{"id":5976,"date":"2024-04-18T14:58:56","date_gmt":"2024-04-18T18:58:56","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=5976"},"modified":"2024-04-18T15:00:24","modified_gmt":"2024-04-18T19:00:24","slug":"mitigate-zero-day-threats-with-modern-third-party-incident-response","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/","title":{"rendered":"Mitigate Zero-Day Threats with Modern Third-Party Incident Response"},"content":{"rendered":"

\"Third-Party<\/p>\n

Solutions Review\u2019s\u00a0Contributed Content Series<\/u><\/a> is a collection of contributed articles written by thought leaders in enterprise software categories. Bob Maley of Black Kite<\/a> walks us through what it takes to mitigate threats with third-party incident response.<\/em><\/strong><\/p>\n

There was a time when phishing and business email compromise dominated headlines, but today there is a much more significant threat to companies: zero-day vulnerabilities. Because supply chains have become inextricably linked through software, a single vendor being compromised can have a ripple effect impacting hundreds of companies throughout the supply chain. Similarly, companies cannot only concern themselves with the security of their systems alone. They must monitor and mitigate vendor risk from hundreds \u2014 even thousands \u2014 third, fourth, and Nth parties.<\/p>\n

We don\u2019t have to look far to understand how third-party breaches have catastrophic impacts. The industry is still grappling with the fallout from the Change Healthcare incident. Just recently, American Express notified customers after a third-party merchant processor allowed unauthorized access to AMEX systems, resulting in the compromise of customer data. In early December, two zero-day vulnerabilities in Qlik Sense were discovered and notably exploited in a ransomware campaign by the Cactus Group. The incident impacted 65 companies across the U.S. and Europe, with a significant focus on manufacturing and professional services. Also, Microsoft, which is still reeling from a 2023 attack that leaked source code, just disclosed 60 unique CVEs in its March 2024 update.<\/p>\n

According to the Identity Theft Resource Center, zero-day attacks jumped significantly in 2023, fueling a 78 percent year-over-year increase in data compromises. The impact to the supply chain was staggering, with the number of organizations impacted soaring more than 2,600 since 2018. Meanwhile, phishing-related attacks were down slightly. Why? The answer is likely ROI. Phishing can be resource-intensive to eventually compromise a single company, especially when organizations have invested so heavily in training their employees to be cyber-aware. But a single zero-day can compromise tens, hundreds, or even thousands of victims. To put it simply: In the business of cyber exploits, there is more to gain.<\/p>\n

Mitigate Zero-Day Threats with Modern Third-Party Incident Response<\/strong><\/h2>\n
\n

Third-party Incident Response Challenges<\/strong><\/h3>\n

When a new CVE is announced, there is a clear general incident response playbook: Determine severity and prioritize the vulnerability, identify and patch any instances of the software in use, and monitor for indicators of compromise. However, when it comes to determining the impact of these vulnerabilities within vendor organizations, the process is less concrete.<\/p>\n

Historically, organizations do not have visibility into vendor systems, so the only way to determine if they have been impacted by a vulnerability is by asking via manual outreach. And in today\u2019s digitally connected cyber ecosystem, we\u2019ve learned that response doesn\u2019t stop there. A comprehensive approach must extend beyond direct vendors to include their sub-vendors and partners. It\u2019s a slow process that absolutely cannot scale for large enterprises, which often have hundreds, if not thousands, of third- and fourth-party service providers to consider. This is a massive problem because the speed at which companies can identify vendors impacted by high-profile security events and then implement their response plan often determines the level of damage \u2014 financial, technical, reputation, etc. \u2014 incurred.<\/p>\n

Another problem with traditional incident response strategies is that they rely on assessments and questionnaires to determine whether or not a serious security incident has impacted a vendor. Analyzing these responses can take weeks and by that point, the information may be outdated, causing organizations to respond late or not in time to mitigate threats in their vendor ecosystem. As an alternative, companies may enact a blanket response for all of their vendors, which can cause unnecessary business disruption or fail to properly contain or remove the threat.<\/p>\n

Tips to Modernize and Streamline Third-Party Incident Response<\/strong><\/h3>\n

Companies must modernize and streamline their security strategies to combat zero-day threats in their supply chains. There are several approaches companies can implement to improve third-party incident response.<\/p>\n

