Most organizations are aware that when they start a relationship with a vendor, partner, or contractor, they effectively take on that third party’s attack surface. Big breaches from Target (2013) to Okta (2022) leave no room for debate that actions undertaken by a third party can lead to serious consequences down the supply chain.
What organizations may be less likely to consider is that bringing on third-party partners also means absorbing the attack surface of their vendor’s vendors, and their vendors — and so forth.
Cascading risk, or Nth party risk, is the new reality in our highly connected, partner-dependent world. Third-party access already presents a significant risk that many organizations are struggling to effectively mitigate; when cascading risk is taken into account, it becomes painfully clear that organizations simply cannot afford to continue granting implicit trust, admin-level permissions, and wide lateral access to their third-party vendors and partners.
For these reasons, all third-party users should be regarded as high-risk users, and their access should be secured and controlled accordingly.
Cascading Risk by the Numbers
Recent research illustrates the depth and breadth of cascading risk. Here are some key statistics:
Put in the simplest terms, cascading risk is like a contagion. It can spread through the slightest direct or indirect contact and quickly becomes impossible to control. Plus, the greatest risk doesn’t always come from high-level users. The Target breach began with an HVAC contractor, and Okta was compromised through a customer support contractor.
The Challenge of Securing Third Parties, Fourth Parties, and Beyond
Securing third-party vendors is hard enough, and the challenge only escalates with each degree of separation. And remember - whether a breach occurs in the vendor ecosystem or the software supply chain, the first-party organization remains liable for any regulatory, financial, and reputational damages.
Organizations can’t extend controls to third- and fourth-party vendors
While organizations can dictate policies and manage devices for in-house employees, they typically can’t enforce the same level of control over vendors. Shipping managed devices or forcing vendors to install agented solutions (such as VPNs) on their own devices is costly and can slow down productivity. When it comes to fourth-party vendors and beyond, the idea of maintaining any sort of control over devices or user behavior becomes implausible.
Third- and fourth-party vendors aren’t always required to disclose vulnerabilities and breaches
In most countries, disclosure laws at the state/regional and federal level regard the first-party organization and its end customers, and they usually focus on sensitive customer data like social security numbers and banking information.
However, a majority of laws require vendors to merely disclose the fact of the breach. Sometimes, a third-party vendor who’s experienced an incident can’t or doesn’t even supply enough information for their customers to meet disclosure requirements — and fourth parties fall under even less obligation.
The bigger hole, though, is that vendors are not required to disclose breaches regarding unprotected information, like source code or internal systems, even though these breaches pose an equal threat to first-party organizations.
Organizations can’t control everything
At the end of the day, even if an organization could secure access beyond third parties, how far would they go? Fifth parties? Sixth parties? Tenth parties?
Extending the perimeter this far clearly isn’t feasible. Even when it comes to creating deny and allow lists, it is impossible to foresee all adverse situations. Meanwhile, vendors often demand significant access to avoid barriers to the job they’ve been hired to do.
Solving the Epidemic of Cascading Risk
Recovering from an illness takes time, but preventing the infection in the first place is a far more effective course of action. This holds true for cascading risk as well.
Audit existing vendor relationships
At any company, but especially at the enterprise level, the vendor ecosystem can become very complex. Organizations should have a standard process for offboarding vendors when the relationship ends, and they should perform regular audits of accounts and access controls, particularly those provisioned for third-party users.
Of course, profiles for ex-vendors, or their former employees, should be decommissioned.
Evaluate vendor risk before the start of a relationship
When taking on a new vendor, many companies take the vendor at their word and reputation when it comes to security. Similarly, most contractual obligations are reactive to a breach, not preventative. Third parties are both a bridge and a barrier to fourth parties, and organizations struggle to gain visibility into the vendor’s own vendor network.
Evaluating the security of a vendor will look different from one organization to the next. However, at a minimum, organizations should require potential vendors to complete security questionnaires that assess their security and privacy controls. This questionnaire should ask what fourth-party vendors have access to systems that could potentially contain sensitive information from the organization.
In this questionnaire, organizations would do well to ask how the third-party vendor is protecting themselves from their vendors. Third parties should audit their relationships, run regular vulnerability scans, and maintain a well-run patch management program.
Move toward zero trust
Organizations can’t expand their own perimeters to include fourth parties and beyond, but they can adopt the zero-trust security model as a means of hardening the walls around individual users, systems, and assets. On the whole, zero trust decreases an organization’s reliance on factors and behaviors beyond its control.
By enforcing zero-trust access for all third-party users, organizations gain greater visibility and control over these connections, as well as the ability to tailor more granular permission sets for them. When third-party users are connecting to sensitive internal systems exclusively via secure zero-trust access, the risk posed by fourth and fifth parties naturally declines.
Security vs. the Bottom Line
Traditionally, security and the business’s bottom line have conflicted, at least from the perspective of leadership. Third parties have a significant impact on productivity, and when security slows a vendor down, it hurts the ROI of the relationship.
However, with proper vetting and a well-implemented zero-trust strategy, security leaders can secure the company — saving it from the compliance fines, insurance costs, and reputational damage of a breach — while still supporting the business’s financial mission.
To learn more about securing third-party access and overcoming cascading risk, read our recent white paper, “Conquering the 5 Biggest Hurdles of Third-Party Access.”
