By Corey Nachreiner

Corey Nachreiner

Trust is hard to earn and easy to lose. Software vendors have learned this lesson the hard way over the last few years, as their products have become the target of increasingly frequent and damaging digital supply chain attacks.

The SolarWinds breach is a fitting example. A network breach gave threat actors privileged access to SolarWinds’ source code repositories and build systems, allowing criminals to introduce a backdoor Trojan into the official installer package for Orion (a popular network monitoring product). SolarWinds’ problem then became a problem for thousands of its customers. The SolarWinds incident is just one of many, which is why third-party risk management (TPRM) and vendor validation have become important parts of most buyers’ purchasing decisions.

TPRM is the practice of assessing the risk of any external product, service or contractor to which you offer privileged access. A key aspect of this includes a vendor security validation, where you validate the security of both the product or service itself and the security practices of the vendor that provides it. Any product that touches the core of your network should pass a formal TPRM process before you buy it.

However, there are good and bad ways to run this process. For those new to it, it’s important to understand that it will take time and effort — from you and the outside vendor. Doing it inefficiently can waste money and, if you impose unnecessary burdens on them, negatively impact relationships with your business partners. So how can you do it right? Below, we’ll cover common missteps and ways to make the process more efficient for everyone involved.

Vendor Validation Missteps and Pitfalls

While it might include some research (yours and the third party’s), the core act of vendor validation is a survey or questionnaire that asks the vendor about its product or service and organizational security practices. While it sounds simple, there are several common pitfalls:

TPRM and Vendor Validation Best Practices

Understanding the above TPRM missteps can help you build effective best practices.

For instance, rather than writing your own questions, try …

… standard questionnaires such as the Shared Assessment’s Standardized Information Gathering (SIG) questionnaire or CSA’s Consensus Assessments Initiative Questionnaire (CAIQ). There are also scaled-down versions of these standard surveys for smaller engagements with third parties.

Before determining the appropriate security questionnaire to send partners, conduct due diligence to assess the risk of the product or project you’re considering with them. How much of your data, if any, will the third party have access to? Does it include personally identifying information (PII) for your customer or employees, sensitive corporate data or public data? Will you have to install any part of the product or service into your own private infrastructure? If so, what level of privileged network and user access is required? Questions like these will help you understand the security risks that this third party’s products or services might pose to your organization. For more basic integrations, consider sending a shorter, more basic questionnaire.

Finally, invest in tools or services to help automate, track and audit your TPRM process. There are many that deliver these capabilities and help manage other aspects of trust, such as GDPR and CCPA compliance. Using these tools will help accelerate the vendor-validation process and offer a more sophisticated level of tracking and process auditing.

Verify Trust Efficiently

In this day of digital supply chain attacks, vendor security validation and third-party risk management is crucial, and all companies should consider it. But doing it poorly can waste time for you and your partner. By investing more effort into formalizing your process using the available standards, and considering TPRM tools to enhance your process, you can make this vital security process much quicker and easier for all involved.

Corey Nachreiner is the chief security officer of WatchGuard Technologies. Recognized as a thought leader in IT security, Nachreiner spearheads WatchGuard’s technology and security vision and direction. He is a speaker at forums such as Gartner, Infosec and RSA and is a regular contributor to publications including CNET, Dark Reading, Forbes, Help Net Security and more. Find him on www.secplicity.org. You may follow him on LinkedIn or @watchguard on Twitter.