Why do companies allow third parties to handle their data?
Companies seek out third parties to handle their data for operational efficiency.
The scale and cost of maintaining in-house infrastructure can be outsourced to third parties who specialize in data management or in certain business functions.
Third parties who handle an organization’s data can range from large public cloud providers such as Azure or AWS, to boutique companies who handle specific business functions such as telemarketing, payment systems, or webpage hosting.
The operational efficiencies gained through third-party data management can be summarized by three key benefits:
- Global accessibility: Third-party data storage enables data access across the globe, allowing businesses to access data from anywhere.
- Enhanced collaboration: Third-party data storage allows for file sharing, real-time editing, and integration with other applications and services enhancing a business’s collaboration efforts.
- Reliability and uptime: Reputable third-party storage providers offer high reliability and uptime guarantees, ensuring that data is available whenever needed. They typically have robust disaster recovery and backup systems in place to prevent data loss.
Given these benefits, it is no surprise that businesses are using these services to expand their operations and scale efforts with the need of a growing business. This strategic move not only optimizes resource allocation but also enhances operational agility, enabling businesses to adapt swiftly to evolving data demands and maintain a competitive edge in a dynamic market.
Security risks of entrusted data to third-party vendors
Entrusting data to third parties can expose businesses to supply chain risks and increase the risk of data breaches and unauthorized access. A business has less control over its data and becomes dependent on the third party's policies, practices, and uptime. Many third-party vendors are the target of hackers who specialize in monetizing sensitive data and exploiting gray areas around who is responsible for securing the data.
Thus, businesses are vulnerable when they entrust sensitive data to third-party platforms, which often lack transparency about data usage and security. The platforms, chosen mainly for cost, efficiency, and user experience, are frequent targets for cyber criminals, hacktivists, and opportunistic lone hackers looking for sensitive data accidentally exposed due to misconfigurations or poor data management policies.
Consumers are putting pressure on businesses to improve cybersecurity when handling their personal data. Businesses who suffer a data breach face a high level of scrutiny from customers, investors, the media, and governments, even when the data breach is the result of a third party’s being hacked. For example, Uber made headlines in 2022 for a data breach which was the result of a compromised vendor who had access to data regarding Uber’s employees.
Similarly, the UK’s Ministry of Defence was the victim of a data breach earlier this year when hackers targeted a third party payroll system used by the government department.
Why do cyber-criminals target third parties?
Cyber-criminals can potentially gain access to multiple networks when targeting a third-party storage provider. A successful attack could give attackers access to the networks and systems of all its clients, amplifying the impact of a single breach.
For example, when Illuminate Education was the target of a cyber-attack, the data of 23 US School Districts was stolen via its student-tracking software. It included student data from the country's two largest school systems - New York City Public Schools and Los Angeles Unified School District.
Common third-party security risks
When collaborating with third parties, organizations should be aware of the most common types of security risks posed to their cybersecurity.
- Software supply chain attacks: Software supply chain attacks occur when cyber criminals infiltrate and compromise software products or updates at any point in the development or distribution process. This allows attackers to insert malicious code into legitimate software, which then gets distributed to users through trusted channels.
- Human error: Human error in cybersecurity refers to mistakes made by individuals that lead to security breaches or vulnerabilities. These errors can result from lack of awareness, insufficient training, negligence, or simple mistakes.
- Privileged access misuse: Privileged access misuse involves the inappropriate or unauthorized use of elevated access rights by individuals within an organization. This can include intentionally malicious actions or unintentional misuse of administrative privileges.
What to look for in a security solution when using third parties to store or manage data
Understanding the security posture of a third party is important when partnering with it and entrusting it with your organization’s data. Understanding how basic cyber hygiene policies are implemented is a good place to start, such as data retention policies, use of encryption for data in storage, and how identity and access are managed.
In some circumstances, it is important to understand who is responsible for the data’s security. For example, when using public cloud infrastructure, it is generally the responsibility of the data owner to manage how the data is accessed and stored.
In that situation, an organization needs to ensure it has solutions in place which gives it full visibility of that third-party environment, and which can proactively identify misconfigurations and detect and respond to suspicious activity in real time.
Benefits of using AI tools to aid in managing sensitive data
According to research performed by IBM, organizations with extensive use of security AI and automation identified and contained a data breach 108 days faster in 2023 than organizations that did not use AI for cybersecurity. (1) This figure is only likely to improve as companies mature in their adoption of AI for cyber security and can be a key indicator in the security posture of a third-party vendor.
Example of third-party security incidents
Sumo data breach
Sumo, an Australian energy and internet provider, suffered a data breach which they became aware of on May 13th, 2024. Further investigation into the cyber incident has found that “the personal details of approximately 40,000 customers were compromised, including approximately 3,000 Australian passport numbers.” (2)
While none of Sumo’s systems were allegedly accessed or affected and the third-party application also worked as designed (3), the incident was blamed on an unnamed third party. The breach may have been the result of a misconfiguration or human error.
This incident underscores the importance of not only selecting third-party providers with robust security measures but also continuously monitoring and assessing their security practices.
How Darktrace helps monitor third-party data usage
Darktrace/Cloud uses Self-Learning AI to provide complete cyber resilience for multi-cloud environments.
Benefits of Darktrace/Cloud:
Architectural awareness: Gives users an understanding of their cloud footprint, including real-time visibility into cloud assets, architectures, users and permissions. Combines asset enumeration, modeled architectures, and flow log analysis. Cost insights give a better understanding of resource allocation, helping teams contextualize resources.
Cloud-native detection and response: AI understands ‘normal’ for your unique business and stops cyber-threats with autonomous response. Near-real-time response goes beyond simple email alerts or opening a ticket; and includes cloud-native actions like detaching EC2 instances and applying security groups to contain risky assets.
Cloud protection and compliance: Identify compliance issues and potential misconfigurations with attack path modeling and prioritized remediation steps. Darktrace’s attack surface management (ASM) adds a critical external view of your organization, highlighting vulnerabilities most impactful to your specific situation and revealing shadow IT.
Learn more about securing cloud environments by reading: The CISO’s Guide to Cloud Security here.
References
1. https://www.ibm.com/reports/data-breach
Like this and want more?
![Device Event Log indicating several connections from the source device to the rare external IP address 146.70.71[.]135 over port 80.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/669973708ae3bd007b761051_Screenshot%202024-07-18%20at%2012.55.55%20PM.png)
![PCAP of a HTTP POST request showing streams of data being sent to the endpoint, 146.70.71[.]135.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/669973c9c7e48724389cdff4_Screenshot%202024-07-18%20at%2012.57.50%20PM.png)
