What We Do
How We Do
Resources
Company
Partners
Get Started

THIRD-PARTY CYBER RISK

Protection From Supply Chain and Third-Party Cyber Risk

As a security leader, you need to be aware of the potential cyber risks that arise every time an external party is granted privileged access to your systems. eSentire helps assess your third-party cyber risk and offers 24/7 support for rapid threat detection, threat hunting and complete threat containment in minutes, before your business is disrupted.

GET STARTED

Identify the risk of being impacted by a third-party breach

Protection from threat actors leveraging third-party vendors for cyberattacks

SUPPLY CHAIN AND THIRD-PARTY CYBER RISK BY THE NUMBERS

45%

of organizations experienced a third-party security incident in the last year1

84%

of third-party incidents result in operational disruption2

108DAYS

The average time between an attack and the disclosure was 108 days in 20223

1. Prevalent, Third Party Risk Management Industry Study, 2022
2. Gartner, Annual ERM Survey, 2023
3. Black Kite, Third Party Breach Report, 2023

How Do You Assess Vendor Risk?

Most organizations rely on a highly interconnected environment of vendors, suppliers, partners and service providers to extend their capabilities and scale operations. To address the growing third-party cyber risks, you need to strategically assess every vendor with privileged access to your systems, networks, and data. Start by asking yourself:

  • Do I have formal procedures to manage cyber risks associated with third-party access to my environment and data?
  • Have I thought about the supply chain in my vendors’ ecosystems and who else may have access to my data?
  • How can I ensure my data is protected if my third-party vendors are compromised?

The cost of a third-party breach is not just measured in short-term financial loss and lost productivity, but also in long-term reputational damage and client churn.

The best way to protect your company from a devastating breach is to avoid one in the first place – conduct the due diligence needed and have the right protection in place.

How eSentire Protects Against Supply Chain and Third-Party Cyber Risk

We can help with third-party cyber risk due diligence with our Vendor Risk Assessments and provide ongoing 24/7 protection with eSentire Managed Detection and Response (MDR).

eSentire Vendor Risk Assessment

eSentire Managed Detection and Response

KEY CHALLENGE

Proactively identify the risk of a supply chain or third-party breach.

HOW WE HELP

  • Develop and update your third-party risk management program.
  • Evaluate third-party cyber risk leveraging our 15-point security program assessment.
  • Develop a cyber risk management plan and become more resilient to third-party breaches.

KEY CHALLENGE

Protect your business from threat actors leveraging your third-party vendor(s) to bypass traditional security controls.

HOW WE HELP

  • Get multi-signal visibility enabling deeper correlation and threat investigation capabilities proven to contain threats faster.
  • Gain 24/7 protection with proactive threat hunting and disruption facilitated by our SOC Cyber Analysts and Elite Threat Hunters. Automatically disrupt threats in real time with our open XDR platform.
  • Stay ahead of the most advanced threats with original threat research and novel ML detection models developed by our world-class Threat Response Unit (TRU).

Consider the Three Ps of Third-Party Risk:
Policies, Prevention, and Promises

Threat actors often target critical service providers that are known to be trusted vendors, because if the attack is successful, they gain access to a downstream client base. Therefore, organizations need to bake security, by design, into their programs, products, and services.

To reduce your cyber risks, you need to assess the vulnerabilities and weaknesses of any third-parties that you rely on. So, consider the three Ps of third-party risk:

Policies

MINIMIZE
  1. Define Supply Chain Policies
  2. Develop Due Diligence Tools
  3. Establish Periodic Validation
  4. Raise Security Awareness
  5. Encourage Improvement

Understand what data you’re willing to share and the type of access you’re willing to provide to a vendor. These policies should be established before you engage with a potential third-party vendor.

Prevention

MEASURE
  1. Identify Assets and Obligations
  2. Define Risk Appetite
  3. Conduct Risk Assessments
  4. Analyze Results and Risks
  5. Define Defensive Requirements

Identify the risks that may arise as a result of the policies. Then, work with your vendor(s) to establish the minimum security requirements needed to mitigate the risks and protect your business from potential cyber threats.

Promises

MITIGATE
  1. Contractual Obligations
  2. Demark Responsibilities
  3. Establish Minimum Standards
  4. Document Notifications
  5. Representations/Warranties

Ensure that your vendor contracts consider how and when breaches will be disclosed, how breach information will be logged and shared, and who will be responsible for the remediation, forensic analysis, and damages.

