With increasing dependence on vendors in today’s interconnected world, vendor risk assessments are more essential than ever. No doubt, due to COVID-19, many companies took shortcuts with their security just to continue with “business as usual” during these unprecedented times. Simultaneously, however, cybercriminals were taking advantage of the situation, as is apparent by the growing intensity and frequency of cyberattacks in 2020.
While working with vendors provides obvious benefits, it’s important to be mindful of the risks they bring as well. Do your due diligence, evaluate vendor cyber risk and then decide whether or not to work with a particular vendor. Just the thought of performing vendor risk assessments can be overwhelming, but failing to do them may result in much worse: lost business, reputational damage, non-compliance or legal fees and fines.
How can you be sure that your vendor cyber risk assessments are effective? Here are five key steps that you should be sure to include:
1. Understand your vendors’ impact on your organization.
In order to understand the inherent risk of each vendor, do the following:
- Examine the current security measures your vendor has in place, what must be secured and how, the highest risk areas and how the impact poses risk to your organization.
- Understand the business implications a vendor breach would have on your organization. For example; would a sudden vendor loss disrupt your business or affect your customers?
The above considerations will help explain how your vendors’ risks can potentially affect your organization based on your business relationship with the vendor. Given this information, you can make informed decisions about the scope of the assessment.
2. Analyze the attack surface of your vendors.
Scanning your vendors’ public-facing digital footprint is critical so that you can discover their assets and any possible cyber gaps. Any analysis should examine at least three layers:
- IT and network: parameters involving DNS servers, SSL-related protocols and more
- Applications: parameters involving Web applications, domain hijacking and more
- Human: parameters involving social posture, presence of dedicated security team and more
Keep in mind that performing a comprehensive review of the vendor’s attack surface requires specific engineering and security know-how. Panorays can help by unveiling assets while running tests in parallel with the least amount of false positives. This will allow you to quickly review many vendors at once and significantly accelerate and scale this process.
Subscribe to Our Blog
3. Customize security questionnaires according to risk level.
Answering questionnaires is a lengthy process that often involves multiple team members on the vendor side. Obviously, it’s not helpful to require them to complete security questionnaires that contain a lot of irrelevant questions.
To streamline the process, it’s best to customize questionnaires according to the business relationship that your company has with the vendor. For example, some vendors will need to comply with regulations such as GDPR and NYDFS, which means that they will need to respond to specific questions that assess their regulatory readiness.
Manually creating customized questionnaires for each vendor can be extremely time-consuming. Using an automated solution like Panorays, you can rapidly generate automated questionnaires based on your company’s business relationship with vendors.
4. Review responses and create remediation timelines for vendors.
Once you gather all of the responses from the questionnaires, which can easily include hundreds of responses per questionnaire, you need to carefully review each response and flag any issues. Using automation can greatly reduce the amount of time spent on this step.
This is also the time to determine whether any cyber gaps must be remediated. If so, you will need to present a remediation plan and timeline to your vendors according to your organization’s guidelines.
5. Continuously monitor your vendors for changes to cyber posture.
Your vendors may be cyber gap-free when you onboard them, but that could change. Hackers constantly use new and advanced methods to exploit new vulnerabilities and engage in cyberattacks. Moreover, vendors frequently add new assets and software and may change their internal reasons. For these reasons, it’s important to continuously monitor your third parties and receive live alerts about any issues.
Want to learn more about how to perform effective vendor risk assessments? Contact us to schedule a demo.
