Cybersecurity and Third-Party Risk - Gregory C Rasner

. .

Auteur(s) : Gregory C Rasner

Editeur : Wiley

Langue : Anglais

Parution : 01/07/2021

Format : Moyen, de 350g à 1kg

Nombre de pages : 480

Expédition : 634

Dimensions : 22.5 x 15.2 x 2.6

ISBN : 111980955X

Résumé :

STRENGTHEN THE WEAKEST LINKS IN YOUR CYBERSECURITY CHAIN

Across the world, the networks of hundreds of different world-class organizations have been breached in a seemingly never-ending stream of attacks that targeted the trusted vendors of major brands. From Target to Equifax, Home Depot, and GM, it seems as if no company is safe from a third-party incident or breach, regardless of size. And the advanced threats are now exploiting the intersection of weaknesses in cybersecurity and third-party risk management.

In Cybersecurity and Third-Party Risk, veteran cybersecurity specialist Gregory Rasner walks readers through how to lock down the vulnerabilities posed to an organization's network by third parties. You'll discover how to move beyond a simple checklist and create an active, effective, and continuous system of third-party cybersecurity risk mitigation.

The author discusses how to conduct due diligence on the third parties connected to your company's networks and how to keep your information about them current and reliable. You'll learn about the language you need to look for in a third-party data contract whether you're offshoring or outsourcing data security arrangements.

Perfect for professionals and executives responsible for securing their organizations' systems against external threats, Cybersecurity and Third-Party Risk is an indispensable resource for all business leaders who seek to:

• Understand the fundamentals of third-party risk management
• Conduct robust intake and ongoing due diligence
• Perform on-site due diligence and close vendor risks
• Secure your software supply chain
• Utilize cloud and on-premises software securely
• Continuously monitor your third-party vendors and prevent breaches

...

Biographie:

Foreword xvi

Introduction xviii

Section 1 Cybersecurity Third-Party Risk

Chapter 1 What is the Risk? 1

The SolarWinds Supply-Chain Attack 4

The VGCA Supply-Chain Attack 6

The Zyxel Backdoor Attack 9

Other Supply-Chain Attacks 10

Problem Scope 12

Compliance Does Not Equal Security 15

Third-Party Breach Examples 17

Third-Party Risk Management 24

Cybersecurity and Third-Party Risk 27

Cybersecurity Third-Party Risk as a Force Multiplier 32

Conclusion 33

Chapter 2 Cybersecurity Basics 35

Cybersecurity Basics for Third-Party Risk 38

Cybersecurity Frameworks 46

Due Care and Due Diligence 53

Cybercrime and Cybersecurity 56

Types of Cyberattacks 59

Analysis of a Breach 63

The Third-Party Breach Timeline: Target 66

Inside Look: Home Depot Breach 68

Conclusion 72

Chapter 3 What the COVID-19 Pandemic Did to Cybersecurity and Third-Party Risk 75

The Pandemic Shutdown 77

Timeline of the Pandemic Impact on Cybersecurity 80

Post-Pandemic Changes and Trends 84

Regulated Industries 98

An Inside Look: P&N Bank 100

SolarWinds Attack Update 102

Conclusion 104

Chapter 4 Third-Party Risk Management 107

Third-Party Risk Management Frameworks 113

ISO 27036:2013+ 114

NIST 800-SP 116

NIST 800-161 Revision 1: Upcoming Revision 125

NISTIR 8272 Impact Analysis Tool for Interdependent Cyber Supply-Chain Risks 125

The Cybersecurity and Third-Party Risk Program Management 127

Kristina Conglomerate (KC) Enterprises 128

KC Enterprises' Cyber Third-Party Risk Program 131

Inside Look: Marriott 140

Conclusion 141

Chapter 5 Onboarding Due Diligence 143

Intake 145

Data Privacy 146

Cybersecurity 147

Amount of Data 149

Country Risk and Locations 149

Connectivity 150

Data Transfer 150

Data Location 151

Service-Level Agreement or Recovery Time Objective 151

Fourth Parties 152

Software Security 152

KC Enterprises Intake/Inherent Risk Cybersecurity Questionnaire 153

Cybersecurity in Request for Proposals 154

Data Location 155

Development 155

Identity and Access Management 156

Encryption 156

Intrusion Detection/Prevention System 157

Antivirus and Malware 157

Data Segregation 158

Data Loss Prevention 158

Notification 158

Security Audits 159

Cybersecurity Third-Party Intake 160

Data Security Intake Due Diligence 161

Next Steps 167

Ways to Become More Efficient 173

Systems and Organization Controls Reports 174

Chargebacks 177

Go-Live Production Reviews 179

Connectivity Cyber Reviews 179

Inside Look: Ticketmaster and Fourth Parties 182

Conclusion 183

Chapter 6 Ongoing Due Diligence 185

Low-Risk Vendor Ongoing Due Diligence 189

Moderate-Risk Vendor Ongoing Due Diligence 193

High-Risk Vendor Ongoing Due Diligence 196

Too Big to Care 197

A Note on Phishing 200

Intake and Ongoing Cybersecurity Personnel 203

Ransomware: A History and Future 203

Asset Management 205

Vulnerability and Patch Management 206

802.1x or Network Access Control (NAC) 206

Inside Look: GE Breach 207

Conclusion 208

Chapter 7 On-site Due Diligence 211

On-site Security Assessment 213

Scheduling Phase 214

Investigation Phase 215

Assessment Phase 217

On-site Questionnaire 221

Reporting Phase 22...

Sommaire:

GREGORY C. RASNER is the lead of Cyber Third-Party Risk at Truist Financial Corporation. He has extensive experience in cybersecurity and technology leadership in banking, biotech, software, telecom, and manufacturing. He is the author of several published articles on Third Party Risk and is a sought-after keynote speaker in this area.