IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Businesses must pay greater attention to third-party risk

Roles and responsibilities must be agreed on now to avoid blindspots and recriminations

Series of locks on binary code with one unlocked

Third-party relationships can pose a significant security challenge for businesses, with a clear delineation of responsibility needed to help avoid pitfalls, IT Pro has been told.

Speaking at EMC World 2016, Rob Sadowski, director of market insight at RSA, told IT Pro that while the supply chain has always been a potential vector of attack for businesses, the number of connected devices in use in any organisation is making it more complex to deal with.

"I think that fortunately this is an area where people are starting to at least recognise that this is a challenge, so it's not that they are completely blind to this idea. But, how do they really wrap their heads around it?" said Sadowski. "What third party relationships do they have? Just cataloguing that is a tremendous challenge."

Even once the number and nature of each third party relationship is established, however, there can still be confusion over who is responsible for certain areas. Indeed, this is something that could go unnoticed for years until one party suffers a breach and each believes it was the other's responsibility to ensure it didn't happen.

"I think that's often the most challenging part - who are the third parties I work with, what are they supposed to be doing, and are they actually doing it?" said Sadowski.

"It becomes a very difficult task and one that, especially as things get more reliant on service providers, really requires a bit of automation and a good process, because third-party risk is really growing significantly as part of the organisation's overall risk profile," he said.

Help is at hand, however, and this issue is being increasingly recognised by standards bodies, which are beginning to incorporate it into their guidelines.

"I think you see in some of the more progressive standards that are out there," said Sadowski. "Take, for example, the PCI Data Security Standard -- in the most recent revisions of the standard, there haven't been a lot of changes to core control objectives and things like that.

"Where some of the evolution has been is in how covered organisations deal with third parties [such as] clearly asking them ... [to] define who is responsible for what requirement and get acknowledgement from them that they are responsible."

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022