Blog

It’s time for Vendor Risk Management (VRM) strategy to evolve. Emerge from a compliance-based, point-in-time assessment to continuous, internal security-based, vendor risk monitoring and management.

Imagine this. While in your efforts to assess the cybersecurity posture of your vendor ecosystem, you’ve compiled a compliance report with vendor score ratings. After a month or so of reviewing reports, you breathe a sigh of relief believing you’ve created a complete picture and understand the potential risks. You’d like to think its enough, but is it? Well, not according to industry experts.

Modern risk management, a recent Gartner e-book said, must account for ongoing changes in third-party relationships and mitigate risks in an “iterative way” or continually, rather than solely at specified intervals. Here are two paradigm shifts needed to make that happen and better manage the weak link in enterprise cybersecurity, third-party risk:

1. Move from point-in-time assessments to ongoing, dynamic, and continuous measurement.
2. Supplement assessment and third-party scoring tools with actual, direct security evidence.

Security teams seeking to graduate to continuous vendor risk monitoring should consider a deception-based approach. It will equip your organization with relevant data about how vendors are behaving in, and around, your network in real-time. Furthermore, it will provide “early warning” indicators if the behavior is potentially harmful.

How about an example or two? You are doing business with a specific office of a global organization, but other entities from that company are scanning your external network. Maybe a trusted vendor that you’ve allowed behind the firewall is inexplicably scanning parts of your network. Wouldn’t you want to stop them? Our Vendor360 solution creates a lightweight, agentless way to help detect anomalous vendor behavior. It takes action to prevent breaches or exfiltration of critical data.

Quick-start Guide to Risk Management

The Department of Energy also points to continuous risk monitoring as a need in this Quick-start Guide to Risk Management*:

• During implementation, map applicable policies to identify areas of focus and potential gaps.
• Use manual and automated monitoring of individual policies to measure ongoing effectiveness at a granular level.
• Create reports at multiple tiers to identify effectiveness at different levels of the enterprise.
• Feed continuous monitoring data into risk analysis solutions.
• Utilize quantitative risk to prioritize weaknesses and determine appropriate mitigations.

Is your organization looking for a way to protect against a vendor-related breach? Do you want to enforce policies around how your vendors behave on your network? Either way, we can help. Ask us about continuous vendor risk monitoring with Deception360 VRM.

^{* U.S. Department of Energy Office of Scientific and Technical Information and Sandia National Laboratories Report}