Time and time again, organisations face an escalating threat to their data: third-party breaches. As businesses increasingly rely on external vendors and partners for various services, the security of sensitive information becomes more vulnerable. This poses the question: Are traditional security measures still effective or obsolete in protecting vital information?
There has been a notable increase in third-party breaches, with headlines featuring Snowflake, Santander and Ticketmaster as recent victims. These incidents highlight that vulnerabilities are inherent in our systems, making no organisation immune to such attacks.
Unsurprisingly, 98% of organisations have experienced a third-party breach within the past two years. These breaches can expose critical data, resulting in severe financial and reputational damage. To mitigate these risks and protect organisational assets, it is essential that organisations thoughtfully consider new strategies to defend against third-party breaches and protect our data.
The problem with third-party breaches
A third-party breach occurs when malicious actors compromise a vendor, supplier, contractor or another affiliated organisation to gain access to sensitive information or systems related to the victim’s customers, clients or business partners. These breaches can happen through various methods, including compromised credentials, software vulnerabilities, insider threats and weak security measures. Ultimately, adversaries will always opt for the path of least resistance to achieve their goals.
Third-party vendors are invaluable to any business but also introduce significant risks. Supply chain attacks, in particular, are on the rise, with 62% of network intrusions originating from a third party, often someone within your supply chain. The most alarming aspect of these breaches is their considerable impact.
Organisations have experienced significant disruptions from third-party cyber incidents, with 73% reporting at least one major incident. A notable example is the 2020 SolarWinds breach, where a sophisticated malware program was inserted into its software updates. SolarWinds, which managed numerous companies’ credentials, became an ideal target for a widespread attack.
This breach exposed many organisations to risk due to the extensive use of SolarWinds solutions within the supply chain. As a result, 18,000 customers were impacted. The financial fallout was substantial, with BitSight estimating losses at $90m.
Beyond financial damage, such incidents harm reputations and erode the trust between businesses and their third-party partners.
Many people consider their risk surface to be confined to the domains they directly control, yet they remain vulnerable to direct attacks and insider threats. Your risk area encompasses all the risks associated with the companies you interact with. As the saying goes, “You don’t just marry the person; you marry their family.” This includes customers, vendors, partners and suppliers. The SolarWinds incident affected not only its direct customers but the entire supply chain, illustrating the interconnected nature of these risks. A crucial difference exists between the “known attack/risk surface” and the “unknown but real attack/risk surface.”
In addition, large-scale data breaches have highlighted the urgent need for robust cybersecurity measures. Notably, Ticketmaster, Santander and Snowflake have all suffered significant breaches. Ticketmaster’s breach compromised data for 530 million customers, while Santander exposed personal information for 30 million.
The breached data included full names, email addresses, phone numbers and hashed credit card numbers. Snowflake’s breach, which involved compromised employee credentials bypassing their authentication service, underscores the critical need for secure cloud storage and effective cybersecurity tools. This incident demonstrates that implementing strict security protocols and multi-factor authentication is essential, making Zero Trust not just a preference but a necessity.
Organisations need to implement a comprehensive risk management plan for vendors. This includes thoroughly vetting third parties, requiring accountability, and staying aligned with cybersecurity best practices to remain vigilant against potential threats. This significantly diminishes the size of a breach and its devastating impacts.
Prioritising data protection in a zero-trust model
In the wake of significant data breaches affecting major organisations, it’s clear that traditional cybersecurity measures have become insufficient. A more comprehensive approach, such as the zero-trust strategy, is essential to protect sensitive information. Zero-tru
st is a security framework that requires all users, whether inside or outside the organisation’s network, to be authenticated, authorised and continuously validated for security configuration and posture before granting or maintaining access to applications and data. While zero-trust is often associated with network and access control, it’s crucial to extend these principles to the data layer to ensure data remains protected regardless of its location or access method.
Protecting data before involving third parties is a critical step in enhancing security. If data was appropriately protected at its origin, breaches like those involving Ticketmaster and Santander might never have made headlines. Effective data governance and visibility into data operations are essential for managing privacy and protecting information comprehensively. Additionally, data protection strategies such as encryption, data masking and other de-identification techniques can secure data before it’s shared, minimising the risk of exposure.
The long-term impacts of data breaches can be severe, affecting an organisation’s financial standing, reputation and customer trust. Implementing data de-identification methods like tokenisation, encryption, data masking and anonymisation reduces these risks.
Tokenisation replaces sensitive data with non-sensitive equivalents.
Encryption converts data into a coded form accessible only with a decryption key.
Data masking obscures data to hide its true content.
Anonymisation removes identifiable information.
By integrating these methods into a zero-trust strategy, organisations can better safeguard their data and maintain the trust and security of their digital ecosystems.
In today’s digital age, the increased levels of connectivity come with their share of risks. Third-party breaches pose a significant challenge to organisations, demanding meticulous attention and proactive measures to prevent data compromises. Adopting a zero-trust strategy and investing in robust data protection solutions are critical steps in navigating this complex digital landscape. By implementing proactive measures, maintaining a continued focus on security and committing to data protection, organisations can enhance their resilience and safeguard their data now and in the future. Embracing these strategies will ensure a secure environment where sensitive information is consistently protected against evolving cyberthreats.
Clyde Williamson is Chief Security Architect at Protegrity
"The problem with third-party breaches – a data protection dilemma" was originally created and published by Electronic Payments International, a GlobalData owned brand.
The information on this site has been included in good faith for general informational purposes only. It is not intended to amount to advice on which you should rely, and we give no representation, warranty or guarantee, whether express or implied as to its accuracy or completeness. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the content on our site.
