- In this lesson 6.2,
we're gonna focus
on third-party and supply-chain threat vectors.
Now, in the last lesson, 6.1,
we looked internally at operational vectors.
Here we're looking at our third parties, our fourth parties,
and our supply chain.
So what is a third party?
Third parties include vendors,
managed service providers we refer to as MSPs,
business partners, consultants, and contractors
that in some way interact with our systems or with our data.
Now, fourth parties are vendors
that a third party sources through.
And there are a number
of pathways to exploit that are inherent
in our third- and fourth-party relationships.
And they manifest, really,
as really significant risk to the organization.
What can be the consequences?
Financial loss, reputational damage, inefficient operations,
a data breach or data exfiltration, service disruption,
and regulatory non-compliance.
What we want to include
in our discussion also, our supply chain.
A supply chain is the entire ecosystem
of organizations, processes, people,
and resources involved in providing a product or service.
Pre-pandemic, many of us didn't pay a lot
of attention to the supply chain,
but boy, we learned some hard lessons
in the pandemic about supply chain disruptions
and other supply chain issues.
That supply chain represents the steps it takes
to get a product or service from inception to the end user.
That end user could be a consumer or an organization.
One of the biggest challenges
in trying to manage or understand the supply chain is
that an organization very inoften has a direct relationship
with supply chain vendors or components,
or have a communication conduit to their supply chains
and really are dependent
upon the vendors that have those relationships.
So we're gonna start
with a third party threat vector survey,
and then we're gonna dive deep just like we did
in the last lesson.
We're gonna dive deep into each one of those threat vectors.
So issues, lack of support, end of life and end of support.
We talked about that in the last lesson
and we're gonna talk about it again,
because it is so important.
Proprietary configurations, system sprawl,
undocumented assets, supply chain dependency,
supply chain disruption, and supply chain non-conformance.
So lack of support from a third party
or ultimately a fourth party is really a significant issue.
The lack of support stems
from either getting an inadequate service
from that vendor or unknowledgeable support personnel
at that vendor,
or there's a deficient warranty,
or they're just plain old unresponsive.
What's the impact?
Well, we have downtime, potentially,
we get problems that aren't resolved,
and vulnerabilities that aren't addressed.
So what should be our response?
Well, first of all, due diligence,
which is the investigation of a vendor or any relationship
before we enter into a contract or any type of of agreement.
And then we wanna continue to do that investigation, right?
And analysis really through the life of the relationship
and particularly at any type of contract renewal time.
And then having SLAs
or service level agreements to codify service
and support requirements and expectations.
Again, both of these topics
are things we're gonna be talking
about in just a little bit.
Next, we're gonna talk about end of life and end of support.
Now, I know we've already talked about this already
but this is such an important topic
with such significant ramifications
that it's worth talking about again.
So what's the issue?
The issue is that we have a product or service
that's either at EOL, end of life, or EOS, end of support.
The EOL, end of life, is the date
when a product, service,
or subscription is determined to be obsolete.
So no new features or new functionality is going
to be developed for that product.
End of support is the last day
to receive applicable service and support.
So you can't call for help anymore.
And really importantly,
there will be no more vulnerability management going on,
no more patches being released.
So what's the impact?
Well, we could have problems not resolved,
no new features or functionalities,
and vulnerabilities not addressed.
And that's the big one.
Vulnerabilities not addressed.
End of life and end of support systems
are absolutely opportunistic targets, right?
If this attacker knows that you're running something
at end of life or end of support,
that's really a fabulous pathway for them to attack you.
So the response, having good agreements and contracts,
having refresh policies and standards.
Refresh policies really refer
to how often are we going to refresh
or turn over our devices, our hardware, our software.
And then resource management
and of course budgeting appropriately.
So having the right budget allocation.
But so often in the field I hear,
"Why can't I just continue
"to use the software or hardware,
"even though it's post EOL or EOS,
"if it's meeting the organization's needs
"and it's functioning properly?"
It's like, "I love this software,
"why can't I keep using it?"
Or, "This hardware is working great,
"why can't we keep using it?"
Well, here's why you can't,
and here's the message you need to deliver
in your organizations.
The adversaries will continue to identify
and exploit vulnerabilities.
And almost every regulation requires
that organizations take reasonable steps to protect the data
and systems that are under its control.
And not doing so would be a compliance violation.
You'd also have exposure to litigation
for not upholding the standard of due care.
Due care is really defined as kind of reasonable actions.
You would've risk of downtime
due to lack of support or service resolution,
and really likely would be incompatibility
with newer operating systems, applications and hardware.
So we absolutely wanna discourage using any type of hardware
or software post-EOL or at very worst post-EOS.
Another issue we face
in organizations is proprietary configurations.
We may have hardware, software devices
inside our infrastructure that we don't own
and we don't manage.
And those configurations are considered proprietary
if in fact we can't manage them.
We're the user organization.
And so the impact could be unknown exposures
or vulnerabilities that aren't addressed
in a timely manner
and also an inability to update those systems.
So our response, agreements and contracts.
We wanna have right-to-audit agreements,
we wanna have interconnection security agreements,
ISAs that we use
to document technical requirements and responsibilities.
So an ISA agreement says, "Okay,
"who is responsible for managing this device?
"Who is responsible for patching it?
"Who is responsible for configuring or reconfiguring it?
"Who is responsible for fixing it if it breaks?
"Who is responsible for replacing it if it's not fixable?"
