Managing Third-Party Cybersecurity Risk: Common Threats and How to Respond

Common Threats That Can Impact Cybersecurity Risk

When individuals are given more access privileges than what is needed for their job description (either intentionally or unintentionally), there’s a risk of privilege abuse. A user with too much access could potentially mishandle a sensitive document, further sharing it with other individuals outside of the organization.

How to manage: Make sure that your third-party vendor understands and implements the concept of least privilege. This idea means that a user should only have access when needed for the job task and removing the access once complete. Separating duties for sensitive tasks and requiring access requests and multi-level approvals are also best practices in the concept of least privilege.

Sensitive information that isn’t properly secured and protected can be at risk for intentional or unintentional data breaches. When data is intentionally sought out by hackers to be stolen, it can often be resold on the dark web, modified, destroyed, used for fraud and identity theft or held for ransom.

How to manage: Protecting sensitive data is a key principle in cybersecurity and can be accomplished through several different practices such as regular patching and penetration testing, ongoing monitoring, using anti-malware software and encrypting data at rest and in transit. All these practices should be outlined in your vendor’s documented policies to ensure they’re taking the appropriate steps to protect your sensitive data. Your third-party vendor should understand where they have vulnerabilities that may be exploited so they can be proactive in repairing them.

Various studies have shown that human error accounts for most data breaches. Mistakes can arise from either lack of skills or poor decision making and it’s important to note that your vendors may even put your organization at more risk if they aren’t held to the same standards as your employees regarding areas like logical access management. Accidentally downloading malware through phishing scams or using weak passwords for remote access are just some of the ways in which your third-party’s employees can put your organization at risk.

How to manage: Of course, it isn’t possible to eliminate all human error, but there are practical steps to take to ensure that mistakes are greatly reduced. To reduce the risk of weak passwords for remote access, you could require the implementation of multi-factor authentication. Specific employee awareness training, like phishing exercises, can also be required of your vendors to address this area of third-party cybersecurity risk.