Section 10.90 Third-party Vendor Risks & Supply Chain Risks Flashcards
Objectives 2.2 Explain common threat vectors and attack surfaces. Objectives 2.3 Explain various types of vulnerabilities. Objectives 5.3 Explain the processes associated with third-party risk assessment and management.
Third-party Vendor Risks
Potential security and operational challenges from external collaborators e.g Vendors, suppliers or service providers.
Risk: Impact on integrity, data security, and overall business continuity
Supply Chain Risks 1
Hardware Manufacturers
Products like routers and switches are composed of many components from various suppliers
Rigorous supply chain assessments needed to trace origins and component integrity
Component tampering or untrustworthy vendors can introduce vulnerabilities
Hardware Manufacturers
Secondary/Aftermarket Sources
Risk of acquiring counterfeit or tampered devices
Budget-friendly but high-risk option
Devices may contain malware or vulnerabilities
Supply Chain Risks 2
Software Developers/Providers
Check for proper licensing, authenticity, known vulnerabilities, and malware
Proprietary software can be scanned for vulnerabilities
Open-source software allows source code review
Software developers and software providers are integral cogs in the supply chain however software can introduce vulnerabilities
Supply Chain Risks 3
Service Providers/MSPs
Organisations that provide a range of technology services and support to businesses and other clients
● Data confidentiality and integrity concerns
● Assess provider’s cybersecurity protocols and support for security
incidents
Third-party Vendor Considerations
● Evaluate data security measures
● Ensure confidentiality and integrity
● Assess cybersecurity protocols
● Response to a security breach
