When risk walks in through your partner's door
A survey by Kroll, a global risk management consultancy, revealed a figure that deserves the attention of every leadership team: 69% of data breach victims in the period analyzed were hit by an incident that occurred at a third party, according to a report by Infosecurity Magazine. The same study points out that attacks on technology companies that provide services to other organizations were the most common cause of these breaches.
Simply put, companies across every industry had data exposed because of a vendor's security, which shows that protecting your own environment is only one part of the equation. Infosecurity Magazine highlighted the growing weight of the supply chain in companies' cyber risk, a subject that rarely comes up in board meetings and that deserves a permanent spot on the agenda.
So here's an honest question: if the accounting firm, payroll system or billing platform that serves your company suffered an incident, could you say which of your data would be at stake?
What this figure means for your company
For partners and C-level executives, the key point is that they are the ones who sign the contracts and answer for the company's reputation when customer data leaks, even if the failure happened at another company. Data protection regulations such as GDPR and LGPD typically require the organization responsible for the data to also demonstrate due care in selecting and overseeing those who process that information on its behalf.
Controls that protect you regardless of the vendor
The good news is that you can significantly reduce the impact of a third-party incident with controls that are in your hands. The first is to require MFA (Multi-Factor Authentication) for all vendor access, so that a password leaked on the partner's side isn't enough to get into your environment. The second is to apply least privilege, the principle under which each external account receives only the permissions needed for the contracted task, with periodic reviews and deactivation when the contract ends.
The third pillar is resilience, ensured by an isolated, tested backup, along with a disaster recovery plan, so that operations can get back up and running even if a third-party system is compromised. An isolated backup is one kept separate from the main network, out of reach of anyone who might get in through a partner account.
Finally, there is access governance and compliance, which turns good intentions into documented rules. It's worth including some minimum security requirements in your vendor contracts:
- Mandatory use of MFA for any access to your environment.
- A defined deadline for reporting incidents involving your data.
- The right to request evidence of the partner's security practices.
- Clear rules for disposing of data at the end of the business relationship.
Do you know exactly which vendors have access to your company's data?
If answering requires digging through old spreadsheets or checking with several departments, you're in good company, and that's exactly the best place to start. An inventory of vendors with access, classified by the type of data each one touches, lets you prioritize efforts where the risk is greatest. From there, managed IT acts as your team's backstop, combining continuous proactive monitoring, EDR, patch management and periodic reviews of external accounts so that no access is forgotten.
The picture is completed by an isolated, tested backup, which ensures operations can resume, and by training teams to recognize suspicious requests made on behalf of partners, such as changes to banking details or urgent access requests. With these layers, your company gains several lines of defense of its own, on top of the safeguards of each vendor.
The Kroll figure works like a map, because it clearly shows where to focus your energy. Companies that know their partners, control access and test their recovery capabilities turn their supply chain into a network of trust, and that path is entirely within your reach, one step at a time.
References
Frequently asked questions
What is third-party risk in information security?
Third-party risk is the possibility that a company will have data exposed or operations affected because of a security failure at a vendor or partner. It involves any provider with access to the company's systems or information, such as accounting, ERP, payroll and remote support. A survey by Kroll indicated that 69% of breach victims were hit through a third party.
How can you protect your company when a vendor suffers a breach?
Protection comes from controls that don't depend on the vendor's security, such as MFA for all external access, least privilege and periodic reviews of partner accounts. EDR and continuous proactive monitoring help detect abnormal behavior coming from legitimate accounts. An isolated, tested backup, along with a disaster recovery plan, ensures operations can resume.
Which security clauses should be included in vendor contracts?
Vendor contracts should require the use of multi-factor authentication, set a defined deadline for reporting incidents and grant the right to request evidence of security practices. It's also advisable to define rules for disposing of data at the end of the business relationship. These clauses help demonstrate due diligence under data protection regulations such as GDPR and LGPD.
Want to understand how third-party access looks in your environment? Schedule a Strategic IT Assessment, No Strings Attached, with Zamak.