Libby Bevin

FINDINGS FROM A CYBERRISK ALLIANCE (CRA) RESEARCH STUDY

Risk management has risen significantly on the board of directors’ radar from a compliance requirement checklist item to one of the many pillars required to ensure a corporation can manage security risk.

A survey conducted by CyberRisk Alliance among 252 senior-level IT executives identified several areas that might drive decision making to address corporate risk-related issues for the foreseeable future.

Some of the findings show:

• A change in North American corporate executives’ view of whether they should take a reactive or proactive approach to cybersecurity
• A need to develop a more effective and efficient risk management operation and integrate it with the audit and compliance operations within the corporate hierarchy
• The top objectives why organizations are investing in GRC software

Read the report to hear from other organizations on the challenges they are facing within cybersecurity risk and what they intend to do to address them.

Data theft can devastate any company, resulting in lost profits, regulatory enforcement, litigation, and reputational damage that can be difficult to overcome. Every organization must protect its customer data and assure that sensitive information is kept safe.

That said, the data in your company’s possession is held in different states – and each of these states has particular vulnerabilities. A security tactic that works for one state may be inefficient for another. Knowing the biggest threats for each type of data can help you to design controls that will keep all of your clients’ personally identifiable information safe.

What Are the Three States of Data?

To create the best information security system for your data, you’ll first need to understand the differences among data at rest, data in motion, and data in use.

Data at Rest

“Data at rest” is data that is not being used or transferred. This means that the data is likely being stored on a hard drive, flash drive, or another device. The term can also refer to data stored in a cloud service, such as Microsoft Azure or Amazon Web Services (AWS). Data at rest is easier to secure, but thieves typically see this data as a more attractive target because there’s more of it to steal. Data at rest is also more vulnerable to malicious attacks from employees who have access to the storage network.

Data in Motion

This refers to data moving from one location to another, such as between two storage devices. This includes downloads, transfers, or any other means of taking data from one place to another. Of the three states, data in motion is by far the most vulnerable. In particular, Man in the Middle (MitM) attacks (where a malicious actor inserts himself into a transaction or transfer) are easier to execute with data in motion.

Data in Use

This refers to data being accessed or used at any given moment. If you are creating, deleting, editing, or processing your data, then it is “in use” until such time as it is stored (at rest) or transferred (in motion).

What Are the Best Practices for Keeping Data at Rest Safe?

As we discussed previously, data at rest can be a tempting target for hackers. The following defense methods can help you protect your stored data.

Keep Your Storage Organized

Disorganized or unclassified data storage can create unnecessary vulnerabilities that hackers will exploit. Creating a well-maintained and well-documented storage system will help you to keep an eye on all of your information and to notice whether anything has been disturbed. Classifying your data based on how valuable or vulnerable it is will also help you to allocate your defense resources correctly.

Encrypt Your Data

Data encryption translates your data into a code that is undecipherable to anyone without the correct encryption keys. Encrypting your data while it is stored means that even if unauthorized access happens, the encrypted data will not be of use to the thieves. Encryption is a powerful tool that can keep information from falling into the wrong hands.

Practice Due Diligence

It’s imperative that you understand where your data is stored and what safeguards are in place. If you’re using cloud storage, your server will likely have a number of protections in place; those are a great addition to a strong defense strategy. Depending on these outside controls alone, however, can have disastrous results. Whatever cloud services you use, you still have a responsibility to create security controls for your storage and make sure the data is safe.

What Are the Best Practices for Keeping Data in Motion Safe?

Data in motion is harder to protect than stored data. These security measures will provide a solid foundation for your data protection efforts.

Secure Your Network

Your company will need to access and transmit data to provide the best service for your clients; leaving critical data in storage is simply not an option. This means that your private network must be secured and protected so that data is safe while in transit. There are a variety of ways to secure your network, such as implementing firewalls or using encrypted connections and SSL certificates. Whatever method you choose, your goal should be to assure that no outside actors are able to see or acquire sensitive data while it moves within your company.

Restrict Access to Data

An important part of data protection is knowing who has access to it and who is responsible for any transmissions. This means that restricting data access on a need-to-know basis and implementing access logs can help you track when data is being moved and who was responsible for moving it. If a breach occurs at this level, access control will make it easier to determine where it originated and what must be done to prevent future breaches.

Encourage Good Security Hygiene

The safety of data transmitted within your company depends on the security of your staff’s accounts. Usually data will be transmitted via email or messaging apps, and your employees need to have unique names and strong passwords to keep that data secure. Multi-factor authentication is also a great option for protecting data, and your employees should be encouraged to implement such protection on their accounts.

