’s latest findings in the Cyber Security Breaches Survey 2023.

This is despite the fact that the threat posed by supply chain attacks is growing.

The State of the Software Supply Chain report from Sonatype  found attacks were up 633% in 2021 and Gartner predicts that 45% of organisations will have experienced a cyber-attack that stems from their suppliers by 2025. And, failing to do your due diligence can be costly, leading to loss of reputation, fines associated with failing to meet sector specific compliance obligations and loss of revenue. Gartner found that 83% of legal and compliance leaders had detected third party risks after they had onboarded suppliers, while a survey carried out in February showed 84% of missed third party risks resulted in operational disruption.

So, given these consequences, why aren’t businesses being more proactive over assessing supplier risk?

According to the government survey, most fail to undertake or do a formal review due to lack of time and money (32%) and an inability to get the information necessary from suppliers in order to carry out the checks (31% up from 28% the previous year). Other reasons given included not knowing what to check (25%) and not feeling they had the skills to do so (18%).

Getting The Intel

Extracting information from suppliers is the issue here and it can prove time-consuming, costly and may even jeopardise relations. It can make it much harder to manage the business relationship going forward because without this information, the business is having to make uninformed decisions and guesstimates over risk levels, making it nigh impossible to hold the supplier to account over any breach of the terms and conditions of the Service Level Agreement (SLA).

What many don’t realise is that there are ways to gain this information without needing to approach the supplier at all. There’s a wealth of data that can be mined to provide insights into the security posture of the supplier and this can be used to validate the relationship before the contract is signed, as well as on an ongoing basis throughout the duration of the partnership. 

A number of technologies have arisen that enable the monitoring of the external networks from External Attack Surface Management (EASM) to Digital Risk Protection (DRP) and Cyber Threat Intelligence (CTI). These have coalesced into a new field which analyst house Frost & Sullivan have dubbed External Risk Mitigation and Management (ERMM). 

Using ERMM technologies, it’s now possible to execute automatic searches that inventory the supplier’s digital presence, enabling the business to carry out third party management without the need for consent or input from the supplier. 

Risk Scoring Suppliers

A risk score can be created for each supplier the company is thinking of working with. This evaluates their vulnerabilities, level of exposure, IT hygiene and any instances of misconfiguration related to the supplier’s website, email, IP address and domain, giving a hacker’s perspective on how secure their processes are. As the evaluation doesn’t require the deployment or configuration of any software, it has no impact on either party.

If the business does decide to go ahead and engage with a supplier, the same technologies can be used to monitor any changes to the risk profile. This will look for changes such as chatter about the vendor, for instance, on the deep or dark web, in addition to the areas outlined above. This effectively allows the external monitoring inventory to be updated on a daily basis to give a continuous risk score so that, in the event of a breach, the business can quickly determine if any liability lies with the supplier.

The external risk score can be supplemented with an assessment of the supplier’s internal security through the usual method of a questionnaire submitted to the supplier. But the real risk will always tend to be external, because, like most organisations, suppliers have focused security resources on securing their internal networks and perimeter.

Going forward, there’s little doubt that organisations are going to need to become more proactive over how they risk assessing suppliers. The current economic climate is seeing more and more organisations outsource, with 71% saying their third party network now contains more suppliers than it did three years ago, according to Gartner.

But, relying on suppliers will always result in delays and missed information. By taking the matter into their own hands, organisations can gain better visibility and control over the risks posed and their third party management. 

Abdullah Mirza is Director at CTM360                                 Image: Cybrain

You Might Also Read: 

A 'Golden Pipeline' To Secure The Supply Chain:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« LinkedIn Accounts Hacked & Ransomed
Enrolment In Computing Degree Courses In Britain Increases »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Blue Frost Security

Blue Frost Security

Blue Frost Security provides high-level IT security consulting, penetration testing services, ISO 27001 Solutions, PCI compliance solutions and training.

Cloud Security Alliance (CSA)

Cloud Security Alliance (CSA)

The CSA is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing

Freshfields Bruckhaus Deringer

Freshfields Bruckhaus Deringer

Freshfields Bruckhaus Deringer is a global law firm with a track record of successfully supporting the world's leading corporations, financial institutions and governments.

Guardtime

Guardtime

Guardtime's Black Lantern platform provides real-time cybersecurity and data-centric asset protection.

ContentKeeper

ContentKeeper

ContentKeeper provides Web Threat Protection solutions to secure today’s Web 2.0 and mobile centric business environments.

Prim'X Technologies

Prim'X Technologies

Prim'X Technologies provides information protection solutions to prevent unauthorised access to sensitive data.

Soracom

Soracom

Soracom offers secure, scalable, cloud-native connectivity developed specifically for the Internet of Things.

Radically Open Security

Radically Open Security

Radically Open Security is the world's first not-for-profit computer security consultancy company.

Highland Capital Partners

Highland Capital Partners

Highland Capital Partners is an early stage venture capital firm focused on category-defining businesses in consumer and enterprise technology, including cybersecurity.

Fortress Information Security

Fortress Information Security

Fortress Information Security is one of the largest cyber security providers of supply chain risk management and vulnerability risk management in the US.

Phoenix Cybersecurity

Phoenix Cybersecurity

Phoenix Cybersecurity Services and Managed Security Services help clients just like you take full advantage of leading cybersecurity technologies and industry best practices.

Exterro

Exterro

Exterro is a leading provider of e-discovery and information governance software specifically designed for in-house legal, privacy and IT teams at Global 2000 and Am Law 200 organizations.

Core Sentinel

Core Sentinel

Australia's #1 Penetration Testing Service. Make Your Systems Fully Compliant With Our OSCE CREST/CISA Certified Penetration Testing.

StealthMole

StealthMole

StealthMole is a deep and dark web threat intelligence company that delivers a cloud-based, unified platform for digital investigation, risk assessment, and threat monitoring.

StepSecurity

StepSecurity

StepSecurity provides a comprehensive security platform for GitHub Actions.

BeamSec

BeamSec

BeamSec is a cybersecurity solutions provider committed to addressing the human element of risk against the evolving landscape of email-based cyber threats.