October 31, 2022 By Kawther Haciane 3 min read

Third-party risks are widespread in the supply chain and can cause substantial damage. Loss of revenue and sensitive information, operational downtime, legal complications, compliance issues and damaged reputations can all arise from a single breach.

If your company lacks a reliable third-party risk management plan, it’s almost impossible to bring in vendors without exposure to risks from cyber threats. This article will explore ways to effectively manage third-party risks so you can confidently bring vendors on board.

First, let’s look at the case of a significant supply chain attack.

Data exposure and vendor risks: A cautionary tale

A perfect example of a significant supply chain attack is the recent Okta breach.

In this case, a hacking group known as Lapsus$ carried out a supply chain attack that targeted Okta’s customers instead of Okta itself. The threat actors had access to a Sitel support engineer with entry into Okta’s resources and actively used that to control a single workstation.

The Okta breach exposed several financial institutions to attacks, including Western Union, Ally and Amalgamated Bank. The breach demonstrates what happens when organizations depend on third-party solution providers without a proper third-party risk management program.

Unfortunately, third-party service providers may be lax in implementing robust cybersecurity frameworks, controls and strategies. Therefore, organizations should explore a third-party risk management program that can assess vendors in the supply chain, communicate about threats and respond quickly to security incidents to minimize supply chain risks.

Why is third-party risk management important?

Now that you’ve seen how much third-party risks can affect your business, let’s explore why managing them is essential.

First, third-party risk management is key to a company’s security. It protects the company from the risks of working with third-party vendors. Failure to assess your business’s supply chain exposes your organization to potential data breaches and supply chain attacks.

Unfortunately, supply chain attacks can financially devastate your business. In fact, according to the 2022 Cost of a Data Breach report by IBM, the average cost of a data breach was $4.35 million globally. But with finely tuned remedies for supply chain attacks, you can drive down these costs while keeping your organization protected.

How do you manage third-party risks in the supply chain?

Third-party vendors pose significant risks to organizations. But what can be done to minimize that risk? Suppose you want to create an effective strategy for improving supply chain security in your organization. In that case, the best starting point is understanding your company’s relationship with your third-party vendors.

The approach will vary depending on each company’s available resources, but there are a few points you can consider to address supply chain risks. These include:

  • Educating your company’s stakeholders about your supply chain process
  • Ensuring you have a reliable method for handling third-party risks
  • Defining your company’s third-party risk tolerance
  • Creating a system for continually assessing and monitoring third-party risks
  • Closely tracking people who have access to crucial data in your company
  • Understanding the most vital assets in your company and identifying their location
  • Ensuring that vendor contracts include cybersecurity requirements
  • Periodically testing an incident response plan.

In summary

While companies can implement a wide range of strategies to manage third-party risks, there’s no guarantee of safety from breaches. Therefore, it’s important to stay vigilant, as third-party risks are now at the forefront of organizational threats.

In addition, your company can source support from the IBM Security team, which helps firms worldwide assess and analyze risks associated with third-party vendors and partners.

IBM Security’s third-party risk management services bring transparency to third-party security and operational activities, providing a scalable way of managing third-party risk and compliance.

Explore our risk management services or schedule a no-cost workshop today to learn more about third-party risk management for your company.

More from Risk Management

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

The evolution of ransomware: Lessons for the future

5 min read - Ransomware has been part of the cyber crime ecosystem since the late 1980s and remains a major threat in the cyber landscape today. Evolving ransomware attacks are becoming increasingly more sophisticated as threat actors leverage vulnerabilities, social engineering and insider threats. While the future of ransomware is full of unknown threats, we can look to the past and recent trends to predict the future. 2005 to 2020: A rapidly changing landscape While the first ransomware incident was observed in 1989,…

Defense in depth: Layering your security coverage

2 min read - The more valuable a possession, the more steps you take to protect it. A home, for example, is protected by the lock systems on doors and windows, but the valuable or sensitive items that a criminal might steal are stored with even more security — in a locked filing cabinet or a safe. This provides layers of protection for the things you really don’t want a thief to get their hands on. You tailor each item’s protection accordingly, depending on…

The evolution of 20 years of cybersecurity awareness

3 min read - Since 2004, the White House and Congress have designated October National Cybersecurity Awareness Month. This year marks the 20th anniversary of this effort to raise awareness about the importance of cybersecurity and online safety. How have cybersecurity and malware evolved over the last two decades? What types of threat management tools surfaced and when? The Cybersecurity Awareness Month themes over the years give us a clue. 2004 - 2009: Inaugural year and beyond This early period emphasized general cybersecurity hygiene,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today