Rule 1: know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place.

Third-party vendors have access to valuable, sensitive corporate and government data, yet more than one third of companies don’t believe these vendors would tell them if they had a data breach, according to a recent study from the Ponemon Institute.

Although it's common to include data privacy and security procedures in third-party contracts to ensure vendors have appropriate measures in place to protect company data, it is difficult to evaluate how the vendor is protecting data from unauthorized access, use, and disclosure, and to know whether the vendor has appropriate contractual terms in place with downstream, who may also have access to your data. 

This disconnect creates a high-risk area for all industries as more and more data loss through third-party vendors results in a breakdown of trust and communication. In the Ponemon survey, about half of 600 respondents who were familiar with their organization’s data practices confirmed that at least one of their vendors was the cause of a data breach, and an additional 16% didn’t even know that a breach had occurred. About 60% of respondents said they felt vulnerable because they were sharing sensitive data with third parties that might have weak security policies.

Golden Rule 1: Know where your data lives
Vendor management of data privacy and security is a key component of risk management. As a first rule, you have to know where your data sets are, which vendors have access to the data, and what privacy and security measures are in place to protect it.

Golden Rule 2: Remember Target
The second golden rule, exemplified by the infamous Target breach, is that data security depends on the weakest link in the chain. The 2013 data breach at Target rocked the world when an HVAC vendor in charge of the environmental controls at Target's retail stores was hacked. By gaining access to Target’s IT system credentials, the hacker found an open door to customer data, which was not segregated from its environmental data. Three years after the Target breach, 73% of the Ponemon survey respondents say cybersecurity incidents involving vendors are increasing.

Golden Rule 3: Develop a Plan
If you don’t know where your data sets are, where the data is being transferred, what your primary and downstream vendors are doing with it, or the security measures they have in place, you are overdue for a formal vendor management program. For a comprehensive approach, prepare to:

  • Map your vendors. Data mapping shows you where data resides in your own organization. Use a similar approach to map your vendors, to track who has access to your data, and to uncover areas of greatest risk.
  • Put one department in charge of vendor management. Ask your legal, finance, or compliance department, (not IT or infosec) to be responsible for vendor management. While IT should be involved to follow the data and map data flows to third-parties, an administrative department must oversee that vendor security measures are included in every contract and that internal groups are working together track data that leaves the organization. 
  • Put it in writing.  Specify in every vendor contract who, how, and why each vendor will access your data.
  • Use financial terms to enforce vendor compliance.  As a condition of doing business with you, a vendor must specify measures that protect the privacy and security of your data, and indemnify you against any breach or loss. It’s not worth the risk to work with a vendor that won’t sign a contract that includes these provisions.
  • Audit, audit, audit. Plan regular data security reviews with your vendors, and review your contractual provisions for trouble spots before they become a serious problem. Using security questionnaires is a common practice to audit vendors.

Companies can significantly reduce their risk of a catastrophic breach by staying a step ahead of the bad guys. The best data security approach includes rigorous risk assessment, prudent planning, consistent internal policies, and regular tracking and review of data access by your vendors and their vendor chain. It is possible to do this well. 

Published in Dark Reading, a widely read online cybersecurity news site.