The evolution of cybercrime is multi-faceted – from social engineering integrating targeted spam and phishing attacks, to insider threats and vendor vulnerability.
It’s becoming an intertwined network that’s increasingly difficult for CIOs, CISOs, and IT managers in organisations of all sizes to appraise and manage.
Despite an awareness of vendor vulnerabilities, there’s a gap in many organisations’ ability to limit their exposure and response to cyber-attacks that stem from vendors.
Many organisations have effective and sophisticated security measures to manage threats directly from outside-in. However, many struggle with managing more convoluted attempts to enter a network, for example hackers piggy-backing on third-party vendor access credentials.
Third-party vendors play a vital and growing role in supporting organisations’ systems, applications and devices. Recent research by Bomgar revealed that, on average, 89 third-party vendors access a typical company’s network each week, and that number is likely to grow.
>See also: The Security of Things: IoT and cybercrime
Three quarters of those polled stated the number of third-party vendors used by their organisation has increased in the last two years, and likely to continue further in the next two years (71%).
However, there’s often a high level of trust within an organisation for third-party vendors, but poor visibility over what they’re doing when connected to the company’s network.
The cocktail of dependence, trust and minimal control has developed into the ‘perfect storm’ for security breaches across companies of all sizes. If a hacker can pose as a legitimate vendor or partner when accessing a network, unmonitored access to an organisation’s network can be achieved.
This can take place for weeks or even months giving them time to act as they please within a network, potentially stealing sensitive data or even bringing whole critical systems to a standstill.
We can draw reference here to a high-profile case of vendor vulnerability took place in 2013 with US retailer Target. Hackers obtained access to the Target network via a third-party air-conditioning company, which had unrestricted and unmonitored access to Target’s network.
Integrating malware into the payment system of its stores, through an unsecure vendor network, the hackers stole details from credit cards used at the company’s 1,797 US stores during a crucial holiday period.
This totalled 40 million credit card numbers, 70 million addresses, phone numbers, and other pieces of personal information, costing the company $252 million and significant reputational damage.
What is key to note here is that it’s not just US retailers utilising vendors such as Target that are at risk. The estimated cost of cybercrime to the UK is estimated at £27 billion per annum, with £9.2 billion per annum stemming from the theft of intellectual property (IP) from UK businesses.
This serves as a widely understood example of why tighter access management must be demanded from IT leaders – and if solutions such as this had been in place, this costly hack could have been reduced, if not avoided all together.
As highlighted, a high proportion of cyber-attacks are due to weak access points within IT networks that can be exploited by hackers, providing them with a clear path into an organisation’s IT infrastructure.
>See also: Beyond personal data – is cybercrime a threat to health and safety?
To alleviate vulnerabilities from third-party vendors, implementing privileged session and account management (PAM) solutions can allow the monitoring and control of all access to IT systems, and limit access dependent on a user’s profile or to approved specific access requests.
They ensure an organisation can understand, monitor and control who is accessing what on their network, reducing the impact of a detrimental breach.
Protecting a company’s most critical assets from the evolving future of cybercrime has never been more critical. With a lack of ability to granularly control access and establish an audit trail of who is doing what on its network, an organisation cannot protect itself from third-party vulnerabilities.
By ensuring access is secured, businesses can reap the benefits of utilising third parties and harness the possibilities of today’s inter-connected world.
Sourced from Stuart Facey, VP EMEA, Bomgar