All of that would be
in our ISA, our Interconnection Security Agreement.
Another issue is system sprawl.
System sprawl is often the result of non-standardization
or decentralization where we have multiple vendors
who are installing stuff,
we have departments working with different vendors.
We may end up with incompatible platforms
and we may just have some unmanaged growth.
The impact of systems sprawl would be a support burden
and the inability to enforce our security requirements.
Our response, having really good vendor security strategy
and standards and of course configuration management.
Have you noticed how many
of these things have come back to configuration management?
Next is undocumented assets.
These are assets that are in our environment
but we don't have any record of them.
So undocumented assets
are not inventory recorded or tracked.
It may be that a user brought something in,
it may be that a vendor brought something in,
so our third party who's working
inside our organization maybe brings their own laptop,
it's an undocumented asset.
So it's not inventory recorded or tracked.
The impact the assets aren't included
in our anti-malware processes,
in vulnerability, or configuration,
or change management processes.
Totally is out of our line of sight.
The response, a contractual obligation
to document any assets that you'd be using
in our network or connecting
to our network using network access control, NAC,
which has pre-admission
and post-admission policies to evaluate a system
before it's allowed on our network.
We'll be talking about that later on.
Network mapping to be able to say, "Okay,
"what assets are out there?"
And vulnerability scanning to identify our assets.
Now we're gonna turn our attention to the supply chain.
And I wanna look at three supply chain issues,
Supply chain dependency, supply chain disruption,
and supply chain non-conformance.
Supply chain dependency is when we have, generally,
a single source or sole-source dependency
on a supply chain vendor.
And when they can't deliver something,
everything comes to a halt.
Supply chain disruption is
when there is a disruption, generally,
in the delivery of supply chain items.
So it could be like we had at the ports during the pandemic.
They all got overloaded, right?
And just couldn't deliver.
Or it could be a disruption because of weather,
or it could be a disruption because of a political issue.
But something's happened, right?
That the supply chain can't deliver.
And then supply chain non-conformance is when they're not
in conformance with your expectations, your contracts,
or your regulatory obligations.
The impact on all of these is the inability to operate
and or deliver a service or product.
We could have negative stakeholder response,
we could end up with regulatory actions,
and certainly a financial impact.
So what do we do?
We're really trying to identify our supply chain.
Who is in our supply chain?
Working to diversify our supply chain
so we don't have a dependency on just one vendor.
And then being really good
about monitoring supply chain activities
and including our supply chain,
all our supply chain vendors and relationships
in our risk management processes.
That my friends, brings us to our three-second challenge.
Are you ready?
Five challenge questions, three seconds each.
Let's do it.
The ecosystem of organizations,
processes and people and resources involved
in providing a product or service.
What is this called?
1, 2, 3.
This is our supply chain question.
Question two, agreement
that documents technical requirements and responsibilities.
1, 2, 3.
That's gonna be our ISA,
our Interconnection Security Agreement.
Number three, the last date
to receive product service and support.
1, 2, 3.
That's gonna be EOS or end of support.
Number four, sole-source reliance on a vendor.
1, 2, 3.
That would be dependency.
And if it's in our supply chain,
it would be supply chain dependency.
And lastly, number five,
the term used to describe unmanaged growth
or when things just get outta control, they get too big.
What's the term we're using?
1, 2, 3.
That's gonna be system sprawl.
Hey, I hope you did well on this.
We're gonna do a Security-in-Action about EOL and EOS.
Why, Because it's such an important topic.
I wanna keep talking about it.
Your boss just loves her old laptop running Windows 7
and doesn't wanna give it up,
even though support
for Windows 7 ended on January 10th, 2023.
As a side note,
Microsoft actually always tells us the end of life
and the end of support date when they release a product.
So we've known this date for a long time,
but your bossman loves
that windows 7 device and doesn't wanna give it up.
So you're preparing for a meeting
to explain why immediately upgrading her laptop
and the operating system is essential.
So what key points are you gonna make
to convince her to upgrade?
Go ahead and put me on pause, jot down some notes
then we'll come back and talk about reasons to upgrade.
First reason, Microsoft no longer provides security updates
or technical reports for the Windows 7 operating system.
Our antivirus software may have limited effectiveness on PCs
that don't have the latest security updates.
So her laptop could be at risk.
And when her laptop connects to the network,
we're putting the entire network at risk.
More and more apps and devices aren't going to work
with Windows 7.
They're expecting a later operating system
And every time she connects to the corporate network,
she's putting the organization at operational, compliance,
legal, financial, and reputational risk.
Hopefully that'll be enough for her to say,
(laughs) "Okay, I'm done."
But if not, we have more arguments still.
She's acting contrary to company policy,
assuming that you have a company policy that says
that you can't be using systems past end of support,
and hopefully you do.
And lastly, let her know that her new PC,
it'll be faster, it'll be more fun,
and it'll definitely be a more enjoyable experience.
So even if nothing else worked,
hopefully that last bullet will.
Being able to have this conversation with your boss,
being confident and really being able
to explain it and moving the needle,
that, my friends, is security in action.
There's your word cloud.
You know what to do, make sure you know all of these terms,
you can explain it.
If not, go back through the lesson again.
Now I do recognize that in the response section,
I introduced a lot of topics we haven't talked about yet.
But we will be talking
about all of them throughout this course.
All right, when you're ready,
I'll see you at the next lesson.