Risky business

Source: Venminder

There’s a good chance that most organisations have an account that no one remembers creating. It may have belonged to a supplier, and someone signed it off, but the project was wrapped up years ago. What never ended, however, is the access itself. “A vendor fills in a questionnaire, it gets filed and everyone treats the risk as managed,” says Christo Coetzer, managing director of BlueVision. “The reality is that the risk lives in the live connection, in the access, the data flow, the integration, not in the paperwork.” What that form captures is a description of a supplier on a single day. The access it granted carries on working indefinitely. “You can outsource the function, but you can never outsource the accountability,” he adds. “When your supplier is breached, it’s still your customers, your data and your board answering for it.”

What makes third-party access a bigger security issue today is how much of a business now runs on infrastructure it doesn’t own. There’s a mesh of SaaS platforms, cloud services, APIs and managed providers, which pushes the perimeter out through dozens of companies the security team doesn’t have sight of. With third-party risk, Coetzer says the economics now favour the attacker, because compromising one supplier with access to a thousand downstream victims is far more efficient than attacking a thousand targets individually.