Recommended
Recommended
More Related Content
Similar to The Ugly Secret about Third Party Risk Management.pptx
Similar to The Ugly Secret about Third Party Risk Management.pptx (20)
Recently uploaded
Recently uploaded (20)
The Ugly Secret about Third Party Risk Management.pptx
- 1. The ugly truth about third party risk management Data Breach Database
- 2. Your vendors are selling you bad, incomplete data. Who are their sources? 1. If they have NOT purchased a cyber loss feed from insurers, they cannot accurately quantify the financial impact of a risky vendor 1. If they are NOT sourcing breach notification data from all federal, state and industry regulators, they are not truly monitoring vendors. tl;dr - The Ugly Truth
- 5. “Organizations should stop using risk scores and risk matrices. There is mounting evidence against (and none for) their effectiveness” — Doug Hubbard, author of “How to Measure Anything in Cybersecurity” Problem 2 Source: https://www.youtube.com/watch?v=bYjPmptlc14
- 6. Instead…
- 7. Solution = Better Data Breach data Cyber loss data
- 8. What is breach notification data?
- 9. Question: Are private companies mandated to notify their users if they leak their data?
- 10. All 50 states and the District of Columbia have laws requiring private businesses, to notify individuals of security breaches of [..] personally identifiable information.” — National Conference of State Legislatures Fun Fact Source: https://www.ncsl.org/technology-and-communication/security-breach-notification-laws
- 11. 1. Breach notifications are regulated at state level 2. 35 states and DC require private companies to notify their Office of the Attorney General 3. 40 states and DC require notification to a credit reporting agency 4. Generally, notification is required for >=1,000 citizens 5. Notification requirements are ASAP to 45 days generally Things to know…
- 14. 1. Breach notifications are real data. They are the Who, What, Where and When. 1. Not notifying impacted users = you’re breaking state law! 1. Breach notification data can be used to ensure vendors, clients and partners are being truthful 2. If you’re paying for risk/threat intelligence data but real data isn’t included, what are you really paying for? Takeaways
- 15. What is loss data?
- 16. Question: How would you identify the true financial cost of a data breach?
- 18. It’s your insurers job to know how much it will cost them if your company has a breach because of risk transfer. Why is this important… Insurance Company Reinsurer Insurance Linked Securities
- 19. ● Company and industry identifiers ● External or internal caused loss including employee, vendor/consultant, terrorist, criminal organization, etc ● Actor vectors, proximate + secondary causes, compromised data sources, types, and affected counts ● Settlement amounts, legal fees, fines, restitution Fields
- 22. 1. Cyber loss data is used purely for underwriting purposes not continuous monitoring of actual breaches as reported to regulators 1. It is occasionally the Why but always the How Much of our story. 2. Identify the REAL cost of a breach from an insurers POV 1. Enrich your risk tools for better storytelling Things to know…
- 23. Solution(s) Third Party Risk (continuous monitoring)
- 24. Vendor X - High Risk What story do we want to tell? ● What letter grade would another vendor assign them? ● What would their theoretical credit score be? ● What security issues are in their external facing sites?
- 25. Vendor X - High Risk An alternative story: ● How many breaches have been reported to a regulator? ● Have they reported a breach but not told us? ● Did they report something different than what was shared with us? ● How much did their breaches cost them and/or other parties?
- 26. Which story is better? A story: ● Vendor X reported three “incidents” last year ● They informed us of one of the three ● They lost the data of a competitor due to phishing ● The total loss amount was $5m USD A story: ● Vendor X has a risk rating of A- ● They have websites that don’t enforce HTTPS ● The vendor is mentioned in an unnamed forum on the dark web ● The range of industry losses is $500k-7m
- 27. “CISOs need to translate the cybersecurity request for funds into the language of the rest of the organization” — Doug Hubbard, author of “How to Measure Anything in Cybersecurity” Solution Source: https://www.youtube.com/watch?v=bYjPmptlc14
- 28. ● For cyber loss data: ○ Verisk, IHS Markit, Zywave ● For breach notification data: ○ Sign up for breachsiren.com ● Reading: ○ “How to Measure Anything in Cybersecurity Risk” by Doug Hubbard ○ FAIR Blog: Shopping for Cyber Loss Data by Allison Seidel Recommendations…
- 29. Your vendors are selling you bad, incomplete data. Who are their sources? 1. If they have NOT purchased a cyber loss feed from insurers, they cannot accurately quantify the financial impact of a risky vendor 1. If they are NOT sourcing breach notification data from all federal, state and industry regulators, they are not truly monitoring vendors. The Ugly Truth
Editor's Notes
- Note: Verizon DBIR historically used a small subset of breach data (~17 states) for trend analysis Fun Fact: How many TPRM vendors have this information? I’ve checked and to my surprise. I have yet to find a single one.
