It's Time to Take Third-Party Risk Seriously

The majority of companies believe their third-party partners have adequate protection and could provide sufficient communication and mitigation measures in the event of a breach. However, though the majority of respondents felt confident in the vendor to keep their data safe, recall that nearly half (44%) of firms had experienced a significant, business-altering data breach caused by a vendor. Exposure at the third-party level can exponentially increase when considering fourth, fifth and sixth parties (or nth parties) with whom vendors (and their vendors) do business.

Enforcing Security Policy

In the study just cited, the majority of companies admitted that though they use a multi-step process to evaluate vendors, security is not always part of the criteria. The best way to protect a company from a detrimental breach is to avoid one in the first place — by doing all of the due diligence needed. Yet only 51% of companies in the evaluation process require a signed contract that obligates the third party to adhere to security and privacy practices. And less than half review the written policies of their third parties.

Clearly, due diligence needs to be enforced by putting company-wide policies in place that specifically take security into consideration when it comes to bringing on third parties.

Policies as Necessities

Monitoring third-party connections at the operational level has become increasingly difficult due to the Web. More importantly, it has become difficult to create policies that effectively minimize the associated risk.

In evaluating third parties, most IT and security teams use a multi-step approach. But the report found that formalized data policies and senior management support for third-party risk are lacking. More than half (60%) of organizations have formalized third-party data risk management policies in place, but completeness and depth varied significantly. Most firms (90%) review their policies at least annually.

Though most respondent companies (81%) think their security policies regarding third parties are effective, this figure conflicts with reported breaches attributed to vendors. While they consider their policies effective, only a quarter of firms completely agree that their company allocates sufficient resources to manage third-party relationships However, most keep an up-to-date inventory of all third parties with whom they share data.

Keeping Your Word

Companies need to follow through with their policies, though the statistics above show that this is often not the case. But business is built on trust. When a customer agrees to do business with you, there is a tacit promise of trust that must be kept. If that trust is broken, so is your business.

Taking action is part of that promise, which must be kept in order to continue as a successful company. Consequences include immediately firing the third party, legal actions including lawsuits, and financial reimbursement to cover breach costs — technical, legal and PR costs — and extra damages. These actions show that your company takes security seriously.

Bring It All Together

It is unlikely that a company could function today without using third parties. So then, the answer to third-party risk cannot be to cut off all outside help. Nor can it be letting third parties slide when they are responsible for a security event. Policies need to be created and upheld. Customers are trusting you to keep their data safe, so you cannot apply assumed trust when it comes to third parties. Use the guidelines above to maintain customer trust, lower risk and improve overall security.

*****

Mark Sangster is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations. In addition to Mark's role as VP and industry security strategist with managed cybersecurity services provider eSentire, he also serves on our Board of Editors and as a member of the LegalSec Council with the International Legal Technology Association (ILTA). He can be reached at [email protected].