    \n
  • Adopt vendor risk intelligence. <\/em><\/strong>Implementing vendor risk intelligence is the most effective addition companies can make to bolster third-party incident response efforts. This involves gathering information on threats and threat actors from open-source intelligence (OSINT) and other data sources and combining it with contextual information and data \u2014 location, industry, data it accesses, etc. \u2014 to measure the potential impact a zero-day may have on an organization through its vendor network.\u00a0 When applying vendor risk intelligence, organizations can dramatically reduce the amount of manual effort associated with third-party incident response. This insight will quickly determine the vendors likely to be impacted by an incident, informing a company\u2019s response. For example, an organization with 500 vendors may require weeks, or even months, to collect and analyze responses from their vendors. However, vendor risk intelligence may show that only 15 vendors are likely to be impacted, so the primary organization can dramatically reduce its manual effort by only reaching out to those high-risk vendors.<\/li>\n
  • Create a dedicated third-party incident response team. <\/em><\/strong>Having a dedicated third-party incident response team is essential in capitalizing on vendor risk intelligence and responding effectively to supply chain incidents. Companies should identify and assign the roles in the response process, and clearly define the actions this team will take to quickly evaluate a vendor\u2019s security status in the event of an incident and the incident\u2019s level of severity. This team is responsible for collecting and analyzing OSINT data on vendors and the threat landscape. And because time is of the essence, this team should have a system in place that allows them to access this information quickly to determine which vendors may be affected in the event of an incident. This team should also build and execute playbooks on how to best contact vendors to assess the severity of the impact. Incidents may begin as times of crisis, but effective third-party incident response can actually be a significant relationship-building opportunity with vendors if both parties work in tandem to mitigate the issue.<\/li>\n
  • Invest in continuous monitoring and automation. <\/em><\/strong>Traditional approaches rely on point-in-time data to assess a vendor\u2019s security posture. This is problematic because it doesn\u2019t reflect real-time changes to systems and software, and it is notably difficult to gain visibility into vendors’ activities in general. Continuous threat monitoring can ensure companies identify high-profile events quickly. Automation can expedite the collection and analysis of OSINT data, ensuring fast access to vendor risk intelligence third-party incident response teams need most. It can be used to vet vendors based on location or access to sensitive data. This information can be combined with threat monitoring information to provide critical visibility into vendor security postures and real-time information about the impact of a zero-day vulnerability.<\/li>\n
  • Ensure robust vendor evaluations.<\/strong> <\/em>Companies should thoroughly evaluate their vendors for any signs of compromise and ensure that they have implemented robust security measures. It is crucial that analysis encompasses a broad spectrum of risk factors, including ransomware susceptibility, vendor size, industry, and geographical location. This comprehensive approach is essential for mitigating risks and safeguarding against the multifaceted nature of cyber threats in today\u2019s interconnected digital landscape.<\/li>\n<\/ul>\n

