Selecting a Vendor

Third-party/vendor vulnerabilities significantly increase your attack surface. Choosing a competent third-party vendor is critical to the safety of your organization’s cyber ecosystem.

Third-party attacks occur when an outside partner or service provider breaches your systems and infrastructure to gain access to your data. Unfortunately, this type of exploitation is a common problem that can be catastrophic for many organizations. In recent years, as many as 45% of organizations have reported at least one third-party software attack. Given the prevalence of the problem, it makes sense to protect yourself by investing in third-party risk management.

Trust But Verify

While you may not have any reason to distrust your third-party partners, keep in mind that they’re always a potential entry point for cyber attacks against your organization. Therefore, it’s crucial to conduct due diligence in the form of a security assessment before bringing on a new vendor or third party. Significant changes to the third party’s environment or infrastructure after onboarding should be reported and analyzed annually. This satisfies the ever-changing security needs of both parties. Since cyberthreats and their countermeasures are certain to evolve over time, it’s essential that your company do regular assessments to stay safe.

Third-Party Risk Management

Third-party assessments are crucial for managing risks associated with data sharing between organizations. Downstream assessments focus on vendors and suppliers, ensuring they meet security standards to protect your organization. Key elements include vendor risk assessments, legal reviews, and ongoing monitoring. Upstream assessments examine your organization’s security posture to meet partners’ requirements. This involves customer due diligence and contract reviews. Both processes aim to identify vulnerabilities, ensure compliance, and protect data. For organizations, partnering with a company like Latitude can simplify these challenging tasks, making them more manageable and effective.

Recent Breaches

Numerous recent data breaches and cyber incidents highlight the increasing role of third-party vulnerabilities in cybersecurity threats. According to the 2024 Verizon Data Breach Investigations Report (DBIR), 15% of all data breaches involved third parties, a 68% increase from 2022.

Some significant recent third-party breaches include:

• Change Healthcare (February 2024). This third-party payment provider fell victim to a ransomware attack and 4TB of data was allegedly stolen.
• MOVEit (June 2023). The breach of this file transfer software affected numerous third-party vendors, potentially affecting millions of consumers.
• Okta (October 2023). Hackers stole information on every customer in the company’s support system in this network breach.
• AT&T (March 2023). Customer information was accessed through a breached third-party system, affecting nine million wireless accounts.
• Dollar Tree (November 2023). A third-party software provider breach affected two million people, including employees and customers.
• 23andMe (October 2023). Hackers used credentials obtained from a third-party source to gain access to user accounts.