Webinar | Cybersecurity in Supply-Chain: Start with Prevention

On the 4th of April 2023, we had our webinar on Supply Chain and Cybersecurity: Start with Prevention. We covered third-party risk assessment, choosing between cloud or on-premises solutions, outsourcing security operations to an MSSP, and ethical hacking.

Third-party software can be risky due to a lack of transparency and insufficient security controls. Cloud solutions offer more accessibility and cost-effectiveness, but on-premises solutions offer more control over data security.

Outsourcing security operations can provide access to expertise and scalability, but also carries risks in terms of loss of control and shared responsibility. Ethical hacking is crucial for preventing cyberattacks, but decision-makers need to be properly informed about the importance of offensive security measures.

Take a more detailed look below:

Assessing Third-Party Risk

Third-party software is used by almost all organizations today as it helps them to be cost-effective and scalable. Although these are critical components of the value chain of the company, the main risks associated with third-party vendors are related to the lack of control over the security of their systems and the data they handle.

Here are some examples:

• Lack of transparency: It can be difficult to get a clear view of the security practices of third-party vendors, especially if they are not forthcoming about their security policies and procedures.
• Insufficient security controls: Third-party vendors may not have the same level of security controls in place as the primary organization, which can make them vulnerable to attacks.
• Unsecured data sharing: Sharing data with third-party vendors can increase the risk of data breaches if the data is not properly secured during transmission or storage.

They’re always a risk but if we can manage their performance and their impact, they become a controlled risk, and so, if their infrastructure is attacked or has a breach, our data, and most importantly our clients’ data, won’t be impacted.

Third-party software is used by almost all organizations today as it helps them to be cost-effective, and scalable, and integrate those with their software and systems. Although these are critical components of the chain of value of the company, the main risks associated with third-party vendors are related to the lack of control over the security of their systems and the data they handle. Here are some examples:

• Lack of transparency: It can be difficult to get a clear view of the security practices of third-party vendors, especially if they are not forthcoming about their security policies and procedures.
• Insufficient security controls: Third-party vendors may not have the same level of security controls as the primary organization, making them vulnerable to attacks.
• Unsecured data sharing: Sharing data with third-party vendors can increase the risk of data breaches if the data is not properly secured during transmission or storage.

Third-party SaaS/Cloud Solutions or On-premises

Third-party solutions can be provided as a service, usually subscription-based or contract-based, but also they commonly exist on-premises, which means that the software will be hosted on the organization's infrastructure. Here are some key considerations to help you choose the right one for your company:

• Security: Third-party cloud solutions can offer robust security features and protections, but organizations may have less control over the security of their data. These third-party cloud providers can also restrict access to perform some types of security tests, along with their frequency and depth. On-premise solutions allow your organization to maintain full control over its data but can be more expensive to maintain, obtain and secure.
• Cost and Accessibility: Cloud solutions can be more cost-effective than on-prem solutions, as they need less investment in hardware and infrastructure, and are accessible from anywhere with an internet connection. However, ongoing subscription costs can add up over time and might have limited accessibility.
• Compliance: Depending on the organization's industry and regulatory requirements, they may need to choose a solution that meets specific compliance standards, such as HIPAA or GDPR.

The decision relays on the specific needs and contexts of the organization, and both have some types of drawbacks. No matter the one you choose, always consider the one that ensures additional control over your data while allowing you to improve and implement active monitoring in your processes as an organization.

MSSPs and External Security Providers

When the in-house expertise lacks resources, Managed Security Service Providers/ outsourced security solutions are becoming the standard to improve the security posture. They include defensive security to offensive security solutions, and consulting or compliance. Even though, there are some risks associated with this type of outsourcing:

• Lack of control: When outsourcing security operations to an MSSP, organizations may have less control over their security posture and data. They must trust that the MSSP is implementing appropriate security measures and protocols.
• Shared responsibility: Although MSSPs are responsible for managing security operations, organizations still have a responsibility to ensure that their data is secure. This shared responsibility can be complex to manage and may result in security gaps if not managed effectively.
• Compliance concerns: Depending on the industry and regulatory requirements, organizations may need to ensure that their MSSP complies with specific standards, such as HIPAA or GDPR.

Advantages for MSSPs: Access to experts, Scalability and it's Cost-effective.

Disadvantages for MSSPs: Communication challenges with both parties, Data privacy concerns, and Dependence on the MSSPs Service. 

While outsourcing security operations to an MSSP can provide organizations with access to expertise, scalability, and cost-effectiveness, it also carries risks in terms of loss of control and shared responsibility. Before selecting an MSSP to manage security operations, organizations should carefully weigh the benefits and drawbacks of each option. 

Ethical Hacking

Ethical hacking can be a challenge in terms of convincing decision-makers to invest in offensive security measures, being it for the word “hacker” or what this action implies, especially if they do not fully understand the potential risks. How to address that:

• Educating decision-makers: It's important to educate decision-makers on the potential risks and consequences of a security breach, and the benefits of investing in offensive security measures like ethical hacking.
• Demonstrating the value of ethical hacking: Organizations can demonstrate the value of ethical hacking by conducting a pilot test or providing case studies of successful penetration testing engagements that identified security vulnerabilities.

In addition, organizations can work with third-party ethical hacking firms or Managed Security Service Providers (MSSPs) to help augment their offensive security capabilities, as these firms have established expertise in conducting ethical hacking engagements and can provide valuable insights to improve security defenses.

This is exactly what we do at Ethiack!

We give your company the extra mile to stay ahead of cyber threats by using offensive security. Instant and autonomous security solution powered by ethical hackers and AI to identify and manage vulnerabilities.

Ready to take the next step?