Every corporation relies on communications and interfaces with other organizations, whether for professional services such as legal or consulting, or for the licensed software items that comprise its internal infrastructure. Of course, we need these channels of communication open in order to work efficiently. But just how safe is it?
When an organization connects a technology with a third-party, it becomes directly dependent on how secure they are as well. This might be as basic as enabling consultants to use a file sharing platform on their work computers in order to better engage with your internal teams.
We inherently trust the data and files on these platforms when we open our environment, but we also expose ourselves to risk. When you open a file sharing or chat platform, for example, you frequently have little control over what information may or will be uploaded. Nonetheless, transmitting harmful files is not typically an intentional decision. Malware may have previously been deployed on the environment of your partner or vendor as a result of a prior breach caused by insufficient security procedures.
To take this a step further, businesses are frequently relying on third parties to handle their own identity and access management systems, resulting in a “federated” security environment. These systems must be effective and up to date, including the removal of any employees who have left the organization. Breaching these vendors in your software supply chain can bring an attacker directly into yours – obsolete credentials and forgotten leavers are a free ticket directly into your environment.
Individual security analysts cannot keep track of all the data and access throughout your dispersed system. The only way to achieve this efficiently is to use artificial intelligence to automate security analytics and defensive actions. We must collaborate closely with our partners and providers until solutions like this are widely available in the market. This implies that the chief information security officer (CISO) and security team should be included in our sourcing and procurement talks, working to eliminate any possible risks and maintaining security policy consistency.
The entire sector has a potential to smooth over these interactions by adopting an objective “cyber hygiene” score, which would provide a degree of confidence between organizations as their counterparts have been set up in a safe manner. We may learn from the Food and Beverage industry’s labeling methods, where ingredients, suggested dietary intakes, and the traffic light system are employed as decision-making tools. Making these sorts of assessments over internal infrastructure should be automated as much as feasible, or else industry-wide deployment will become manual and tedious.
These additional efforts may appear to be difficult or inconvenient, but they are necessary to guarantee that second order hazards are adequately safeguarded. These are the ones that threat actors utilize every day to conduct progressively more sophisticated attacks, resulting in our infrastructures resembling a “house of cards.”
A small amount of suffering now can prevent large-scale disruption and extensive commercial effect caused by these stealthy insider attackers later.