Page 264 - Cyber Defense eMagazine August 2024

Notably, many companies don’t utilize this method. In one recent survey of over 2,500 companies, 29%
of senior executives reportedly don’t assign a risk score to each vendor. An additional 13% admitted they
don’t use any third-party risk management system, highlighting the opportunity for widespread adoption.

Decision-makers should look to guidance like the International Organization for Standardization 28000
to learn how to reduce security risks or the National Institute for Standards and Technology SP 800-161
to manage supply chain threats. These standards can help them recognize what to prioritize and how to
proceed.

Best Practices for Handling Third-Party Insider Threats

A zero-trust architecture is quickly becoming fundamental to cybersecurity. Leveraging it can minimize
companies’ insider threat risk and reduce the scope of potential damage. Giving supply chain vendors
the minimum amount of access needed to do their jobs prevents them from having opportunities to cause
problems.

Another best practice is to leverage encryption. While typical techniques minimize the damage negligent
and inadvertent insiders can do, format-preserving encryption (FPE) prevents malicious actions. Its
ciphertext is the same form and length as the plaintext, allowing vendors to perform operations on data
without reading it or possessing a decryption key.

Decision-makers should also consider developing an incident response strategy to address internal
threats as soon as the IT team detects them, minimizing the scope of damage. Outlining the grounds,
limitations and implications of such action in contracts would help them escalate as necessary while
giving vendors a reason to comply.

Insider Threat Mitigation Is an Ongoing Process

Human error and disgruntled employees are a natural part of doing business. In other words, insider
threats will always exist, no matter how often the IT team addresses them. While this fact may seem
discouraging, it is a reminder to stay vigilant — threat mitigation is an ongoing process that evolves with
time.

About the Author

Zac Amos is the Features Editor at ReHack, where he covers cybersecurity and
the tech industry. For more of his content, follow him on Twitter or LinkedIn.

Cyber Defense eMagazine – August 2024 Edition 264
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.