A vulnerability in the file transfer software MOVEit led to a widespread data breach that impacted millions of people worldwide last year.
The incident, which federal authorities attributed to a Russian hacking group, compromised personal data from hundreds of companies and government agencies. Some of the high-profile victims included the U.S. Department of Energy, Shell Oil, and the Johns Hopkins Health System.
The situation was a large-scale example of the many incidents each year where companies suffer data breaches because their third-party vendors have been hacked. In fact, more than 98% of organizations relate with a third-party group that has been breached over the past two years, according to a 2023 report from Security Scorecard.
These situations highlight a concerning reality that all businesses face: As hackers seek out weaknesses up and down the supply chain, your vulnerability to hacking isn’t just affected by your own cybersecurity. It’s affected by your vendors’ cybersecurity, too.
Let’s explore how to properly manage your third-party vendors and vet them to prioritize the security of your customers, your employees, and your business.
Third-party vendors have more access and interconnectivity today than ever before. From software and cloud storage providers to payment processors, consultants, contractors, and managed service providers — there are a host of companies that may have sensitive information related to a single business’s finances, employees, and customers.
While a business may follow all of the protocols, checklists, and best practices when it comes to its own cybersecurity, these connections to outside vendors can leave it vulnerable.
For example, third-party payment processors could have access to information like customer credit card numbers and bank account numbers. A payroll vendor could have access to the private financial information of employees. And your managed service provider has valuable access to IT infrastructure that hackers could use to gain a wealth of your data.
When one of these vendors suffers a breach and it affects your company, it can cause harm to your customers, employees, and reputation — as well as your bottom line. For example, in 2013 a hack of one of Target’s HVAC contractors led to data being stolen from as many as 40 million cardholders, and the cyberattack cost Target millions.
As a business, the first step in managing the risk among your vendors is being proactive. Whenever you hire a third-party vendor, it’s important to make security a focus of your selection process.
Hackers look for weak links all along the supply chain, so businesses with improper security protocols, outdated software, untrained employees, or other vulnerabilities, could lead to breaches that hurt your business and your customers.
Here at 12 Points Technologies, we recommend asking the following questions to your vendors:
The selection of a managed service provider is an especially important decision since these companies perform IT management, security services, data backups, and more.
When working with an MSP, we recommend asking the following questions:
For more information, read our guide, “5 Questions to Ask Before Choosing a Managed IT Service Provider.”
If you learn one of your vendors has been hacked, the first step is to learn more about the breach, determine what data was exposed, and evaluate your risk. Work closely with your cybersecurity professionals to follow your incident response plan, if you have one.
Other steps include:
If it’s your managed service provider that has been hacked, ask them for more information about the scope of the risk and follow their recommendations for how to respond and protect yourself to minimize risk.
Whether you’re vetting your vendors or recovering from a third-party data breach, you don’t have to face the challenge of dealing with these issues alone. Working with a cybersecurity consultant or managed service provider will help you understand your vulnerabilities and point your company in the right direction.
At 12 Points Technologies, we take a security-first approach to all of our services. We offer customizable cybersecurity and risk management services to help you holistically defend yourself against cyberattacks. And unlike some managed service providers, we are transparent about our security practices and work to ensure you know your data is in good hands.
Our services include security assessments to analyze your network infrastructure’s integrity, and vulnerability management services that identify your weak spots, monitor them, and help you fix them.
Reach out to us today to discuss how we could help you strengthen your business’s cybersecurity.
https://www.12pointsinc.com/wp-content/uploads/2024/06/Cybersecurity-Compliance.jpg 1284 1920 webspec_admin /wp-content/uploads/2022/10/Original-600ppi-Updated-2022.png webspec_admin2024-06-26 08:37:002024-09-15 15:42:09Cybersecurity Compliance: What Small & Mid-Sized Businesses (SMBs) Should Know
https://www.12pointsinc.com/wp-content/uploads/2024/06/Penetration-Testing-scaled.jpg 1707 2560 webspec_admin /wp-content/uploads/2022/10/Original-600ppi-Updated-2022.png webspec_admin2024-06-10 08:35:052024-09-15 15:42:09Why Penetration Testing Is Essential for Small & Mid-Sized Businesses
https://www.12pointsinc.com/wp-content/uploads/2024/05/Cybersecurity-Insurance.jpg 1076 1920 webspec_admin /wp-content/uploads/2022/10/Original-600ppi-Updated-2022.png webspec_admin2024-05-08 09:57:312024-09-15 15:42:09How to Choose Cyber Insurance: A Guide for Small & Mid-Sized Businesses