    Solving Third-Party Incident Response<\/strong><\/h3>\n

    Zero days are a clear and present danger to the supply chain. Incidents like Qlik Sense, Microsoft and many others underscore the importance of robust third-party risk management strategies in identifying and mitigating cyber threats. As digital ecosystems expand, it is imperative for companies to modernize and streamline their approaches to third-party incident response to eliminate uninformed, manual processes. They need dedicated teams armed with data on vendor risk, a holistic view of the threat landscape, and automation to transform complex cyber threat information into actionable intelligence. These modern strategies will foster stronger vendor relationships, enable faster response, and ensure companies remain secure and protected in the event of high-profile attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Solutions Review\u2019s\u00a0Contributed Content Series is a collection of contributed articles written by thought leaders in enterprise software categories. Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response. There was a time when phishing and business email compromise dominated headlines, but today there is a much more […]<\/p>\n","protected":false},"author":1065,"featured_media":5977,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,21,276],"tags":[],"acf":[],"yoast_head":"\nMitigate Zero-Day Threats with Modern Third-Party Incident Response<\/title>\n<meta name=\"description\" content=\"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Mitigate Zero-Day Threats with Modern Third-Party Incident Response\" \/>\n<meta property=\"og:description\" content=\"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/\" \/>\n<meta property=\"og:site_name\" content=\"Network Monitoring Tools & Performance Software | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-18T18:58:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-18T19:00:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"786\" \/>\n\t<meta property=\"og:image:height\" content=\"393\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Bob Maley\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Bob Maley\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/\",\"name\":\"Mitigate Zero-Day Threats with Modern Third-Party Incident Response\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg\",\"datePublished\":\"2024-04-18T18:58:56+00:00\",\"dateModified\":\"2024-04-18T19:00:24+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/2d14e1247d7df917b9adad0ec7815fa1\"},\"description\":\"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg\",\"width\":786,\"height\":393,\"caption\":\"Third-Party Incident Response\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/network-monitoring\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mitigate Zero-Day Threats with Modern Third-Party Incident Response\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/\",\"name\":\"Network Monitoring Tools & Performance Software | Solutions Review\",\"description\":\"Evaluating Enterprise NPM Software, Network Observability & Packet Analysis Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/2d14e1247d7df917b9adad0ec7815fa1\",\"name\":\"Bob Maley\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Bob-Maley-headshot-scaled.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Bob-Maley-headshot-scaled.jpg\",\"caption\":\"Bob Maley\"},\"description\":\"Bob Maley is the CISO of Black Kite. Bob has been involved in security for most of his career, initially in physical security as a law enforcement officer. In those years, Bob acquired a broad range of expertise and experience in all areas of security, including third-party security, risk assessment, architecture, design, policy development, deployment, incident response and investigation, and enterprise solution deployments in areas including intrusion detection, data protection, compliance, and incident reporting and response. His previous roles include Head of PayPal\u2019s Global Third-Party Security & Inspections team and CISO for the Commonwealth of Pennsylvania. Bob\u2019s certifications include CRISC, CTPRP, and OpenFAIR.\",\"sameAs\":[\"https:\/\/blackkite.com\/\"],\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/author\/bmaley\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Mitigate Zero-Day Threats with Modern Third-Party Incident Response","description":"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/","og_locale":"en_US","og_type":"article","og_title":"Mitigate Zero-Day Threats with Modern Third-Party Incident Response","og_description":"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.","og_url":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/","og_site_name":"Network Monitoring Tools & Performance Software | Solutions Review","article_published_time":"2024-04-18T18:58:56+00:00","article_modified_time":"2024-04-18T19:00:24+00:00","og_image":[{"width":786,"height":393,"url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg","type":"image\/jpeg"}],"author":"Bob Maley","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Bob Maley","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/","name":"Mitigate Zero-Day Threats with Modern Third-Party Incident Response","isPartOf":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg","datePublished":"2024-04-18T18:58:56+00:00","dateModified":"2024-04-18T19:00:24+00:00","author":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/2d14e1247d7df917b9adad0ec7815fa1"},"description":"Bob Maley of Black Kite walks us through what it takes to mitigate threats with third-party incident response.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#primaryimage","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Modern-Third-Party-Response.jpg","width":786,"height":393,"caption":"Third-Party Incident Response"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/network-monitoring\/mitigate-zero-day-threats-with-modern-third-party-incident-response\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/network-monitoring\/"},{"@type":"ListItem","position":2,"name":"Mitigate Zero-Day Threats with Modern Third-Party Incident Response"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website","url":"https:\/\/solutionsreview.com\/network-monitoring\/","name":"Network Monitoring Tools & Performance Software | Solutions Review","description":"Evaluating Enterprise NPM Software, Network Observability & Packet Analysis Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/2d14e1247d7df917b9adad0ec7815fa1","name":"Bob Maley","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Bob-Maley-headshot-scaled.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2024\/04\/Bob-Maley-headshot-scaled.jpg","caption":"Bob Maley"},"description":"Bob Maley is the CISO of Black Kite. Bob has been involved in security for most of his career, initially in physical security as a law enforcement officer. In those years, Bob acquired a broad range of expertise and experience in all areas of security, including third-party security, risk assessment, architecture, design, policy development, deployment, incident response and investigation, and enterprise solution deployments in areas including intrusion detection, data protection, compliance, and incident reporting and response. His previous roles include Head of PayPal\u2019s Global Third-Party Security & Inspections team and CISO for the Commonwealth of Pennsylvania. Bob\u2019s certifications include CRISC, CTPRP, and OpenFAIR.","sameAs":["https:\/\/blackkite.com\/"],"url":"https:\/\/solutionsreview.com\/network-monitoring\/author\/bmaley\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5976"}],"collection":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/users\/1065"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/comments?post=5976"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5976\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media\/5977"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media?parent=5976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/categories?post=5976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/tags?post=5976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}