Pre-Contract: Connectivity

Question 1

Connectivity

Answer 1

Connectivity adds more risk
-open hole in your network. We need to be aware of what they are, even if we don’t have control over who they are.
-Your ability to do due diligence can get complicated.

Relationships are complicated
Types of Connectivity
-Leased-line (from ISDN to P2P to MPLS and on): usually requires a piece of hardware (now sometimes software-only routers) at each end and sometimes in between to route traffic.
Follow-Up: What is the patch management process for
this hardware?
-File Drops: From Box to SFTP to Email
-Web: HTTP or HTTPS
-Screen-Scrapers
-Intermittent Connectivity (hard drive transfers, USB drives, etc.)
-Encryption
-Access Management
-Out-of-Band Devices

*E.g. Business owners will say they don’t have a connection to use but they have data so how are they getting the data? They’re connected.

Question 2

Types of Connectivity

Answer 2

-Leased-Line
-File-Drops
-Web
-Screen-Scrapers
-Intermittent

Question 3

Types of Connectivity:
Leased-Line

Answer 3

(from ISDN to P2P to MPLS and on): usually requires a piece of
hardware (now sometimes software-only routers) at each end and sometimes in between to route traffic.
Follow-Up: What is the patch management process for this hardware?

Leased line is always on.

Question 4

Types of Connectivity:
File Drops

Answer 4

From Box to SFTP to Email

Question 5

Types of Connectivity:
Web

Answer 5

HTTP or HTTPS

Question 6

Types of Connectivity:
Screen-Scrapers

Answer 6

Go to your site and take data off of them

Question 7

Types of Connectivity:
Intermittent

Answer 7

-Hard drive transfers
-USB drives
-Intermitted connectivity once a month
-Most challenging because they’re not always on. You won’t always get a vendor that is open about how often they need to connect.

Question 8

Connectivity:
Access Management

Answer 8

Who has access to the devices and how do they get into those?

Question 9

Connectivity:
Out-of-Band Devices

Answer 9

Most common way we see them is hardware device such as a network router that gives your company access to the internet.
-If the service is off, this gives your vendor the ability to remove access to the machine to get the access back.
-You should have a process that asks for business justification for it, what is the timeline you need it back.
-Generally are not connected to monitoring activity, they are a backdoor. Search out of band device controls.