You are no doubt familiar with the recent significant compromise of SolarWinds Orion, a prolific IT system used to perform critical IT security and performance monitoring functions. Of course, SolarWinds was just one of five significant breach or compromise events in the security vendor space recently. The other four:

1. FireEye
2. Zyxel Firewall and VPN Gateways
3. Ubiquiti Portal Breach
4. SonicWall 0-Day

A troubling aspect of the SolarWinds breach is that the extent of its proliferation may never be known. US-CERT is still dropping updates and analysis of the intrusions.  It was propagated via the standard SolarWinds software update process, and the malware enabled multiple attack types for threat-actors, throughout the supply chain.

When was the last time you questioned the security of vendor patching and updates? Unfortunately, it is time to update that little-examined sense of trust and convert it into risk intelligence.

These breaches highlight at least two important considerations for today’s organizations as they outsource more core business functions to third-party vendors:

1. What happens when security vendors fail at security?
2. What are we doing differently to manage increasing third-party risk to align with the cloud migration of our infrastructure and core business functions?

The short answer to the first: If your Defense in Depth control layers are well implemented and your patch management program is sound, you should have adequate protection to remain safe while you decide what to do about the specific vendor that suffered a failure. If the failure was not severe enough to warrant a change, at least it should trigger a deeper dive into that vendor’s operations. If it is an event of such severity that it makes change necessary, there are multiple vendors in the security space, at each layer of defense, and replacing one is not likely to have significant impact on customers or business operations.

But let us take a step back and focus on the larger picture of third-party service provider management: If your due diligence process and larger vendor management program have not undergone some evolution over last 5 years, then you are overdue for a review.

A chief aspect of that review is to determine if we know enough about the Software Development Lifecycle (SDLC) of our critical vendors, and especially those hosting our core business functions and providing one or more security functions. To learn what needs your attention, and what questions to ask, click here to download Monarch’s free Guide to Vendor SDLC Due Diligence.

We have seen 3rd party due diligence processes mature rapidly over the past 6 years for clients in financial services. This is because after Target, which was caused by a vendor compromise, the FFIEC issued guidance directing banks to pay much closer attention to service providers. We should all move third-party risk management up the priority order in our information / cyber security programs. Our change management practices will also have to evolve. We need a clearer understanding of our systems’ normative behaviors so we can more readily identify anomalous activity during the testing phase of our patching and updating processes.

When upgrades/updates/patches are significant, consider a more robust testing regimen prior to roll-out. Consider the following when making changes:

• The logic-bomb in SolarWinds’ compromise waited 2-weeks to execute, helping the malware evade discovery during the initial testing phase of patch deployment.
• Altering patch/update deployment timelines may be justified in light of the challenges that come with trusting third parties with our critical operations and legally protected information under our management.
• Network monitoring added to testing processes can identify anomalous data traffic and help us note any deviance from baseline.
• Always make it a risk-based process.

These events can merely remind us that everyone is vulnerable to the right attack by the right perpetrator; or they can motivate us to go beyond the conceit. That means creating and sustaining quality protections across the layers of preventative and detective controls in our environment. Finally, we need to assess when we should be segregating security layers, such as security testing and security monitoring, for instance, to ensure we have inter-vendor oversight that is an organic aspect of our careful strategic security design.

Vigilance is required because cybercriminals are innovative. They have demonstrated they know how to continue to win with old techniques as well as develop and use new strategies and techniques to stay at least one step ahead. Getting to know our vendors better is incumbent upon us, to put our efforts where we know they will identify and reduce risks we face, every day.