- This problem lives in our tools. How do we communicate value when our tools don’t use REAL data?
- One we’re missing the big metric = real money but more importantly we’re failing to tell a story. I want to know what’s impacted my competitors and industry peers quarterly and annual earnings. Not some breach study with averages or someone’s opinion on what the dark web values.
- Literally most of the tools in our industry are pushing us in the wrong direction here…
- We can do what Doug says to do which is to use historical observations and to also quantify those observations.
- To build out that story with data, we’re going to look at insurance and legal and deal with our topics for the day which are two different types of closely related data types (breach & cyber loss data). Before we hop in let me tell you a quick story about we ended up here…
- That was a clue that we needed more data and lead to the question what are breach notifications really?
- Show of hands. We know about HIPAA. Right but what if it’s just PII?
- Not 5, 10, 25 but all 50 states have laws requiring you to notify.
- What I find fascinating is that to be honest, I didn’t know this until last year. If your company is not notifying the state, you may be breaking the law. This gets really interesting when we think about whistleblowers. Let’s look at these and learn more…
- Here’s a breach reporting form for the state of New York in 2012. In a lot of cases, what happens is that inside counsel works with outside counsel who handles notification and contacts the AG’s office.
- Note: Verizon DBIR historically used a small subset of breach data (~17 states) for trend analysis Fun Fact: How many TPRM vendors have this information? I’ve checked and to my surprise. I have yet to find a single one.
- Secondary question: Can you compute reputational damage?
- As an example, here’s a slide from a presentation that I did many years ago on the Anthem (Wellpoint) breach of 80 million records of PHI. Here are the actual costs as reported in their annual reports and regular reporters.
- We could attempt to crunch the numbers ourselves but we cut corners here by understanding a little bit about how the insurance industry works…
- Now that we understand what it is and why it is. Let’s dive in to what the data looks like and how it can be used.
- Now that we understand what it is and why it is. Let’s dive in to what the data looks like and how it can be used. In this case, we have the largest cyber losses from last year. Instagram was the winner with $401m due to GDPR violation. The other top 4 were hacking losses in the cryptocurrency industry.
- For 2022, we can see that breach losses as a whole cost more than privacy losses.
- Fun fact: Insurers pay a ton of money for this data and there are entire companies that specialize in helping them model and price out risk. Starting price hundreds of thousands to millions of dollars annually.
- Let’s wrap up and talk solutions.
- Status Quo - Let’s assume that they’ve completed a questionnaire and in this case we just want to know about their technical risks. The current options let us check the box and lets be honest that does have value but there are so many gaps that it borders on fraudulent. What happens if a vendor doesn’t have a significant online presence? How does a letter grade tell me whether their using MFA or if they’re getting quality pentesting or not?
- Current tools can’t provide you this information and when they do its for a tiny subset of what’s out there. Again it’s time for change.
- Let’s suppose that your vendor process is the same in both of these stories. A questionnaire has been completed along with a quality SOC2. From here, we can arm legal with resources to build out meaningful asks for added insurance coverage or security language.
- Here’s one last quote from Doug Hubbard the author of #1 bestselling business math book, “How to Measure Anything” and also “How to Measure Anything in Cybersecurity.” Two of his books are required reading for the Society of Actuaries exam prep.
- Note: Verizon DBIR historically used a small subset of breach data (~17 states) for trend analysis Fun Fact: How many TPRM vendors have this information? I’ve checked and to my surprise. I have yet to find a single one.