4th Party Risk: The People Problem

4th Party Risk: The People Problem

managed it security services provider

Okay, so 4th Party Risk: The People Problem. It really boils down to, well, people! (Duh, right?) We spend so much time worrying about our vendors, you know, the 3rd parties we directly hire. managed services new york city We vet them, we check their security, we make em sign contracts promising they wont leak our data all over the internet.

4th Party Risk: The People Problem - managed services new york city

    But what about their vendors? managed service new york And their vendors vendors? Thats where the 4th party risk sneaks in, and its usually a people problem.


    Think about it.

    4th Party Risk: The People Problem - managed it security services provider

    1. managed service new york
    2. managed services new york city
    3. check
    4. managed service new york
    5. managed services new york city
    6. check
    7. managed service new york
    8. managed services new york city
    9. check
    10. managed service new york
    11. managed services new york city
    Company A hires Company B (a 3rd party) for, say, payroll processing. Company B, to save money or because theyre lazy, outsources part of that to Company C (a 4th party) in some other country. Maybe Company Cs employee, lets call him Bob, is disgruntled. Maybe Bob is just plain careless. Maybe Bob is easily tricked by a phishing email! Suddenly, our sensitive employee data is compromised because of Bob and Company C, and we didnt even know they existed!


    The chain of responsibility gets really blurry, really fast.

    4th Party Risk: The People Problem - managed it security services provider

    1. managed service new york
    2. managed it security services provider
    3. check
    4. managed service new york
    5. managed it security services provider
    6. check
    7. managed service new york
    8. managed it security services provider
    9. check
    Its hard enough keeping tabs on our employees and making sure theyre following security protocols. check How are we supposed to manage the security awareness (or lack thereof) of someone three layers removed from us?! We cant, really. Which is precisely what makes it so scary.


    So the "people problem" isnt just about malicious actors (though they exist!). Its about a whole spectrum of human error. managed service new york Its about lack of training, poor security hygiene, negligence, and just plain old mistakes. managed service new york And because these 4th parties are often smaller companies, they might not have the resources or expertise to properly train their employees or implement robust security measures.

    4th Party Risk: The People Problem - managed it security services provider

    1. check
    2. check
    3. check
    4. check
    5. check
    6. check
    7. check
    8. check
    9. check
    10. check
    11. check
    They might be more focused on just getting the job done than worrying about data protection. (Which, I get it, but still!)


    Its a real challenge to navigate. We need visibility into these 4th party relationships, even if its just knowing they exist. We need to ask our 3rd parties tough questions! Like, "Hey, who are you using, and are they any good?" And we need to consider the potential impact of a breach at that level. Its not foolproof, but its a start. Ultimately, managing 4th party risk means acknowledging that humans are the weakest link, and that the further down the chain you go, the harder it is to control them! Woah!

    managed it security services provider

    4th Party Risk: A Legal Minefield