Risky business: it’s time to talk about third party data breaches
The number of security breaches attributed to third parties continues to rise – Audi and Volkswagen Group of America, Inc. had a vendor leave unsecured data for almost three years, from 2019 to 2021, that was accessed by an unauthorized party. Even organizations that serve the public good are at risk — in 2021, a third-party provider used by Cancer Centers of Southwest Oklahoma suffered a data breach that exposed over 8,000 patients. One study found that 31% of third-party vendors could cause “significant damage” if breached.
Third parties increase vulnerability
But third-party relationships are a part of doing business in today’s globalized world. Even the smallest business can have many diverse global business relationships that help the company to grow. However, in working with third parties, your exposure to risk multiplies; IT security risks, regulatory compliance risks (those fines and potential prison sentences are only getting steeper), anti-corruption risks, operational risks, health and safety risks, environmental risks, quality risks and reputational risks. Not to mention additional consequences like increased vulnerability to litigation and depressed market value and share price.
A virtual minefield
Of course not every third party you work with is going to be corrupt or hiding bribe-swallowing hackers. Some of these trusted third party relationships span decades, but it’s important to know that when talking about third party risk management, you’re talking about a constantly evolving environment. According to a Booz Allen Hamilton report, most third party incidents occur in an existing relationship.
Mistakes happen and consequences are very costly. It’s your company at stake and your CEO’s head on the line, no matter whose fault it is. Organizations today are being held responsible not only for their own activities but also for the actions of customers, suppliers, vendors and partners. To make matters more challenging, regulators are cracking down even harder on potential third-party risks. With the complexity of supply chains and external partnerships often spanning countries with different laws, regulations and governance, businesses need to start protecting themselves and fast.
Some of these risks might have to be assessed during the on-boarding process but after that it’s often out of sight, out of mind. Out-dated contracts might not reflect developments and trends that have appeared since first being written. Third-party risks that aren’t identified and mitigated can very easily snowball into big issues that damage your reputation and your bottom line.
How to effectively manage and monitor third party relationships still seems to confound many companies, whose approach is usually ad hoc and fragmented. It’s a tough problem– businesses want to grow and stay competitive and this involves, to some extent, expanding their third-party network.
On the other hand, doing business with a high-risk or non-compliant third party can land you in extremely hot water. Six-figure fines aside, many companies find out the hard way that customers tend to bolt when something goes wrong. Your customers assume you have the risks under control when they enter into a relationship with you, so it’s about keeping brand promises and living up to their expectations.
Without effective Privileged Access Management (PAM), it’s impossible to monitor third party activity or be able to proactively unearth potential security breaches, regulatory violations, theft, bribery, etc. and those blind spots lead to disaster. These third parties become an extension of your company, so even if you’ve been working together for twenty years, you need to be managing and monitoring them effectively.
Many companies are still grappling with increased complexity of third party networks, regulatory compliance pressures, and increased volumes of data, etc, and it’s easy to let things slide. However, with a cyber environment increasingly resembling the Wild West, it’s vital to remember that what was safe a few years ago isn’t safe any longer.
Businesses need to change the way they view security – it should be bespoke, for your environment and systems. A recent WALLIX poll revealed that 70% of businesses thought Privileged Access Management to be very important but only 10% seem aware that a big reason for that is reducing third party risk. By providing full control and visibility of the sensitive, daily tasks of personnel (including third party personnel), an effective PAM solution can greatly reduce the risk of attack and also ensure compliance with industry regulations. Not being able to manage third parties like your own in-house teams was always never ideal, but with PAM, you can.
For more information about how PAM can help you mitigate the risks of third party data breaches, check out WALLIX Bastion.