Human Error + Third-Party Vendors = Trouble

Third-party vendors (like supply chain partners) significantly increase your threat profile. 

When it comes to cybersecurity, business partners and third-party vendors represent one of the MOST significant risks that organizations face, because many entrust third parties with access to their most sensitive data and systems. Companies and suppliers in industries like defense, financial services, manufacturing, and healthcare also operate in highly regulated environments. For those organizations, meeting stringent compliance requirements such as HIPAA, SOX, GDPR, Personal Data Protection Bill, etc. are critical to business operations. As a result, failure to implement the right compliance and cybersecurity measures can put these companies at greater risk of serious harm.

How big is the problem?

According to IBM threat intelligence, the average cost of a data breach is $4.45 million, and “Manufacturing is the industry most commonly targeted by cybercriminals.” Unfortunately, the true cost may be even greater because breaches and leaks that result in sensitive data getting compromised can be catastrophic, leading to lost credibility, disrupted supply chains, lost revenue, and even impact national security.

Large companies rarely publish specifics about their supply chains, but a few pioneering brands have outlined the scale of their supply chains. It’s also apparent that in recent years, the number of supply chain partners for most companies has exploded, mostly because of COVID-related supply chain issues:

• Proctor and Gamble has more than 60,000 external business partners (EBPs)
• Walmart over 100,000 suppliers
• TotalEnergies buys from 100,000+ suppliers

Now let’s put that in context for the average large enterprise that we (Seclore) see every day:

• # of Employees: 10,000+
• # of Suppliers/Vendors/External Business Partners: 5,000+
• # of Sensitive emails/Documents shared: 1,200 daily (~300k/year)
• # of mishandled documents: ~25 or 2% daily

Each of these suppliers represent a potential threat vector, exponentially increasing the attack surface of the companies they supply. Add to that the increasing number and sophistication of AI-powered cyberattacks and now we’ve got some idea just how big this problem is.

And it’s not just us talking about this problem:

Our internal findings also align with what’s being reported externally by government agencies and non-governmental organization (NGOs). For example, in 2020, the Royal Canadian Mounted Police (RCMP) reported that 38 agencies’ mishandling of data resulted in more than 5,000 incidents between Jan. 1 and Dec. 10 in which classified, or otherwise protected documents were stored in a manner that did not meet security requirements (or ~20 incidents every day). These numbers look conservative when compared to the numbers reported by the US Federal government. It’s been reported that over the last decade, millions of emails intended for .mil (US military email addresses) were accidentally sent to .ml addresses, the top-level domain (TLD) for the African nation of Mali. As a result of this one-character typo, and sheer volume of emails sent… including medical data, identification documents, maps of military installations, travel itineraries, bookings for high-ranking military leaders, and more reached .ml addresses rather than their intended .mil ones. While shocking, this all represents how hard it is for organizations to anticipate every eventuality when it comes to protecting their most sensitive data.

Given all this, it’s easy to see how your organization can quickly get out of compliance, or worse, discover an active breach because sensitive data was mishandled. Layer hacking, social engineering, and malware into the equation, and it’s obvious that this is a real “Houston we have a problem” moment. Even supply chains for single product lines can be complex. Seclore regularly sees manufacturers expose sensitive data (intellectual property, strategies, pricing, release plans, etc.) to thousands of ‘potential’ vendors as part of their request for proposal (RFP) process, relying solely on Non-Disclosure Agreements (NDAs) to keep this data safe.

Sadly, this complexity often hides the scale of the problem, which only comes to light in times of crisis (data breach, pandemic, etc). So it’s no wonder that we regularly see organizations in the news for getting hacked — despite their 3^rd party suppliers being the source of the data breach.

“Their” weakest link = “Your” weakest link.

Most security researchers acknowledge that humans are the weakest and most easily exploited link in an organization’s cybersecurity chain, and studies confirm this, highlighting the fact that nine out of 10 (88%) of data breaches are caused by employee mistakes. Worse, employees may be unwilling to admit these mistakes if, for example, organizations penalize those mistakes too severely.

But let’s put that aside for now, and assume that your internal cybersecurity culture, training, and awareness is outstanding… how about your suppliers and 3^rd party vendors? Now we’re getting to the heart of the problem. Even if you do most (or all) the right things, your sensitive data is still at the mercy of organizations that aren’t under your control, and whatever their cybersecurity cultures are – unless you embrace a “data-centric” security approach.

Best practices for protecting sensitive data shared with third parties:

I think we’ve clearly outlined the problem that organizations face to remain competitive in the digital era. The question is, what can they do to improve their security posture, particularly when data intentionally (or unintentionally) leaves their controlled perimeter?  The following principles are all inherent to “data-centric” security, and all of them are prerequisites for achieving zero trust.

• Assume that third-party networks are hostile: In the distant past, users could be relatively certain that known networks were secure, whereas zero trust assumes that any given network is insecure. Whether a network is secure or insecure, Seclore dynamically protects sensitive data at all times – at rest and in transit.
• Acknowledge that internal and external threats are endemic: Traditional security methods assume networks are secure until a threat is detected. Data-centric security turns this model on its head. The goal is to flip the risk-reward ratio in favor of data owners. This means that control no longer equals access, and data-centric security measures like file-level encryption and access control place a tremendous burden on adversaries no matter how they acquire protected digital assets.
• Authenticate and authorize every user and data flow: Data-centric security dynamically authorizes and authenticates users on a per-session and per-user basis, which makes it easier to enforce least-privileged access.
• Dynamic Watermarking: Unlike static watermarks, a dynamic watermark is context-specific and can change after a publisher first applies it. Context can include anything from changes to the document or a user viewing it, to the date and time someone opens a file or email.
• Continuously Assess Risk: Seclore helps organizations continuously assess the risks associated with business partners. While organizations should consider factors such as security, compliance and data handling practices when selecting partners, continuous monitoring means that organizations can promptly detect suspicious or unusual activity and potential security breaches.
• Dynamic Access Control: Seclore lets you control who has access to your data, what they can do with it, and revoke that access at any time.
  • Dynamically adjust usage-controls like the ability to print, download, or copy data
  • Grant access to third parties for a limited period of time, and revoke access when a project is finished, an employee is off-boarded, or sensitive data is accidentally shared with an unintended recipient.
  • As a last resort, revoke access to all emails/documents if a breach includes compromised identities, to limit the harm of that breach.
• Dynamic Policy Adoption: Extend the value of your DLP/CASB solutions by leveraging existing classification policies to apply protection, rights management, and information/insights from Seclore. This full circle approach brings continuous improvement (CI) to your security posture so you can answer questions like:
  • How long should saving data/files be available?
  • Should documents be editable or forwardable to additional recipients?
  • Should classified documents and emails be printable?
  • Should my company allow documents to be opened in any country?

Remember, while business partners can enhance your capabilities, they also introduce risk. By following these best practices, you can minimize vulnerabilities and build a more secure network of trust with your partners. With an advanced solution like Seclore, your organization can reap the benefits of data-centric security & compliance. By putting data first in your security architecture, you can clearly understand what digital assets need to be protected, where they reside, how sensitive they are, and effectively control access to them.

Many organizations assume that ‘trusting’ their partners/suppliers is the only path forward; however, this is a false choice. Seclore’s Data-Centric Security platform eliminates over reliance on third-party vendors who might have a radically different security posture than you do. By safeguarding the data itself, rather than focusing primarily on securing networks or devices, Seclore ensures that your most valuable digital assets remain secure regardless of where they end up and how they got there. With Seclore, you get better knowledge, control, and security for your sensitive data, ensuring that third-party vendors don’t mishandle that data and make your company headline news.