Joe Filer, Vice President and Chief Information Security Officer (CISO) at Harland Clarke, discussed the future of vendor management during his presentation at the 2014 CISO Leadership Forum in Dallas on Oct. 2. In his presentation, “Vendor Security Risk Management – How to Handle the New Normal,” Filer noted vendor security risk management is important, and auditing and validation is key to avoid security issues with vendors. According to Filer, documentation plays a vital role in vendor security risk management. If a vendor develops effective risk management processes, Filer said, it can minimize and prevent security issues: “The key component for the vendor security risk management piece for me has always been the documentation part of it. How do I develop something when I’m doing effective vendor security risk management that allows me to document my thought processes associated with performing that risk assessment of an individual vendor so I can provide that to whoever’s interested in seeing it?” Filer also pointed out consistent security risk management guidelines can have far-flung effects on an organization. In addition, an organization that understands the impact of these guidelines, Filer said, can avoid unnecessary risks: ” There are some real inconsistent guidelines to the management process out there and it’s important to put something together that allows you to continue to be subjected to the cost effective and efficiency space. You have to have a confident sense of the security posture of your key vendors, though, and it has to be one where you’ve been able to build that in a way that doesn’t push them into a place where they don’t want to be a part of the process.” - See more at: http://www.argylejournal.com/chief-information-security-officer/vendor-security-risk-management-how-to-handle-the-new-normal-joe-filer-vice-president-chief-information-security-officer-harland-clarke/#sthash.9bNU6U4O.dpuf

1. October 2014
Vendor Security Risk Management -
How to Handle the New Normal
“Some Important Lessons Learned From Both Directions”
Presented By:
Joe Filer, CISSP, PMP, CRISC

2. Who is this Guy?
 BA in Math, Masters in Operations Research
 Over 20 years as an information security professional
–Increasing levels of global security leadership with
extensive compliance focus
 CISSP/CRISC – Security and Risk Experience
 PMP – Project Management Experience
 ISSA Distinguished Fellow
 Currently – VP, CISO at Harland Clarke Holdings Corp.
–Multi-company, global footprint
 Resident of San Antonio, TX (almost 30 years)
2

3. Ground Rules
 Some of the information provided will be identified as
“my personal or professional opinion” and should not
be considered as reflective of my employer’s position.
 Any aspect of this presentation that might be
considered to address legal issues reflect summaries
and should not be considered legal advice.
3

4. Overview
 What is Vendor Security Risk Management?
 Overview of the Key Concepts
 Perspective/Premise
 Changing Landscape and Forecasts
 Issues and Lessons Learned
 Solutions
 Conclusions
4

5. Definition
Vendor Security Risk Management
 Structured approach to ensure that relevant
vendor security risk postures are understood,
documented and validated to an appropriate level
5

6. Key components of effective VSRM
Vendor Security Risk Management
 Required confidentiality components in contracts
 Confidence that all “relevant” vendors are
subjected to program’s oversight
 Approach where vendor security postures are
understood, documented and validated when
appropriate
 Feedback to the vendor to facilitate remediation
when required
6

7. Key Concepts
 Risk – potential harm that could occur from a future
event
 Risk Management – the process of understanding risk
and determining how best to handle exposure
 Compliance – meeting all the requirements of a
standard
 Certification – authority attesting to a level of
compliance
7

8. Unique Perspective
 Own Vendor Security Risk Management for ~50 Critical
Vendors
My Team
 Support client requirements as a Critical Vendor to
hundreds of Financial Institutions
8

9. Premise - As an industry we need to recognize
the importance of doing vendor security risk
management better….
“Vendor Security Risk Management (VSRM/Due Diligence)
efforts can be very costly and may not lead to confident
visibility into the security posture of our critical vendor
relationships.”
“We have not embraced the key lessons learned from doing
VSRM for several years.”
“There has to be a better (cost effective) way to meet this
important objective.”
9

10. Changing Landscapes and Forecasts
 OCC Guidelines Oct 2013
–Establishes clear requirement for 3rd party oversight
–Emphasis on risk management and due diligence
–Considered somewhat ambiguous and subject to
misinterpretation
 The weaknesses associated with “Payment
Card Industry approach” will be addressed
–Expect more comprehensive requirements including vendor
security management
–More stringent assessor expectations
–VISA Validation effort – Jan 2015
10

