How Well Do You Know Your Business Partners?

When you hire a new organization for some IT work, do you really know about their vendor security practices? Well, if you are Google, you certainly do. Before anyone can get business from Google, they are asked to fill out an extensive questionnaire detailing their security posture.

While you probably don’t want to create something quite as extensive for your own purposes, the Google Vendor Security Assessment Questionnaire (VSAQ) serves as a solid model if you are looking to contract out IT security work. But there is another reason to look at the VSAQ too: The process of filling out the form and answering these questions can serve as a good security framework for any IT manager to evaluate their own organization’s security weaknesses and gaps.

As posted on the Google blog earlier this year, “Most vendors found the questions intuitive and flexible — and, even better, they’ve been able to use the embedded tips and recommendations to improve their [own] security posture.” Google even posted the code for producing the questionnaire on Github in case organizations want to extend or modify it for their own purposes.

Making Assessments Using the Vendor Security Survey

The VSAQ is divided into four different sections: general security and privacy, Web application security, infrastructure security and physical security. Under general security, you are asked if your company has any external data privacy practices and policy descriptions, how you secure sensitive human resources data and what the consequences are when these policies are violated. There are also questions about how often your employees undergo security training, and if this training extends to temporary staff and interns too.

Under Web application security, you specify whether your Web apps can only be reached via HTTPS protocols, whether users need to authenticate themselves and if you have role-based policies within the app. One section goes into detail about mechanisms for preventing cross-site scripting.

If you select one of the riskier options, such as being able to escape user inputs or user-provided HTML, you are asked for further explanation. You are also asked how you monitor your app after it is online, such as if you have explicit QA teams that monitor crashes and errors.

Under infrastructure security, you state whether you have specific network operational guidelines that are regularly updated, whether you have firewalls and VPNs in place, and whether parts of your network security management are outsourced. There are also questions on the functions of your servers, such as whether they log security events and have regular operating system updates and patches. Of course, expect to provide specifics about how you handle your backups and if you regularly test them.

Finally, there is physical security, which also covers where your data centers are located, whether you make use of any cloud providers, and in which countries you operate.

Anyone who develops Web applications should be able to review these questions and already know the answers for most of them. If not, you should examine your own deficiencies with a new eye toward helping improve your own security posture.

More from Application Security

Critically close to zero(day): Exploiting Microsoft Kernel streaming service

10 min read - Last month Microsoft patched a vulnerability in the Microsoft Kernel Streaming Server, a Windows kernel component used in the virtualization and sharing of camera devices. The vulnerability, CVE-2023-36802, allows a local attacker to escalate privileges to SYSTEM. This blog post details my process of exploring a new attack surface in the Windows kernel, finding a 0-day vulnerability, exploring an interesting bug class, and building a stable exploit. This post doesn’t require any specialized Windows kernel knowledge to follow along, though…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Vulnerability management, its impact and threat modeling methodologies

7 min read - Vulnerability management is a security practice designed to avoid events that could potentially harm an organization. It is a regular ongoing process that identifies, assesses, and manages vulnerabilities across all the components of an IT ecosystem. Cybersecurity is one of the major priorities many organizations struggle to stay on top of. There is a huge increase in the number of cyberattacks carried out by cybercriminals to steal valuable information from businesses. Hence to encounter these attacks, organizations are now focusing…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today