In this lesson,
we will learn about third-party risk management.
Third-party risk management involves assessing
and mitigating risks associated with external parties
that provide commodities or services to an organization.
Third-party risk management considerations
include subprocessor risk,
which arises when third-party vendors subcontract work,
vendor risk, which focuses on the potential impact
of direct suppliers to the organization,
and supply chain risk,
which encompasses risks across all stages
of the supply chain,
including both subprocessors and vendors.
Let's explore vendor risk, subprocessor risk,
and supply chain risk in more detail.
First, we have vendor risk.
The vendors we rely on
can significantly affect our business operations
and security so it's essential
to assess their risk carefully.
For instance, if a software vendor we depend on
for daily operations has poor security practices
and suffers a data breach,
our sensitive data could be exposed,
even if the breach occurred outside our organization.
That's why, for each new vendor, we conduct due diligence.
Due diligence is the process
of thoroughly evaluating reliability, risks, and integrity
before entering into a partnership,
such as a vendor agreement.
Once they're on board and integrated into our systems,
we apply due care to the vendor relationship
by continuously taking reasonable steps to prevent harm
and mitigate risks,
ensuring that our operations remain secure.
Now that we've covered the importance
of managing initial vendor risk, it's clear
that evaluating vendors is just the beginning
of building a secure business environment.
Once we've ensured that vendors are trustworthy
through due diligence, we need to look deeper
into how they impact our business operations.
This includes considering factors
like product support lifecycle.
For example, purchasing software from an established vendor,
like Microsoft, ensures
that we will receive long-term updates
and security patches, reducing the risk
of vulnerabilities over time.
In contrast, a newer or less stable vendor
might not have the resources
to offer this level of support.
Second, we have subprocessor risk.
A subprocessor is a third-party entity that a vendor
or service provider outsources certain functions to.
Processing data or managing specific services
are common subprocessor functions.
For example, a cloud service provider
might use a subprocessor
to manage their data centers
or perform certain technical tasks.
Managing subprocessor risk is important
because even though we're not directly working with them,
these subprocessors can still impact our security
and business operations.
If a vendor we rely on outsources critical functions
like data storage or IT support to another company,
we need to ensure that the subprocessor
is reliable and secure.
To manage this risk, we first need to ask our vendors
to disclose who their subprocessors are
and what services they provide.
Then we need to verify
that these subprocessors follow strong security practices
and comply with the same standards we expect
from our main vendors.
This way, we can be confident that every link in the chain,
both vendors and subprocessors,
meet our security and performance requirements.
Third and last, we have supply chain risk.
When assessing the total supply chain risk, it's important
to consider all components that make up your products,
such as hardware and software.
For instance, if you buy a router, it's possible
that the parts inside may have been tampered with
along the way.
Conducting a supply chain assessment helps you understand
where those parts came from and whether they can be trusted.
You don't need to track every component,
but knowing the reliability of your suppliers
is key to ensuring a secure working environment.
Another key aspect of supply chain risk
is source authenticity.
When buying equipment, it's important
to purchase directly from trusted vendors,
such as Cisco, rather than secondhand
or unauthorized sources, which carry a higher risk
of compromised or counterfeit devices.
Evaluating the supply chain
for products you're integrating into your systems
helps ensure the final product is free
from hidden threats,
like malware embedded in firmware,
which could go undetected for long periods,
and pose serious security risks to your network.
So remember, third-party risk management
involves identifying
and mitigating risks from external parties
that provide services or products to our organization.
Key aspects include vendor risk,
which focuses on the direct impact of our suppliers,
subprocessor risk, which arises when vendors outsource parts
of their services to other providers,
and supply chain risk,
which encompasses risks across the entire supply chain.
Managing these risks requires conducting due diligence
to ensure the reliability and security of vendors
and their subprocessors,
as well as verifying the authenticity
of products and services in the supply chain.