What We Do
How we do it
Resources
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Sep 20, 2022
eSentire Recognized as Top Global MDR Provider by MSSP Alert, CrowdStrike and G2
Waterloo, ON - September 21, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), celebrated multiple industry recognitions as the leading global MDR provider, over the last week: Named #9, and the top pure play MDR provider on MSSP Alert’s Top 250 MSSPs global rankingRecognized as the CrowdStrike 2022 Global MSSP Partner of the Year Earned G2’s industry-renowned status…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — May 02, 2022

Policies, Prevention, and Promises: How to Protect Your Organization from Third-Party and Supply Chain Risks

5 minutes read
Speak With A Security Expert Now

Partnering with external suppliers and vendors is necessary for almost every business and can provide competitive advantages, but third-party and supply chain vendors can also increase your cyber risk. By outsourcing some of your business functions to one or more third-party vendors, your data becomes a part of a web that leaves more entry points and weaknesses for threat actors to exploit. Regardless of how well planned your layered cybersecurity defenses are, it’s important to remember that your vendors may not be as vigilant about their own approach to cybersecurity.

It's no surprise that cyber threat actors are taking advantage of the external vendors’ lack of cybersecurity maturity and targeting their customers. In a 2018 supply chain cyberattack discovered by eSentire against Kaseya, an IT Management Software company, an unknown threat actor tried to leverage a zero-day vulnerability in Kaseya’s Virtual System Administrator (VSA) agent to gain access to our customers’ network. The goal of this was to deploy the Monero cryptocurrency mining malware to multiple eSentire customers.

Kaseya also faced a supply chain cyberattack after it was discovered that their VSA platform was being used by cybercriminals to deliver ransomware through an auto-update. This breach impacted 60 customers and close to 1,500 downstream businesses.

The reality is that third-party vendors with access to your data may not meet the same standards of cybersecurity procedures and policies that your organization has implemented. So, it is up to you to ensure that you are conducting the due diligence needed to protect your company from third-party vendor risk.

The Three Ps of Third-Party and Supply Chain Risk: Policies, Prevention, and Promises

In order to effectively address third- party risk, you need to pinpoint any vulnerabilities and weaknesses present in your vendor’s systems or processes. One way to approach this is to consider the three Ps of third-party and supply chain risk: policies, prevention, and promises:

Policies: Minimize your cyber risk

While many third-party partners rely on your data to deliver their services, you should understand what information they need, and what information you are willing to share prior to establishing partnership. It is also important to consider who can access this information and the process of granting them this access.

The end goal here is to minimize the number of third-party and supply chain risks by proactively defining supply chain policies, developing the necessary due diligence tools, setting validation meetings on a consistent basis, raising the overall security awareness around the policies being set at your organization, and encouraging your team and suppliers to improve.

Prevention: Measure your cyber risk

The core objective here is ensure that you understand if there are any threats and risks that may arise once you’ve set up your policies. From here, you can work with your third-party vendors to set expectations and requirements with their cybersecurity processes that mitigate your organization’s cyber risks.

Therefore, the most critical steps you can take from a prevention standpoint are to start by identifying your assets and obligations, defining your organization’s tolerance for risk, conducting a vendor risk assessment (or at minimum, a due diligence questionnaire) and defining the defensive requirements to address them.

Promises: Mitigate your cyber risk

Once you’ve set up your policies and preventative measures, the last thing to consider is how you’ll mitigate third-party risk by establishing and following contractual obligations, documents, and standards in the event of a cyberattack. Therefore, any contract you sign with your third-party vendor should extend from simple things like service definitions and pricing to the minimum cybersecurity requirements.

Here you should consider what to do when your vendor faces a cybersecurity incident, ranging anywhere from detecting unauthorized activity to a successful data breach. Both parties should agree on what activity is worth flagging, who works to resolve it, and what information should be logged for forensic analysis. Another important factor to consider – who is responsible if damages occur?

Any business or organization, regardless of their size, is a potential target for a cyberattack. However, trusted vendors who serve a larger client base are especially at risk as threat actors may have access to a downstream client base in the event their attack is successful.

How can organizations protect themselves from third-party risks?

The key to mitigating third-party risk lies in taking proactive measures prior to finalizing business partnerships. Ask yourself, how susceptible are your third-party partners to phishing attempts? What potential zero-day vulnerabilities could be present that would allow threat actors to access your data?

Our Due Diligence Questionnaire can help your team highlight which third-party and supply chain risks your organization may be susceptible to.

However, while a due diligence questionnaire is a good starting point for this discussion, what your team will really benefit from is conducting a thorough Vendor Risk Assessment.

The assessment will help you answer questions regarding your third-party and supply chain risk such as:

Given the explosive growth of supply chain cyberattacks globally, a vendor risk assessment will give you the peace of mind you need since it provides:

Based on data findings and security program recommendations that a vendor risk assessment provides, you can plan your cybersecurity defenses around your vulnerabilities to ensure you have the tools, technology, and people you needed to successfully mitigate your third-party risks.

When creating a cybersecurity plan that addresses your third-party risks and vulnerabilities, it is important to review “the 3 Ps” of third-party and supply chain risk to maximize your cybersecurity defenses and leave no loose ends for potential zero-day attacks.

Good things come with time. By going through a vendor risk assessment with your partners, both parties will come out with stronger defense measures, a clearer understanding of their cyber risks, and a detailed response plan that gives peace of mind.

Ready to mitigate your third-party risk with a Vendor Risk Assessment? Book a meeting with an eSentire cybersecurity specialist to get started.

Join 100,000+ Security Leaders

Get notified of the latest news, intel and helpful tools & assets. You can unsubscribe anytime.

By clicking the button below I confirm that I have read and agree to the eSentire privacy policy.

View Most Recent Blogs
eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.