Endpoint security should also be a concern, and any laptops or mobile devices used by your staff must be secured. Training your staff on the importance of data security should be an integral part of your overall data management plan.

Use ZenGRC for Data Protection

Your best defense in the face of data theft is preparedness. Part of that preparedness is a risk management system tailored to your company’s needs. Organizing this important information in spreadsheets can result in redundancies or worse, risks that slip through the cracks. How can you best streamline your risk management and protect your customers’ data?

ZenGRC is an integrated software solution that allows you to view your entire risk landscape in real time. This innovative platform will help you track and assign risks for all data, whether it’s at rest or in motion.

Schedule a demo today to learn how ZenGRC can help create a risk management system tailored to your data protection needs.

Third-party risk management needs a new approach because (let’s be honest here) the current approach doesn’t work.

According to Gartner, 83 percent of legal and compliance leaders identify third-party risks after initial onboarding and due diligence. This suggests traditional due diligence methods in risk management policy are failing to capture new and evolving third-party risks.

Organizations need effective third-party risk management (TPRM) policies to establish guidelines and practices for third-party risk assessment, monitoring, remediation, and reporting. But many businesses face difficulties when implementing third-party risk management policies by themselves across their third-party suppliers.

What Does Third-Party Risk Mean?

Third-party risk is the potential threat to your organization’s operations, data, compliance posture, and financial information that arises from your supply chain and other business partners.

A common example of third-party risk is network intrusion, which refers to unauthorized activity on your digital network. One of your third parties is connected to your IT systems but has weak access controls of its own, so attackers first penetrate that third party and then proceed onto your IT network.

Moreover, there are many techniques to carry out network intrusion. For instance, cybercriminals create traffic loads that are too large for systems to screen adequately, inducing chaos and congestion in network environments. This allows them to execute attacks without ever being detected.

This is where a third-party risk management program comes into the picture. With effective third-party risk management policies in place, you’ll be better equipped to mitigate undue risks and excessive costs associated with third-party cybersecurity risks like network intrusion.

Third-party risk management is critical because using third parties (both directly and indirectly) creates cybersecurity risk. TPRM can reduce the possible harm to your company, your customers, and your organization’s finances.

What Types of Third-Party Risks Are There?

Third-party relationships can generate higher profitability, competitive advantage, decreased cost, and faster marketing. But they also expose your organization to multiple risks, such as:

1. Financial risk. A third party may fail to deliver a promised good or service, or suddenly go bankrupt or otherwise end the business relationship. In that case, your company might face unpleasant and expensive consequences trying to replace the vendor or otherwise rectify the situation.
2. Reputational risk. Third parties might interact with customers on your behalf (say, a delivery service or a call center) and their poor service would boomerang back onto your corporate reputation. Or if your third party experiences a data breach with your customer data, your organization may experience customer distrust.
3. Operational risk. These risks arise from inadequate or failed internal processes, systems, and people, or from external events. For example, if a third party experiences a cyberattack that shuts down the service, your organization might face a business interruption.
4. Cybersecurity risk. These risks arise from the unauthorized access, use, destruction, disclosure, modification, recording, or inspection of sensitive information, regardless of the form it may take.
5. Compliance risk. A company is legally responsible for the conduct of third parties acting on its behalf. So for example, if an overseas distributor bribes government officials to sell your products, you may face liability under the U.S. Foreign Corrupt Practices Act.

How Can You Manage Third-Party Risk?

Companies must manage third-party risk to reduce its harm to your organization. Here are the four steps to address third-party risks:

• Conduct a risk assessment to identify the types of third-party risk you’re likely to encounter and the steps you can take to reduce them.
• Assure your due diligence process is proportionate to the risk.
• Implement a comprehensive electronic workflow system.
• Adopt a company-wide approach to risk management, making it a part of your company culture.

What Are the Best Practices in Managing Third-Party Risk?

In addition to the above steps, you can follow these best practices for managing your third-party vendor risks:

• Identify all third-party vendors and their contact information.
• Learn about your vendor’s own risk management.
• Evaluate all risks associated with third-party, fourth-party, and “nth-party” vendor solutions.
• Leverage automation whenever possible.
• Have the right processes and metrics for the ongoing monitoring of third parties.

What Is a Third-Party Risk Assessment and How Is it Conducted?

A third-party risk assessment involves analyzing risks introduced to your organization via third-party relationships along the supply chain: vendors, software providers, service providers, and other suppliers. It involves the following three steps:

Establish vendor risk criteria

Create a list of vendor risk criteria that includes the most destructive third-party risks your organization could face. Try to compile an actionable list of high-risk third parties with whom you’ll perform risk assessments.

