Unfortunately, when hackers and cybercriminals can’t go straight to the source and infiltrate their targets’ networks and systems directly, that often isn’t the end of the attack effort. Malicious actors increasingly target organizations’ supply chains’ weakest and most vulnerable points, uncovering entry points through third-party service providers. While organizations are right to prioritize their internal cybersecurity efforts, not designating the same attentiveness to third-party risk management can lead to disastrous results.
Reuters reported a notable attack in 2021 that they claimed had “set off a race to hack service providers.” Kaseya, a company that provides software for managed service providers (MSPs), experienced a ransomware attack leveraging a vulnerability in its VSA software. The attackers, associated with the REvil ransomware group, exploited this vulnerability to distribute ransomware to Kaseya’s customers and clients. The attack impacted approximately 1,500 businesses worldwide, including many small businesses that relied on MSPs using Kaseya’s software for IT management.
In one of the farthest-reaching breaches on record, a cybercrime gang abused a zero-day exploit on Progress Software’s popular file transfer service MoveIt Transfer. Even with releasing a patch the same day, the attack affected more than 2,000 organizations and more than 62 million individuals. Nearly 1,700 of the 2,098 known victim organizations were compromised through third parties rather than directly as part of the MoveIt campaign, including private companies, U.S. government agencies, healthcare providers, and more.
In one of 2023’s most notable ransomware attacks, MGM Resorts and Caesars Entertainment had operations disrupted so severely that the attack caused a $100 million hit to the companies’ quarterly results. The incident stemmed partly from social engineering efforts focused on third parties with privileged remote access to the hotel and casino environments.
According to Prevalent’s 2023 Third-Party Risk Management Study, 71% of respondents ranked a data breach or security incident as their chief third-party risk concern due to poor vendor security practices. Awareness appears to have reached an all-time high, with only 4 percent of companies reporting that they didn’t monitor third-party breaches. At the same time, 41 percent of respondents reported experiencing a breach or similar security incident with a tangible impact in the past 12 months.
Effectively managing third-party risk throughout an organization’s extended supply chain and vendor relationships can be difficult, especially for larger organizations with hundreds to thousands of vendors. However, organizations can proactively seek out potential risks and better prepare for incoming cyber incidents by conducting regular third-party risk assessments and vendor evaluations. The following periods are good for performing third-party risk assessments.
Establishing a standardized process to consistently monitor, manage, and mitigate potential third-party risks is important. Viewing all existing and potential vendor relationships through structured processes and standardized questionnaires can help organizations make smarter risk-based decisions with all third parties.
Navigating the third-party vendor risk lifecycle can be a challenge, especially for growing organizations reliant on external providers’ services to scale and maintain operations. Risk assessments must be efficient with minimal disruptions, making managed service providers or other third-party risk analysis solutions popular options.
The RAMPxchange marketplace gives organizations a trusted source and resource for connecting with highly rated providers and third parties wholly committed to strong, risk-free cybersecurity. Reach out to a RAMPxchange representative today to join and learn more about the potential partners who can help manage your organization’s third-party risks.