{"id":5430,"date":"2024-08-22T15:47:41","date_gmt":"2024-08-22T19:47:41","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=5430"},"modified":"2024-09-04T15:48:55","modified_gmt":"2024-09-04T19:48:55","slug":"fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/","title":{"rendered":"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk"},"content":{"rendered":"
\n

\"Fortifying<\/p>\n

Kevin Landt, the VP of Product for Cybersecurity at Thrive<\/a>, explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain from potential issues. This article originally appeared in\u00a0Insight Jam<\/a>, an enterprise IT community that enables human conversation on AI.<\/span><\/strong><\/em><\/p>\n

\"\"<\/a>In 2023, the\u00a0Identity Theft Resource Center (ITRC)<\/a> reported 3,205 data breaches, a 78 percent jump compared to the previous year. While organizations are increasingly beefing up their prospects regarding cyber resilience and disaster recovery to avoid such situations, some could be gambling on the risks served by third-party vendors. In fact, the data also shows that 59 percent of enterprise data breaches came from partner companies.<\/p>\n

In our interconnected business world, companies increasingly turn to third-party vendors for different operational needs, whether operational efficiency or service specialization. While these partnerships are advantageous, they also present a crucial cybersecurity problem that is too often swept under the rug: risk exposure from their vendors’ security postures.<\/p>\n

However, by understanding and managing these risks, organizations can strengthen their cybersecurity chain and gain a competitive edge in the market. As cyber threats become more sophisticated and prevalent, organizations must know they are only as strong as their weakest vendor.<\/strong><\/p>\n

Third-Party Vendor Vulnerabilities Lead to Cascade Effect<\/strong><\/h3>\n

Businesses need to work with vendors to carry out operations. From accounting firms to software platforms, third parties are essential in today’s business world, which makes the potential impact of a third-party cyber incident not only a very real possibility but one that will impact an organization’s day-to-day operations.<\/p>\n

Whenever a business works with a third party, a certain amount of data\u2014which can include client or personal information\u2014flows into their systems to achieve the partnership’s goal. For example, an accounting firm can’t do payroll if they can’t access payroll data. However, that means that if that third party falls victim to a data breach or cyber-attack, a business’s data is also exposed and can be used by bad actors. Not only does this mean the reputational damage caused by the cyber-attack impacts the business, but any downtime can result in operational disruptions and ultimately impact the bottom line.<\/p>\n

Organizations thinking about this impact don’t have to look any further than the Change Healthcare attack earlier this year to see how much of a problem a third-party attack can have on a business. Pharmacies couldn’t give patients their medicine, hospitals had to use fax machines to send refills for medicines, and payments couldn’t be processed. The reach of this event is still being felt by healthcare systems today, showing how damaging such an event can be. In this case, patients’ lives could have been on the line if they weren’t able to get their medications.<\/p>\n

Assessing and Managing Third-Party Risks<\/strong><\/h3>\n

A well-thought-out approach to assessing and mitigating third-party vendor risk is necessary to shield your business against these cascading risks. This process should include:<\/p>\n

    \n
  1. Put Your Vendors Under the Microscope:<\/strong>\u00a0Practice due diligence by doing a detailed security assessment of each prospective business partner in advance with industry compliance standards and mitigation response plans.<\/li>\n
  2. Contract Capacity:<\/strong>\u00a0Ensure you specify your security requirements and responsibilities in the contracts with vendors, such as regular security audits, data protection standards<\/a>, and incident notification practices.<\/li>\n
  3. Continuous Monitoring:\u00a0<\/strong>Implement continuous security posture monitoring for your vendors. This includes the types of security assessments, vulnerability scans, and significant incident response capability arrangements they have in place.<\/li>\n
  4. Limited Access and Data Sharing:<\/strong>\u00a0Vendor access should be on a need basis only. Limit access and interconnected data sharing to what is necessary for the vendor to serve its function.<\/li>\n
  5. Encryption<\/strong>\u00a0and Data Security:<\/strong>\u00a0Ensure all data shared with or stored by vendors is appropriately encrypted in transit and non-transit.<\/li>\n<\/ol>\n

    Create Comprehensive Business Continuity Plans<\/strong><\/h3>\n

    Protecting against third-party risk is essential, but organizations should also be prepared for the inevitable situation in which a vendor experiences an attack. Comprehensive business continuity plans allow organizations to continue operations and save data even if a critical vendor goes dark. Some key areas these plans might cover are:<\/p>\n

