Share these talks and lectures with your colleaguesInvite colleagues
The three Ps of third-party risk
As trusted partners, third-party vendors often become the overlooked or unwitting accomplice in criminal activities. As privacy laws and cyber security regulations continue to increase accountability around data confidentiality and protection, firms are struggling to shift from an in-house security paradigm to gain line of sight that extends to cover their vendors and the entire supply chain. Beyond the umbrella frameworks of NIST,1 ISO 27001 information and security management2 and ISO 27032 guidelines for cyber security,3 two smaller and —perhaps more palatable — guidelines offer simplified elements to frame supply chain risk management. The first, from the New York Department of Finance Cyber Rules NYCRR 500, section 11, provides actionable steps to access and mitigate vendor risk. The second resource comes from the National Cyber Security Centre in the UK, organised as 12 principles to grapple with supply chain risk, including defining risk, establishing mitigation controls, validating assurances and building in continuous improvement. This paper will explore the risks associated with third-party vendors, and how adversaries are leveraging supply chain vulnerabilities. It will also examine research that supports a three-step programme comprising policies (controls, due diligence tools and validation mechanisms), prevention (establishing risks and defining defensive requirements) and promises (contractual obligations, demarcated responsibilities, defined standards and warranties).
The full article is available to subscribers to the journal.
Mark Sangster , vice president and industry security strategist at eSentire, is a cyber security evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that organisations integrate cyber security into their day-to-day operations. In addition to his passion for cyber security, Mark’s 20-year sales and marketing career was established with industry giants such as Intel Corporation, BlackBerry and Cisco Systems. Mark’s experience unites a strong technical aptitude and an intuitive understanding of regulatory agencies. Mark holds a bachelor’s degree in psychology from the University of Western Ontario and a business diploma from Humber College.