hacker

After a year full of high-profile data breaches of enormous proportions, companies are scrambling to ensure that their internal cybersecurity standards are up to snuff. But they may be overlooking some key vulnerabilities.

A recent survey from consulting group Protiviti and the Shared Assessments Program found that although 42 percent of organizations reported high levels of engagement and understanding from their boards around internal operations cybersecurity, only 29 percent could say the same of their vendor operations.

The survey, which polled 539 company executives and is now in its fourth year, saw a 3 percent increase in both internal and vendor cybersecurity attention from 2016.

The survey also found that organizations are increasingly willing to cut ties with their vendors over cybersecurity concerns. Fourteen percent of organizations polled noted that it was “extremely likely” that they would exit or “de-risk” vendor relationships in the next year, while an additional 39 percent noted that they would be “somewhat likely” to pursue a de-risking strategy.

“What we typically see is that boards naturally focus first on their own security readiness, not the readiness of their partners/vendors,” Cal Slemp, managing director for Protiviti's security and privacy consulting operation, told LTN.

However, Slemp noted that security issues caused by weak vendor cybersecurity standards are starting to bear significant consequences for companies. This has led to a boost in regulatory standards, such as those out of the New York Department of Financial Services (NYDFS) and the Federal Financial Institutions Examination Council (FFIEC), as well as privacy laws.

“Companies are being held accountable for information security throughout their ecosystems. So, it is important that boards include their vendors in the oversight of cyber risks,” Slemp said.

For companies that hope to improve their security standards, Slemp suggested they begin to set up and enforce policies around vendor cybersecurity.

“Maturity in vendor management, like most other definitions of maturity, is a combination of having governance in place [policies, alignment, etc.], processes defined to support the policies, implementation of controls, measuring the control effectiveness and then reacting based on the measurement feedback,” Slemp explained.

For companies considering pulling away from vendors with lax standards, Slemp said there are a few pre-emptive strategies to consider, such as identifying alternative providers and developing exit strategies.

“The common focus items include spreading the same work across providers to instill competition, as well as having contract terms which are more clear on [service-level agreements], security requirements and transition actions/timelines,” he added.

That said, “de-risking” or divesting from vendors can be a tricky process. “It is not easy. It is also not the desired outcome,” Slemp acknowledged. “The old adage of hoping for the best but planning for the worst holds true here. Having an ongoing communication with vendors oriented to objective SLAs, performance scorecards and—in this case—information security expectations/discipline has been effective in reducing the stress.”