News
NIST releases updated supply chain guidance - Expert Comment
May 2022 by Saket Modi, CEO and Co-founder of Safe Security
Following the news that the NIST (National Institute of Standards and Technology) has released updated guidance on securing the supply chain against cyberattacks, the comment from Saket Modi at Safe Security, who highlights the importance of understanding the level of access vendors have to your information, and how/why this might affect the Supply chain…
“Enterprise cyber risk management is growing in complexity, and some of the most critical and damaging risks are born not within an organisation but in its third, fourth, or ‘nth-party’ supply chain. Most questionnaire-based surveys, SRS services, and the subsequent security rating scores do not reflect the volume or impact of this critical risk – providing you with an incomplete, inaccurate representation of your third-party cybersecurity risk. Moreover, these services offer limited capabilities to contextualise the risk - leaving your ratings mostly unactionable.
Unless you understand the level of access vendors have, why they have it, who uses it, and how they have it, you will not have complete visibility of the risk you’re exposed to.
The extent of your exposure might surprise you. Consider the following:
Are you sharing your data? Do you know exactly what or how much?
Are you sharing your code or IP with a co-development partner?
Are you sharing data with your agencies?
Does your marketing agency hold customer data or Personally Identifiable Information?
Do your vendors have access to your Intellectual Property?
Does your company insurance provider store your employee’s Personal Health Information?
In turn, this increases the risk of a multitude of attacks:
A vendor might accidentally share sensitive data
A malicious employee within your supply chain could misuse proprietary information
To manage today’s modern-day third-party and supply chain risk, businesses need to have a quantified, inside-out view of risks arising from third parties in real-time - third party risk management 2.0. By embracing the combination of inside-out and outside-in assessments using Cyber Risk Quantification, you will gain more accurate and real-time visibility of the risk you’ve inherited across your vendors’ people, processes, technologies, and third-party ecosystems.”
