In this lesson,
we're going to cover vendor assessments.
Now a vendor assessment is an essential process
that organizations implement to evaluate the security,
reliability, and performance of external entities
that they rely upon.
In today's interconnected business landscape,
a weak link in one vendor can have reverberations
across multiple businesses
and lead to widespread vulnerabilities
and potential data breaches.
Now, first, let's classify the primary entities
that are often under the purview of vendor assessment.
This includes vendors, suppliers,
and managed service providers known as MSPs.
Now, vendors are typically businesses or individuals
that provide goods or services to an organization.
Think of software providers, like Microsoft or Oracle,
which your organization might rely on
for an enterprise solution.
Next, we have suppliers,
and suppliers are typically going to be involved
in the production and delivery
of products or parts of products.
For instance, a computer manufacturer
might have multiple suppliers,
with one providing processors, another providing memory,
another providing hard drives, and things like that.
Now, finally, we have MSPs,
known as managed service providers.
These are going to be hired by a company
to manage IT services on behalf of your company.
Now, a good example of an MSP, or managed service provider,
would be a cloud service provider, like AWS or Google Cloud,
and they're going to be used
to manage vast data infrastructures
so your organization can instead focus
on their core competencies.
Now, one vital aspect of the vendor assessment process
is penetration testing of your suppliers.
Penetration testing is essentially a simulated cyberattack
against your supplier systems
to check for exploitable vulnerabilities.
Let's imagine your company sources its software
from a third-party developer.
Penetration testing the software would mean attempting
to find and exploit vulnerabilities,
just like an actual cyberattacker would,
in order to attempt their own attacks against your network.
Now, if a vulnerability is found, this is an indication
that the software could be a risk
to your organization's cybersecurity posture.
Our goal with conducting a penetration test
is really to validate that our service provider, or vendor,
is taking their own cybersecurity posture seriously
since their risks could become your risk
once you install their software into your network.
Now, when conducting your vendor assessments,
one part of that is to review your contract
with the vendor or service provider.
When you're reviewing the contract, you should verify
that you have a right to audit clause included inside
of that contract.
Now, this right to audit clause
is going to grant your organization the right
to evaluate the vendor's internal processes
and ensure that they're in compliance
with the agreed upon standards.
For instance, if a company contracts a data management firm
to handle its customer data,
the right to audit clause would allow the company
to periodically inspect the data handling,
storage, and protection practices
of the given vendor you've selected.
Now, this isn't about a lack of trust,
but rather, a method to ensure transparency
and make sure that they're adhering to the best practices.
Remember, inside of cybersecurity,
we always want to trust but verify.
Now, another element that instills confidence
in vendor security is evidence
of internal audits being conducted.
An internal audit refers to a vendor's self-assessment,
where they evaluate their own practices
against industry standards or organizational requirements.
For example, a cloud service provider
might regularly audit its data protection measures
to ensure that encryption protocols are up-to-date
and effectively implemented.
Now, when a vendor can present evidence
of consistent and comprehensive internal audits,
this does serve as a testament to their commitment
to security and quality.
Now, while internal audits are commendable,
they may sometimes be insufficient,
especially if you're lacking the rigor involved with them.
This is where the need
for an independent assessment will come into play.
Independent assessments are evaluations conducted
by third-party entities who have no stake
in the organization or vendor's operations.
Think about this as a neutral party
who's going to be coming in to make sure the vendor is adhering
to the security or performance standards
that you both have agreed to.
Let's consider there's a data center
that houses critical information for multiple organizations.
An independent body,
like the International Organization for Standards, or ISO,
might assess the data center's practices
against its global standards to ensure they're meeting
or surpassing the benchmarks.
This third-party validation is going to be invaluable
for organizations who aim
to minimize their exposure to risk.
Finally, in our discussion of vendor assessments,
we can't overlook the importance
of conducting a supply chain analysis.
A supply chain analysis is going to be used to dive deep
into a vendor's entire supply chain
and to assess the security and reliability of each link.
It is an acknowledgement of the fact
that the vendor's security is not just about their practices
but also encompasses their entire supply chain's integrity.
Now, for example, a hardware vendor might source parts
from various global locations.
A thorough supply chain analysis will then scrutinize each
of these source locations to ensure there's no risk
of counterfeit parts or tampered products entering
into your supply chain.
So remember, in today's interconnected businesses
and global supply chains,
the security and reliability of our vendors
will directly impact our organization's own wellbeing
and security.
While trusting our partners is essential,
actively ensuring their adherence
to top-notch standards is also equally as important,
as we need to ensure that we conduct a vendor assessment
a contract review, a penetration test,
and other internal or external audits to validate
that our suppliers and vendors are remaining in compliance
with the security requirements that are contained
within our service contracts.