CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Organizations will also frequently inherit third-party risks through M&A activity, as seen with the
data breach reported by Marriott International in November 2018. The incident is one of the largest
in history, with the information of more than 500m customers being stolen. However, the breach
originated with Starwood Hotels in 2014 and went unnoticed when the firm was acquired by
Marriott in 2016.
Balancing risk and opportunity
While the increased reliance on digital third-party providers can quickly elevate a company’s
exposure to risk, firms cannot afford to shun digitalization. The flexibility and efficiency created
by digital strategies are essential for retaining a competitive advantage, and is all but impossible
to achieve without the use of third-party providers for cloud, IoT and mobile technology.
This means organizations must be able to balance the opportunities presented by third parties
against the potential threats they may introduce. While companies are well-used to performing
similar analysis for calculating ROI and assessing financial risks, evaluating cyber risks is still a
relatively new and unfamiliar school of thought.
Companies need to ensure that a thorough cyber risk assessment is completed for any new
partner or service provider they take on as a matter of course. More than this however, they also
need to have real-time intelligence on the companies already in their ecosystem. The world of
cyber threats moves so quickly that a previously secure partner could become a potential risk at
any moment. Organizations need to spot potential threats against their connections before they
can come to fruition and lead to an attack.
By analyzing real-time threat activity targeting third parties alongside third-party infrastructure and
vulnerability data, organizations can achieve a more accurate and complete view of risk, enabling
them to understand current weaknesses and evaluate potential impact against the organization.
Searching for risk indicators
To be truly accurate and reliable, threat intelligence must gather data from a number of different
sources, both open and hidden.
One of the most obvious open risks is the use of vulnerable technology. Third parties that rely on
web technology that is often exploited by attackers present an increased risk of compromise for
their partners, particularly if they are failing to keep them patched and updated. Threat intelligence
can also determine if real threat actors are actively targeting vulnerabilities present in a partner’s
technology.
Another clear indicator of risk is the presence of IT infrastructure misuse or abuse. The use of an
IP address hosting a command and control server would present a very clear threat to the firm
and any of its connections.
Domain abuse presents an additional and powerful example that a company is being actively
targeted by cybercriminals and is a potential threat. The existence of lookalike “typo squat”
domains registered to impersonate an organization indicate that it is being involved in a phishing
campaign or targeted attack.