Third-Party Compromise

Description

Third parties often hold VPN access, support accounts, integrations, API keys, access to data, or the job of maintaining systems. If they are less well protected than the organization they reach into, they become the easier target and the bridge to a more serious one.

This risk is hard because it does not end at the company's own infrastructure. An organization can have solid internal controls and still depend on somebody else's password, somebody else's laptop, somebody else's EDR, somebody else's segmentation and somebody else's understanding of an incident.

Examples

• An attacker compromises a smaller IT service provider and uses its account to reach a large client's network.
• An HR agency serving a number of smaller companies is compromised, and the data of many clients leaks with it.
• A software vendor's technical support account is used to get into customers' internal systems.

Notes

• Trust in a supplier must not mean unlimited access. A partner is given what the work requires, not what is easiest to configure.
• A third party is part of your risk even when it is not part of your organization.