Third Party Risk 29 Mar 2019

How Missing Continuous Monitoring Makes Third-Party Risk Management Programs Ineffective

Priyanka Aash Co-Founder | FireCompass

Many organizations have hundreds of vendors and the Third-Party risk exposure is one of the biggest threats. Most of the organizations depend upon partners, vendors, suppliers, contractors and other third-parties for day-to-day operations. Each of them presents some potential risk to the organization.

Third-Party Risk Management programs helps in assessing the cybersecurity of vendors/3^rd parties that handle an organization’s sensitive data or have access to internal IT systems. Main tools used for Third-Party/Vendor Risk Management are

Questionnaires method
Vulnerability Assessments

But these programs miss the key component of effective Third-Party risk management, which is continuous monitoring. With out continuous monitoring, organization’s sensitive data is still at risk and the internal IT systems might be more at risk which you may not realize.

Here are the reasons why you should consider continuous monitoring for Third-Party risk management:

1. Why Continuous Monitoring is required?

Cyber attacks through third-parties have become more common, IT teams started concentrated on cyber security of their vendors. Continuous third-party monitoring helps in the improvement of event identification time, event remediation time, response time to events, in comparing security postures among vendors/3^rd parties, industry specific technology trends.

2. Questionnaire Methods/ Point-In-Time Assessments Are Ineffective:

There are many third-Party risk management tools like questionnaire methods, Vulnerability assessments, penetration tests. But these assessments are done at single point of time and reflects the cyber security posture at that time. Cyber attacks can happen any day and without continuous monitoring, threats and vulnerabilities could not be found out immediately. Continuous monitoring will help the organizations to identify the possible threats and recover based on the technologies implemented. Questionnaire driven approach is flawed since vendors’ answers may not represent the reality and conducting a comprehensive audit is time intensive and costly and is infeasible to conduct regularly.

FireShadows continuously monitors, analyses and provides alerts on any changes or risks associated. Also, its dashboard gives the opportunity to organization to choose their best vendors based on security score to continue their partnership.

3. Continuous Monitoring Is Necessary:

Continuous Monitoring of vendor risk is necessary for competitive organizations as Data Breaches are becoming common and all it takes is one weakness (risk) from vendor that would give away sensitive information/data. Public and consumers expect that the organizations will make efforts to protect the data. If your organization experienced a breach caused by a third party then the fact is that consumers probably were not caring whether their information was accessed via your systems or some vendors.