Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

Third Party – Minimizing
Organizational Exposure by
Mitigating the Wild Card in
Security Strategies
2019 Shared Assessments Third Party Risk Management Toolkit Helps
Organizations Replace FUD with Actionable Insight, Risk Management Best
Practices and Invaluable Tools.
by Catherine A. Allen, Chairman and CEO
The Santa Fe Group
The list of major data leaks caused by third parties
grows almost daily. Third party vulnerabilities,
exposure incidents and hacks have been at
the root of many of the last three years’ most
troubling breaches.
“Third party IT security risks can cause millions
of dollars in loss and damage, and possibly
irreparable harm to an organization’s reputation,”
said Glen Sgambati, risk management expert
with Early Warning Services.
Bad actors are increasingly organized, wellfunded,
determined and patient. They’ll apply
the time and resources to successfully breach
their chosen potential victim. They occasionally
strike for political reasons, but more often their
goal is financial gain.
The IT infrastructures of partners and other
trusted third parties are one of a cyber criminal’s
preferred pathways into a chosen target’s domain.
This burdens organizations with thoroughly
assessing and addressing the potential risks
and vulnerabilities of all partners, vendors and
other third parties, as well as their own in-house
vulnerabilities – an overwhelmingly broad
intelligence-gathering mission for even the
largest company, given the inventiveness and
diligence of bad actors.
Diligence obligates that the C-Suite ensure that
their organizational risk management strategies
and practices anticipate and manage the full
spectrum of risks that result from interactions
with physical and digital ecosystem partners,
while sustaining the agility to adapt to the
ever-changing threat landscape. Assessing
and addressing the current state of corporate
readiness and minimizing the organization’s
exposure to unplanned events and their
consequences is crucial.
Many of the world’s top financial institutions,
energy and critical infrastructure entities,
consumer goods corporations, manufacturers
and security-minded organizations of all sizes
combat the problem together as part of the
Shared Assessments member community.
The member-driven consortium leverages the
collective intelligence and risk management
experience of a diverse cohort of practitioners,
spanning industries and perspectives. The
‘intelligence ecosystem’ produces independent
research, and drives best practices, tools
and certification standards that are used by
thousands of organizations.
Cyber Defense Magazine - Annual Print Edition 2019 101