How to shore up your third-party risk management program

Top third-party risk challenges and solutions

Moving on from security questionnaires. The use of increasingly complicated security questionnaires filled out by the security team or nontechnical sales and marketing staff isn't enough to get at what enterprises really need to know as part of a third-party risk management program. Yet questionnaires are often all that's used to "verify" a vendor's security. More a tool for going through the motions and even protecting the self-interests of those asking the questions, security questionnaires get that box checked. Unfortunately, they often paint a false picture of security in the organization.

A better alternative is to conduct interviews with key staff. I have found frontline IT and security professionals very forthcoming in their knowledge of known security gaps and weaknesses. Empty promises are often made during the sales cycle or contract negotiations with vendors, but if you speak to the right people, it becomes clear how things really work. Questionnaires are a good start, but depending on them exclusively is the first and perhaps most common step in setting your business up for security failure.

Vendor security documentation needs to reflect reality. In security, talk is cheap. I've reviewed thousands of policies that govern a variety of security subjects, and they are all predictably similar. They say the same things, and they're rarely enforced. Documentation creates the illusion that all is well in third-party risk management security, but that's hardly ever the case. Most policies mean nothing, and it's often because IT and security teams documented the policies without the full buy-in at the highest levels of the business. In many cases, no one else, not even management, knew about them or cared to enforce them. Organizations shouldn't let paperwork representing a vendor's security program translate into emptypromises that if unacknowledged, turn into security trouble.

Weak contract management. Most organizations I have consulted with don't have a formal and cohesive contract review process overseeing security-related contracts. Sometimes these contracts are reviewed by purchasing staff, sometimes by legal counsel. At other times, technical staff and nontechnical management review contracts. The challenge is that business decision-makers and those in charge of security are often not on the same page with security standards and oversight. In many cases, they agree to terms and conditions they know nothing about or can't back up with security controls and oversight. Vendor agreements have a lot of moving parts, and in some cases, purchasing and legal will agree to one thing, while IT and security teams are off doing something else. The result could be a security incident or breach in the making.

Assuming proper security testing has been performed. Vulnerability scans are part of an information third-party risk management program, but they're not enough to evaluate actual risk. Similarly, it's not uncommon for full vulnerability and penetration testing reports to paint the wrong picture of how things are. This is arguably the biggest challenge in terms of vendor management. Vendors will claim they are doing X, Y and Z, or that rudimentary testing will be performed even by the organization. But the devil lies in the details of the flaws that have yet to be uncovered by someone with bad intent.

Information security, as it relates to third-party risk management, is complex. Yet the core risks can be simplified into the following:

• Where policies exist, they're not being precisely followed.
• Where technologies exist, they are underimplemented in many ways.
• Where vulnerability and penetration testing has been performed, the odds are near 100% something has been overlooked either in the scoping process or the testing itself.

Gaps and risks are often a case of setting expectations improperly. This means not clarifying and fully spelling out what's expected of both parties (your business and the vendor) in terms of intellectual property ownership, incident response practices and shared security efforts when needed. These issues often occur because some of the people involved try to rush things along too quickly just to get the deal done and to say that due diligence is complete.

Get a grip on your downstream security liability

Getting a handle on downstream security liability has been a struggle for businesses for decades, and the need for it has finally come of age. Shore up your third-party risk management program. Don't let a vendor's security weakness become one of your own. Look past the promises of ISO, NIST and SOC compliance. You're never going to know 100% about your vendor's security vulnerabilities. The important thing, however, is to go beyond the checkboxes and follow that tried-and-true security principle: trust, but verify. Don't be afraid to push for good information. This isn't about being nice; it's about protecting your business.

Get the right people together and ask the tough questions to hold your vendors accountable -- now and moving forward. They don't have as much interest and buy-in on your security posture as you do. Like anything else in security, when done periodically and consistently, your efforts can and will have a positive impact on your security program over time.