Conduct third-party onboarding and screening

You must mandate standard risk management processes across your company. Use real-time checking and containment measures to create a detailed picture of third-party or vendor relations. This will allow you to predict and protect against any potential risk.

Assess both risks and performance results

Assessing results is the only way to determine to what degree (if at all) a third-party relationship is risky. For instance, information security ratings allow you to supervise your vendor compliance and unpredictable risks consistently.

But why do third-party risk assessments matter?

Foremost, risk assessments are often a regulatory requirement. Risk assessments must be completed on each vendor and on every product or service the vendor provides. They also help determine specific areas of risk that need more thorough and ongoing monitoring, such as the third-party’s cybersecurity or disaster recovery planning.

Using these insights, you can then identify potential risks and determine whether your organization requires additional controls to limit risk exposure.

After identifying and analyzing vulnerabilities, you’ll also need a mitigation strategy to reduce the severity of the identified risks and/or remediate them.

Maintain an inventory of all third-party assets, advocate asset ownership, and create a mechanism (even an internal whistleblower hotline, for example) to communicate third-party risks and threats. Follow this by examining and monitoring access and activities from third-party assets and the third-party itself regularly.

Automate Your TPRM program

RiskOptics’ ZenGRC makes it easier to develop and scale a successful TPRM management system.

ZenGRC offers continuous monitoring features to assure you’re always on top of your third-parties compliance hygiene, as well as provides an intuitive dashboard to give you an at-a-glance view of who’s compliant and who isn’t. With ZenGRC automating your TPRM, you and your team can rise above the rest and focus on other, more important aspects of your business.

The need for versatile and affordable solutions for storing and processing data in enterprises makes cloud computing an increasingly attractive IT strategy.

Cloud computing provides flexible and easy-to-use solutions. It can also be more cost-effective than traditional storage methods that require a physical server and hardware at your corporate premises, which is one of the reasons why businesses often make the switch.

“Infrastructure as a service” (IaaS) and “platform as a service” (PaaS) from cloud providers such as Google Cloud (GCP), Amazon Web Services (AWS), or Microsoft Azure are great options when investigating cloud security. Although they all feature cybersecurity as part of their services, you still must develop your own cybersecurity strategy.

The idea of using third-party vendors to provide software applications and other technology solutions to your company via “the cloud” has been gaining traction for years. In addition, the COVID-19 pandemic and the massive shift to remote working has made cloud computing even more essential, making cloud security imperative.

While cloud solutions are convenient, they expand the number of potential security vulnerabilities, and that broadens the scope of your risk assessments, monitoring, and audits. In addition, managing risks related to cloud storage with third parties must also be prioritized.

This article explains the top security risks of cloud computing and the best practices to avoid them.

Security Risks Unique to Cloud Computing

Intellectual Property Theft or Loss

For intellectual property, embracing the cloud is a double-edged sword. For example, some data uploaded by companies to cloud file management services contain sensitive information. Companies therefore face the risk of having their intellectual property stolen.

Database servers are most frequently targeted for intellectual property theft. As a result, one’s first reaction might be to construct more powerful firewalls to provide additional protection to such servers. Another option is to migrate all protected data to the cloud rather than keeping it on servers.

Data Loss

Natural disasters, malicious assaults, user errors, overwriting data, or service provider deletion are factors that can destroy or lose data on cloud servers. Losing sensitive data may be disastrous for businesses, especially if they don’t have a backup strategy in place.

Examining your provider’s terms of service and backup policies is an essential step in data security. For example, physical access, storage locations, and natural disasters could all be addressed by a backup protocol.

Data Breaches

A data breach has the potential to reveal sensitive data to an unauthorized party. Data breaches affect all industries and can occur for a variety of reasons, including theft.

According to experts, data breaches are one of the most common security risks in the cloud computing era. Many victim companies are random targets for cybercriminals, who extract large amounts of usernames, passwords, credit card numbers, or other private information from their databases for quick financial gain.

Malware Attacks

Malware injection attacks can compromise cloud computing infrastructure. The cyberattacker can install a malicious program through vulnerabilities in software as a service (SaaS), infrastructure as a service (IaaS), and platform as a service (PaaS). Information can then be retrieved, exported, or deleted from a company’s IT infrastructure.

As technology improves and detection systems evolve, cyber-criminals also develop new techniques to evade protections and deliver malware to targets.

Compliance Violations

Most companies operate under one or more regulatory obligations. Whether it’s the Family Educational Rights and Privacy Act (FERPA) for personal student documents or the Health Insurance Portability and Accountability Act (HIPAA) for private patient records (or many other compliance obligations), regulations and rules exist to assure information security.

