Last time I wrote about the pitfalls of consuming cloud-based services. On the one hand, there is a business need for quick time to market, but there is another way, how we can provide the same speed without sacrificing our security!
If you are interested in the past article, you can read it at the following link:
The main problem I described relates to today's topic - Third-party vendor risk.
Most companies do yearly vendor assessments. In general, this is a formal procedure when the procurement team of the organization sends a questionnaire to the respective vendors and ask them to fill in with accurate information.
There are several elementary problems with these approaches. To find the depth of the problem, we go back to the math classes.
How do we calculate the possibilities of an event?
We calculate the total tries and the number of the expected results.
Let's assume we are flipping a coin; how much chance do we have for a head? 50%
If we have two coins, how much is the probability of seeing a head? 75%
If we think about the used components, we have two situations: Hacked or remain safe.
Assume we have 100 vendors. On average, we use five solutions from the vendors. It is simple math until now, but let's raise the bar!
Let's assume each of these used solutions is composed of twenty various products from twenty providers. And to make life even harder, their used providers are also using providers!
Now at this point, how much of your chance to have a breach?
If we consider those facts, the more used services which have more customers more attracted to hackers it even increases the potential from fifty percent to get hacked.
The picture gets more detailed if we consider how much is on average until the security patches application takes time after the problem is released (there is a patch that can fix the issue) until the patch is deployed. How does it affect the picture?
You can find details on these statistics:
From this information, you can see that if you check your vendors, you just see the tip of the iceberg, not the full size!
Several solutions can be implemented to resolve the problem:
One is: If all your vendors, with their complete dependency tree, give you a transparent risk map so you can fully calculate your actual risks. - It would be ideal, but it seems more like a mission impossible.
Next, if you shorten your dependency tree and segment your risk between different parts of your company.
The only way to have total risk management is if you control the entire chain. With continuous (not only yearly) cybersecurity assessment, with full source code transparency, you have a chance to manage your risk - otherwise, you can also calculate a number that is more like a gut-punch-like estimation.
The question is always is how you can have the same time-to-market as using cloud-provided services
The answer is nearly 70 years old, from the late years of the fifties:
If instead of systems we think about reusable components, we can have the same speed. More a set of components evolve we can have a faster time to market.
The other part of generic components is even older, from the time of the great Greek philosophers:
We tend to forget what we learned in the past, but it is more the postponing of a professional work!
And finally, for closing: Do you believe in your luck, or you want to manage your IT environment? The decision is in your hand!