11. Changing Landscape and Forecasts
 Consumers are sick of “holding the bag”
–Companies will be held accountable for security decision-making
–Too many vendors do not have a good “history”….
–Class action lawsuits
 Federal legislation is Coming!
–Tech savvy generation in leadership influencing direction
–Lots of new regulations (See OCC 10/2013)
–Legislation has been “bubbling under the surface” for several
years (See http://fas.org/sgp/crs/natsec/R42114.pdf)
–Response to consumer lack of confidence
11

12. Issues/Lessons Learned #1
Vendors are not your enemy! They are not trying to hide
things from you and you should not fear them.
 Lesson: If we need to be “afraid” of our vendors, why
have them?
–Build relationships with good partners.
–Invest in good up-front vetting that starts the process on a
solid footing.
–There is too much focus on people trying to “pull the wool
over our eyes”.
12

13. Issues/Lessons Learned #2
The PROCESS is not more important than the objective.
 Lesson: We need to recognize the impact that this
process has on our vendors and our business elements
–Excessively burdensome requirements can impact the
willingness of the vendor to “participate” in the effort
–We don’t all have unlimited security budgets and “Time is
Money”
–Vendors are not impressed by fancy collection tools, overly
comprehensive surveys, etc.
13

14. Issues/Lessons Learned #3
Inconsistent guidance to Vendor Security Management is
reflected in extraordinary document requests
 Lesson: Vendor Security Management has lost sight of
the original objective – Confidence with the security
posture of key vendors
–Piles of documents cannot really support an effective
evaluation of security posture
–Approach probably increases overall risk as many
documents reflect SENSITIVE information on their own
14

15. Issues/Lessons Learned #4
Not every “gap” is HIGH risk……….
 Lesson: We need to be realistic about the sensitivity
we attach to risk issues.
–Threat consideration is a key piece of the process
–Effective risk assessment allows for business prioritization
and remediation
–Credibility with the business is at stake
15

16. Issues/Lessons Learned #5
Compliance has become a CheckBox exercise in many
cases.
 Lesson: We have lost sight of something learned long
ago - “There is no such thing as One Size Fits All
Security”
–PCI and “compliance versus security” failures
–The “qualitative” aspect of reviews began to erode with
SOX reviews
–Risk context is very important
16

17. Issues/Lessons Learned #6
SOC 2 could be the best thing to happen to VSRM in
some time…….
 Lesson: We have to rely on comprehensive security
reviews whenever possible.
–SAS70 was not the answer – not always measured to same
level
–SOC 2 is a viable solution for non-validated control visibility
– a good, cost effective starting point for vendor security
awareness
–Mentioned directly in OCC Guidelines as viable oversight
17

18. Solutions
 Maintain the focus on Security Risk Management
– Keep process on target and in a “Box”
–We cannot over-rotate on parts of the issue (e.g., scanning)
–Limit document exposure
– Trust but Verify while keeping validation at an appropriate level…….
 We do NOT need to Re-invent the Wheel
–Effective Vendor Security Risk Management has been going on for
over 15 years…..
–Success starts with Clear Requirements in Contracts
–Understand and respect the impact on the vendor
 Be proactive as a Vendor
– “Build Once, Use Many” documents provide efficient visibility
–Confidence goes a long way
–Stand firm when you have to
18

19. Solutions (Generally)
 Focus on Effective Security Posture NOT Compliance
–Comprehensive and secure programs lead to compliance BUT not
the other way around…….
–Recognize the Importance that Risk Plays in the Process
 Document the Risk Management Decision Process
–Capture why things were (or were not) done
–Ensure the Business owns/drives the risk-based decision
–Security should be a Consultant in the process
–Understand and advocate for your vendors/clients/customers
 Own your Compliance/Audit Relationships
–Push them beyond the CheckBox mentality
–Think quality
–And, make them add value to your awareness
19

20. Conclusions
• Vendor Security Risk Management is an absolute
requirement today and we must do it right
• Working together as “partners” is essential
• Process is an enabler not the objective
• As an industry, we have to get better at understanding
and leveraging Risk Management
• There is no such thing as “One Size Fits All Security”
• We must address the rising “CheckBox Mindset” and its
impact on Security /Compliance
• Solid security programs reflect foundation for
Compliance successes – Not the other way around
• We must determine some alternatives – SOC 2 – YES!
• Fundamental Philosophy has not changed – Effective
Security Must Enable the Business
20

21. 21
Questions

22. 22
For more information…
Joe Filer, CISSP, PMP, CRISC
VP, Chief Information Security Officer
10931 Laureate Drive
San Antonio, TX 78249
210.694.1560 (office)
210.475.1920 (cell)
joseph.filer@harlandclarke.com