Third-Party Risk.

What is third-party risk?

Third-party risk is the chance that an outside organization you rely on causes harm to your own security. Outside organizations include vendors, suppliers, service providers and contractors. CISA describes the information and communications technology (ICT) supply chain as a complex, globally interconnected ecosystem. It covers the whole life cycle of ICT hardware, software and managed services.

How does third-party risk work?

You often cannot see how a supplier builds, runs or protects what it gives you. CISA says vulnerabilities can enter at any phase, including design, development and production, distribution, acquisition and deployment, maintenance, and disposal. It lists malicious software, counterfeit components, flawed designs and poor manufacturing processes as examples.

CISA also says foreign adversaries and criminals can target government and industry through contractors, sub-contractors and suppliers at all tiers of the supply chain. So the risk can sit with a supplier of your supplier, not only with the company you pay.

What does a supplier-based attack look like?

ENISA, the European Union Agency for Cybersecurity, describes a supply chain attack as an attack on one or more suppliers, followed by an attack on the final target, the customer. As a simple illustration, a company trusts a software provider, and an attacker who gets into that provider then has a route toward the company.

ENISA analyzed 24 recent supply chain attacks. In about 66% of the reported incidents, attackers focused on the suppliers’ code. In 66% of the attacks analyzed, the suppliers did not know, or failed to report, how they were compromised.

How can you reduce third-party risk?

NIST calls the formal practice cybersecurity supply chain risk management, or C-SCRM. NIST SP 800-161r1-upd1 defines it as a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes and procedures.

CISA recommends six actions:

• Build a team from various roles and functions, and make sure staff are well trained in the security procedures of their role.
• Manage security policies based on industry standards, such as those from NIST.
• Assess the ICT components your organization procures, and the systems with remote access that must be protected.
• Know your suppliers and their upstream sources.
• Verify that suppliers maintain an adequate security culture and supply chain risk program.
• Evaluate your program regularly, including feedback and possibly audits of suppliers.

ENISA gives customers similar advice. It says to identify and document suppliers, define risk criteria for different supplier types, monitor supply chain risks, manage suppliers throughout the product life cycle, and classify the assets you share with suppliers.

How does it relate to nearby terms?

A supply chain attack is one way third-party risk can turn into real harm. A data breach at a supplier can also expose information that a customer shared with it. Both are related terms, and third-party risk is the wider idea of the exposure itself.

Is third-party risk the same as vendor risk?

The two names are often used for the same idea. Vendor risk and supplier risk usually point to the companies you buy from. Third-party risk is a little wider, because CISA’s wording also includes service providers, contractors and customers.

Is third-party risk the same as supply chain risk?

They overlap, but they are not identical. Supply chain risk looks at the whole chain of products and services, including the upstream sources of your suppliers. Third-party risk is often used for the direct relationship with one outside organization. CISA advises knowing your suppliers and their upstream sources, so both views matter.

See also

• Digital Risk Protection 101
• Threat Intelligence Platforms 101
• Supply chain and vendor risk