CISOs Can Learn from Musk Oxen - Third-Party Risks Explained

What Happened

CISOs face significant challenges in managing third-party risks, which can lead to severe business consequences if not addressed properly. Recent cyberattacks on third-party vendors, such as the one involving the Russian hacker group APT29 targeting TeamViewer, underscore this risk. Despite not using TeamViewer, companies rely on numerous similar tools, raising concerns about potential vulnerabilities.

Who's Affected

Almost all organizations depend on various third-party vendors integrated into their software supply chains and business processes. This reliance can involve hundreds or even thousands of partners, increasing the risk of cyberattacks. The stakes are high, as a breach in a single vendor can disrupt critical business operations.

The Threat

The inherent risks of collaborating with third-party vendors are exacerbated by several factors:

• Limited Transparency: Vendors often provide outdated information, failing to reflect their current risk posture.
• Increased Complexity: Many vendors work with subcontractors, complicating the risk landscape.
• Underdeveloped Processes: Some vendors may not have robust cybersecurity policies, putting client organizations at risk.
• Lower Investment: Many vendors allocate limited budgets to cybersecurity, affecting the security of their services.

Tactics & Techniques

Despite the development of best practices and playbooks, many organizations struggle to effectively mitigate third-party risks. Vendor assessments often become mere checkbox exercises, and contractual negotiations for stricter security requirements frequently fall short. Continuous monitoring and incident response plans are useful but do not fully address the underlying risks.

Defensive Measures

The author proposes a 'Musk Oxen Strategy' for CISOs to improve third-party risk management. This approach emphasizes collaboration among organizations to create a protective network around vulnerable vendors. Key steps include:

1. Identifying high-risk vendors and creating a 'Hot List'.
2. Sharing this list with other companies to identify common concerns.
3. Negotiating collective security measures for these vendors, enhancing overall security.

This strategy mirrors how musk oxen protect their young by forming a circle, with stronger members on the outside. By working together, organizations can better shield themselves from potential threats.

Conclusion

While the Musk Oxen Strategy may raise legal concerns regarding competition, it has the potential to significantly enhance third-party risk management. By fostering collaboration and support among organizations, CISOs can create a more secure environment against the ever-evolving landscape of cyber threats.