Identify Your Risk of A Third-Party Breach

As a security leader, you must account for the lack of visibility and reduced end-to-end control the presence of third-party vendors has on your overall attack surface. eSentire is here to minimize your third-party risk with Exposure Management and Multi-Signal MDR services.

eSentire Vendor Risk Assessment

Lack of visibility and end-to-end control of vendor security practices increase the potential attack surface that your organization must consider.

eSentire’s Vendor Risk Assessment is built on the foundation of NIST and is designed to help resource-constrained organizations to:

  • Determine risk identification and measurement criteria
  • Categorize assessment data access against your organization’s risk appetite
  • Develop questionnaires for assessment
  • Conduct comprehensive assessments
  • Analyze data with comparisons against risk categorizations
  • Define corrective actions for risky third-parties and vendors
  • Determine defensive adjustments to mitigate your risk
READ THE DATA SHEET

eSentire Multi-Signal MDR

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. With eSentire in your corner, you can anticipate, withstand and recover from even the most sophisticated cyberattacks so you can build a more resilient security operation.

With eSentire MDR, you get:

  • 24/7 Always-on Monitoring, Threat Hunting, and Threat Disruption & Containment
  • Mean Time to Contain: 15 Minutes
  • Open, Cloud-Native XDR Platform
  • Multi-signal Coverage and Visibility
  • Automated Blocking
  • Proactive Manual Threat Containment and Response
  • Threat Advisories & Thought Leadership
  • eSentire Cyber Resilience Team – 24/7 SOC Cyber Analysts, Elite Threat Hunters, Threat Response Unit (TRU), and a named Cyber Risk Advisor
  • Operational Reporting with 24/7 Insight Portal access
READ THE DATA SHEET

eSentire Third-Party Cyber Risk Management In Action

CASE STUDY: Fraudulent Transaction Illuminates Third-Party Risk

eSentire was engaged by a financial services firm to conduct third-party cyber risk assessments.

The firm previously failed an audit due to a fraudulent transaction from a compromised third party. Realizing the potential implications of a repeat issue, the client contracted eSentire’s Virtual CISO (vCISO) services, specifically a Third-Party Risk Assessment.

Read the full story on how eSentire executed tailored risk assessments that resulted in operational cost savings for this firm.

Read Now →

CASE STUDY: Third-Party Serves as Staging Point for Cryptojacking Attack Using Powershell

eSentire observed an unknown threat actor attempting to deploy Monero cryptocurrency mining malware to multiple customers. This increasingly common type of attack known as “cryptojacking” allows a hacker to leverage the computing power of devices to mine cryptocurrencies, unbeknownst to the victim.

Following an investigation from eSentire’s SOC, it was determined that the threat actor was leveraging a zero-day vulnerability in Kaseya’s Virtual Systems Administrator (VSA) agent to gain access to the clients’ network.

Read this case study to learn how eSentire remediated the attack.

Read Now →

WE OWN THE R IN MDR: The Kaseya Zero-Day Attacks

Watch this video with one of eSentire’s Elite Threat Hunters, Spence Hutchinson, as he reviews the Kaseya VSA supply chain attacks. Spence outlines how eSentire’s Security Operations Center (SOC) and Threat Response Unit (TRU) were able to quickly respond on our customer’s behalf and notify Kaseya of the breaches.

Modern Threat Response

In these attacks, threat actors leveraged zero-day vulnerabilities to push Cryptomining malware and ransomware to Kaseya VSA customers. Our proprietary BlueSteel Machine Learning Engine identified malicious Powershell commands being executed. eSentire’s actions to detect, respond and remediate these attacks demonstrate the importance of MDR services that go beyond alerting and host isolation to deliver complete & robust response.

WATCH NOW →
×
 

Security Leaders Count on eSentire

A logo of eSentire’s customer, CWS Apartment Homes, Inc., next to a testimonial which discusses how eSentrie managed phishing training and security awareness training keeps the organization’s environment secure 24/7.
I have enjoyed having the additional security knowledge on my team. I sleep better at night.”
David Greene
IT Vice President
Wetherby greyscale logo
It’s a pleasure working with a group of people that know what they’re doing. They are an extension of the Wetherby technical security team."
Trevor Hicks
Principal and CTO | Wetherby Asset Management
A logo of eSentire’s customer, EnCap Investments L.P., next to a testimonial which discusses how eSentrie managed phishing training and security awareness training improves EnCap’s security posture.
eSentire provides a better security posture for our organization."
Shahab Kazim
Chief Technology Officer (CTO) | EnCap Investments LP
Read more case studies and reviews →

Ready to
Get Started?

We’re here to help! Submit your information and an eSentire Representative will be in touch to discuss how we can protect your business from third-party cyber risk.