An organization can quickly slip into non-compliance if it isn’t’ careful, putting the enterprise at risk of regulatory fines, litigation costs, and damage to reputation. Bring your own carrier (BYOC) is one of the most common ways for a business to violate government or industry regulations due to potentially insufficient security measures.

Contract Breaches with Clients or Business Partners

When a cloud infrastructure allows information to be stored and shared quickly and easily, that also means a greater risk of information getting into the wrong hands. Beyond the data breach, companies can also trigger security headaches by violating the non-disclosure agreements they have with other companies.

Poor or non-existent segmentation mechanisms within a cloud can result in employees unknowingly undermining the cloud infrastructure and violating privacy and data protection agreements between the company and third parties.

Violating business contracts by breaching confidentiality agreements is common, especially when the cloud service maintains the right to share all uploaded data with third parties.

Denial of Service Attacks

You’re probably well aware of how cyber attacks can be used for account hijacking to gain access to your service provider’s platform. Denial-of-service (DoS) attacks, however, do not try to get around your security measures. They aim to overwhelm servers completely and preventi any other use of the infrastructure.

DoS is also used as a smokescreen for other malicious actions. Some security devices, however, such as well-prepared web application firewalls, are ready to protect your infrastructure from those attacks.

Service Downtime

The absence of services can be unto itself a significant threat to the organization. Organizations that rely heavily on cloud computing tools for their daily operations or companies that provide services to users can be strongly affected by downtime of cloud computing platforms or infrastructure.

A recent and worldwide visible example was the case of Facebook, which suffered a complete outage in all its systems. This event was not the result of a cyber attack, but rather an internal error during software maintenance.

Revenue Losses

Either as a result of operational delays or reputational backlash, your company could suffer revenue losses related to its cloud computing systems. Facebook’s recent global outage is an example of both situations: While Facebook and Instagram platforms remained offline, they lost substantial ad revenue and the trust of their users was undermined, resulting in an estimated loss of $65 million.

Reputational Damage

Data breach issues at your company can harm your corporate reputation, as customers inevitably feel insecure after these risks strike. For example, massive security breaches have resulted in the theft of millions of customer credit and debit card numbers from data storage facilities. If customer data is not safe in your hands, the customers will likely leave for competing companies.

Preventing Cloud Security Issues

The cloud presents vulnerabilities that must be prevented appropriately. But with comprehensive risk management strategies in place, it’s easy to protect files and authorize only the users who should see them. The following practices will help business decision-makers and enterprise IT managers analyze company data security in the cloud.

Assure Governance Is Effective

Most companies have already established privacy and compliance policies to protect their assets. These policies must create a governance framework that establishes authority and a chain of responsibility.

Audit Business Procedures

Every system in an organization must be audited regularly. These are the three crucial areas that cloud service consumers should audit regularly:

• Security at the cloud service facilities
• Accessibility of the audit trail
• Internal controls at the cloud service provider

Cloud Network Security

Cloud service providers aren’t necessarily aware of what network traffic their users plan to send or receive. So organizations must collaborate with their service providers to establish security measures.

Privacy Policies

Any organization’s success depends on the privacy and protection of personal and sensitive data. Security flaws or breaches can occur when an organization holds personal data. If a cloud service provider does not provide proper security, the company may consider switching providers or not transferring sensitive data to the cloud.

Assess Security Vulnerabilities in Cloud Applications

Different organizations store different data types in the cloud. As a result, the provider and the enterprise face several issues regarding cloud application security. Each party has different considerations depending on the cloud service provider’s deployment model, such as IaaS, SaaS, or PaaS.

Data security in the cloud is a concern you cannot afford to overlook. Spending the time to assure that data is adequately protected is the best defense against security breaches and control cloud security threats.

Protect Your Data with Help from ZenGRC

ZenGRC is an integrated platform for tracking and organizing your company’s governance, regulatory, and compliance data. It can help you automate governance procedures, consolidate proof of compliance, and expose security risks before they become liabilities.

ZenGRC also examines your critical infrastructure for holes in existing controls that could expose your organization or project to hazards. It then displays them on user-friendly, color-coded dashboards that show you where your vulnerabilities are and how to address them quickly.

This one-of-a-kind software-as-a-service ensures that you comply with relevant regulatory and industry frameworks, including SOC 2, ISO, GDPR, and CCPA. You can perform self-audits with a single click whenever you like. Audit-trail documentation is collected and saved in the tool’s “single source of truth” database for simple retrieval during audit time.

Contact us for a free demo to learn more about how ZenGRC can help you protect your company’s data.