CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Why threat intelligence is the key to defending against
Third party risks
By Karen Levy, Senior Director of Product and Client Marketing at Recorded Future
As the march of digitalization continues at an increasingly rapid pace, the business world has
become steadily more complex and interconnected. Organizations now routinely rely on a
widening web of suppliers and partners, often trusting them with sensitive data and mission critical
systems.
The advent of cloud-based services in particular has had a powerful effect on the way businesses
operate, with an endless array of cloud-based service providers now available to meet practically
any requirement. The adoption of IoT devices and mobile-centric working practices have likewise
simultaneously created both more opportunity and more complexity.
While this new interconnected world has unlocked powerful new strategies and business models,
it can also drastically increase an organization’s exposure to security risks. Cybercriminals often
use third-party service providers as a stepping stone to attack larger companies, exploiting their
connections to evade the ultimate target’s security measures.
The growing third-party risk
Marking the scale of the problem, leading analyst group Forrester reports that third parties were
the cause of 21 percent of confirmed breaches in 2018, up from 17 percent the year before. This
figure is only likely to increase as organizations continue their digital transformation journey and
incorporate yet more third-party elements into their operations.
Some of the most notable security incidents of the last year were the result of third-party
connections. The data breach reported by Ticketmaster in June for example was made possible
by exploiting a flaw in JavaScript supplied by a third-party developer. Credit card details belonging
to more than 40,000 customers were exposed as a result.