By Ryan Francis
June 9, 2017
Most businesses hire third-party providers to fill in when they lack in-house resources. It is often necessary to allow third-party vendors access to their network. But after Target's network was breached a few years ago because of an HVAC vendor's lack of security, the focus continues to be on how to allow third parties access to the network without creating a security hole.
The use of third-party providers is widespread, as are breaches associated with them. Identity risk and lifestyle solution provider SecZetta claims that on average, 40 percent of the workforce make up third parties. A recent survey done by Soha Systems notes that 63 percent of all data breaches can be attributed to a third party. "The increased reliance on third-party employees, coupled with the growing sophistication of hackers, has led to the current identity and access management crisis that most businesses are faced with today - whether they realize it or not," a SecZetta blog post stated.
Rick Caccia, CMO at Exabeam, explained that the Target breach shined a light on the risks that come with trusted partners. On one hand, they often have access to the most sensitive data and systems within a firm's environment. On the other, the firm has little insight into the partner's own security processes and doesn't really know the partner's employees or their routines.
David Baker, vice president of operations at Bugcrowd, said "The rule of thumb most CSOs live by is that you only use a third party if they do something better than you. So whether that's delivering a package or managing your data center, if an outsourced third party does it better, it makes sense to use them. This extends to security."
For example, a large number of organizations have outsourced their data centers to Amazon Web Services (AWS) not only because the functionality of building the technology on AWS is better than what organizations can achieve on their own, but also because the security offered is better than what companies can build themselves, he said.
"If you use a third party and want to avoid something like what happened with Target, you need to have a process by which you select those third parties, and a big part of that criteria should be security. Security has to be something you can measure that they do better than you," Baker said.
Markus Jakobsson, chief scientist at Agari, said the one big disadvantage to working with third-party vendors is the loss of control over security. "Not only does each vendor create a new entry point into an organization's network for cyber criminals to exploit, but it also means every employee for that vendor is now a potential target to breach your brand. Unfortunately, the only way to ensure your company is not exposed to greater risks is by keeping everything in-house. But in today's digital world, this isn't a reality."