VENDOR MANAGEMENT An Update & Discussion

Transcription

1 VENDOR MANAGEMENT An Update & Discussion

2 Ground Rules TO ENCOURAGE FREE DISCUSSION, NO RECORDING DEVICES OF ANY KIND INCLUDING CELL PHONES, CAMERAS, ETC, ARE ALLOWED NO EXCEPTIONS VIOLATORS WILL BE ASKED TO LEAVE AND BANNED FROM FUTURE PARTICIPATION Plato: Wise men speak because they have something to say; Fools because they have to say something.

3 AGENDA Evolution & Foundation Public Breaches Third Party Third Party Supply Chain Performance Financial Sector Regulatory Sector How? Out of Scope Life Cycle

4 Evolution & Foundation Gramm-Leach Bliley FFIEC: OCC, FDIC, FRB, NCUA Federal Trade Commission FACT ACT Payment Card Industry (PCI) OCC Bulletin Managing Third Party Risk

5 Public Breaches Third Party Target: Public sources intertwined with Krebs On Security Blog s/-and-breaches/target-hackers-tapped-vendorcredentials/d/d-id/ Dairy Queen, Home Depot Backend POS

6 Public Breaches Third Party (Continued) It also disclosed 53 million addresses were stolen Aside From Network Compromise, What Else Is Missed? Why? Audit & Assessment Scope d5a10618b5&e=26dc6f8709 Homeland Security Background Check Database Breached At USIS, Third Party Background Check Firm

7 Third Party Supply Chain Third Party Product Bundling Made IBM Vulnerable: curityweek+rss+feed%29 FTC faults Web privacy firm at 2F11%2F19&id=Ar02809 Payment Gateway Breached: =buffer Third party risks affecting automotive manufacturers Lessons Learned? Facility infrastructure overlooked by regulators, PCI, SSAE 16 Facilities infrastructure viewed first as availability risk rather than network risk vector

8 Financial Sector OCC Bulletin Third Party Risk Operational Risk CLOUD, SaAS, COLO, Guilt By Association General Connectivity (no data sharing) Social Media Netflix/SEC Dodd-Frank and Data Governance Confidentiality & Integrity Purity & timeliness of Data Supporting Executive Info System Development Life Cycle (SDLC)

9 Regulatory Sector pdf million-fine-the-fcc-is-leaping-into-data-security-for-the-first-time/ SEC Examinations: What to Expect When the SEC Is on Its Way -Wall Street & Technology DT_WST_daily_ &elq=67ba52d6cc4c f114d8f2fc4 &elqcampaignid=11105

10 How? Questionnaires: FISAP Reliance On SSAE 16 SOC Reports/AIT Who Defines Scope of Controls & Pays For Attestation? Ssae%2016&s=Site%20Content&start1=0&ct=Site&cs=Searc h&scopes=people,site%20content,conversations ISACA Vendor Management Vendor%20&s=Site%20Content&start1=0&ct=Site&cs=ISAC A&scopes=People,Site%20Content,Conversations NIST, PCI, SANS & ISO

11 How? (Continued) d_party_security_assurance.pdf PCI_DSS_V1.0_Best_Practices_for_Implementing_Security_Awareness_P rogram Onsite Assessments Validate Infrastructure Policies & Procedures Security Settings & Change Management Records Vulnerability Management Program Network Scans Patch Management Independent Third Party Network Penetration Testing Vendor Score Cards

12 ONLINE & THIRD PARTY TOOLS

13 END