      \n
    1. Redundancy and Backup Solutions:<\/strong> Implement redundant systems, including regular data backups, to ensure continuity in case one vendor’s services become unavailable. This is especially crucial for telecom solutions, where restoring service quickly, without additional costs or obligations, is essential.<\/li>\n
    2. Alternative Vendor Identification:<\/strong>\u00a0Identify and vet alternative vendors that could rapidly replace the primary vendor in case of an outage or security breach.<\/li>\n
    3. Specific Incident Response Procedures: <\/strong>A plan for a potential vendor risk or incident should be developed and\u00a0regularly tested.<\/li>\n
    4. Reinforce Communication Protocols:<\/strong>\u00a0Develop communication lines and protocols to seamlessly coordinate with discovered vendors in the event of a security incident.<\/li>\n
    5. Periodic Exercises with Updates:\u00a0<\/strong>Perform periodic tabletop exercises and simulations that validate and update business continuity plans based on those lessons learned and new threats.<\/li>\n<\/ol>\n

      In a world of increasing threats, organizations must realize that their security perimeter is no longer just within their networks. Businesses can mitigate third-party risk by following best practices for evaluating vendors, implementing strong security postures, and developing effective business continuity plans that account for as many scenarios as possible. Ultimately, it doesn’t matter how well-defended your organization is when you’re only as strong as the weakest link\u2014and that concentrated vulnerability just might be sitting outside in a vendor environment.<\/p>\n

      \n

      \n<\/div>\n","protected":false},"excerpt":{"rendered":"

      Kevin Landt, the VP of Product for Cybersecurity at Thrive, explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain from potential issues. This article originally appeared in\u00a0Insight Jam, an enterprise IT community that enables human conversation on AI. In 2023, the\u00a0Identity Theft Resource Center (ITRC) reported 3,205 data breaches, a 78 […]<\/p>\n","protected":false},"author":1133,"featured_media":5431,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551],"tags":[2316,322,2312,2314,2313,2315,1503],"acf":[],"yoast_head":"\nFortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk<\/title>\n<meta name=\"description\" content=\"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk\" \/>\n<meta property=\"og:description\" content=\"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2024-08-22T19:47:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-04T19:48:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Kevin Landt\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kevin Landt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/\",\"name\":\"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg\",\"datePublished\":\"2024-08-22T19:47:41+00:00\",\"dateModified\":\"2024-09-04T19:48:55+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60aedc45031ace4a010d226703fd7ad7\"},\"description\":\"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg\",\"width\":800,\"height\":400,\"caption\":\"Fortifying Your Cybersecurity Chain - Understanding Third-Party Vendor Risk\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60aedc45031ace4a010d226703fd7ad7\",\"name\":\"Kevin Landt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Kevin-Landt.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Kevin-Landt.jpg\",\"caption\":\"Kevin Landt\"},\"description\":\"Kevin Landt is VP of Product for Cybersecurity solutions at Thrive, where he brings over 20 years of technology experience to helping mid-size organizations manage their security risk. He was previously VP of Product Management at Cygilant (acquired by SilverSky Security) and held product leadership roles at Opsgenie (now part of Atlassian), Relativity, the market leader in eDiscovery, and Kanguru Solutions, an encryption and mobile device management provider. Kevin has a BS in Computer Systems Engineering from Boston University and earned his MBA at Babson College.\",\"sameAs\":[\"https:\/\/thrivenextgen.com\/\"],\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/klandt\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk","description":"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/","og_locale":"en_US","og_type":"article","og_title":"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk","og_description":"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2024-08-22T19:47:41+00:00","article_modified_time":"2024-09-04T19:48:55+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg","type":"image\/jpeg"}],"author":"Kevin Landt","twitter_misc":{"Written by":"Kevin Landt","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/","name":"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg","datePublished":"2024-08-22T19:47:41+00:00","dateModified":"2024-09-04T19:48:55+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60aedc45031ace4a010d226703fd7ad7"},"description":"Kevin Landt from Thrive explains how understanding third-party vendor risk can help companies fortify their cybersecurity chain.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Fortifying-Your-Cybersecurity-Chain.jpg","width":800,"height":400,"caption":"Fortifying Your Cybersecurity Chain - Understanding Third-Party Vendor Risk"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/fortifying-your-cybersecurity-chain-understanding-third-party-vendor-risk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Fortifying Your Cybersecurity Chain: Understanding Third-Party Vendor Risk"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60aedc45031ace4a010d226703fd7ad7","name":"Kevin Landt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Kevin-Landt.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2024\/09\/Kevin-Landt.jpg","caption":"Kevin Landt"},"description":"Kevin Landt is VP of Product for Cybersecurity solutions at Thrive, where he brings over 20 years of technology experience to helping mid-size organizations manage their security risk. He was previously VP of Product Management at Cygilant (acquired by SilverSky Security) and held product leadership roles at Opsgenie (now part of Atlassian), Relativity, the market leader in eDiscovery, and Kanguru Solutions, an encryption and mobile device management provider. Kevin has a BS in Computer Systems Engineering from Boston University and earned his MBA at Babson College.","sameAs":["https:\/\/thrivenextgen.com\/"],"url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/klandt\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/5430"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/1133"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=5430"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/5430\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/5431"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=5430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=5430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=5430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}