Cybersecurity Awareness Month, Part 5: Your Vendors Are Your Risk

In December 2020, it came out that SolarWinds - a company whose network management software was used by 33,000 organizations including most Fortune 500 companies and multiple US government agencies - had been compromised. Attackers had inserted malicious code into a routine software update. Every organization that installed the update let the attackers into their network. Willingly. Through their own patch management process. The irony was brutal.

In 2023, a vulnerability in MOVEit, a managed file transfer tool, exposed data from over 2,000 organizations - not because those organizations had poor security, but because their file transfer vendor did. In 2021, Kaseya's remote management platform was compromised, pushing ransomware to roughly 1,500 businesses through the very tool their IT providers used to protect them.

The pattern is clear and it keeps repeating. Your vendors aren't just service providers. They're attack surface.

Understanding Third-Party Risk

Every vendor that has access to your data, your network, or your systems carries risk. That risk scales with the level of access and the sensitivity of the data involved. A vendor that provides office plants has different risk than a vendor that manages your cloud infrastructure. Both are vendors. The risk profile couldn't be more different.

Think about the vendors in your environment right now:

• Your IT provider (that's us - and yes, we subject ourselves to the same scrutiny we're recommending here)
• Your cloud service providers - Microsoft, Google, AWS
• Your SaaS applications - CRM, accounting, project management, HR
• Your payroll processor
• Your benefits administrator
• Your billing or payment processing vendor
• Any contractor or consultant with remote access to your systems
• Your web developer, marketing agency, or SEO company (do they have credentials to your website, analytics, or social media?)

Each of those vendors has some combination of access to your systems, your data, or both. Each one is a potential path for an attacker who can't get to you directly. Why attack a well-defended target when you can attack their less-defended vendor and walk in through the side door?

The Vendor Assessment Process

Vendor risk management doesn't require a massive compliance department. It requires asking the right questions before you grant access and periodically after. For small and mid-sized businesses, a practical vendor assessment covers four areas:

1. What data will this vendor access? Customer PII? Financial records? Protected health information? Employee data? Intellectual property? The sensitivity of the data determines the rigor of the assessment. A vendor that never touches your data needs minimal assessment. A vendor processing your payroll needs a thorough one.
2. What access will this vendor have? Read-only access to a reporting dashboard is different from admin-level access to your cloud environment. Document the minimum access required for the vendor to do their job. Grant that. Nothing more.
3. What are their security practices? This is where vendor security questionnaires come in. A standard questionnaire covers encryption, access controls, employee background checks, incident response, backup practices, and insurance. The Shared Assessments SIG questionnaire and the CAIQ (Consensus Assessments Initiative Questionnaire) are industry standards, but even a simplified 20-question questionnaire is better than nothing.
4. Can they prove it? Self-attestation is a starting point, not a finish line. Ask for evidence: SOC 2 Type II reports, ISO 27001 certification, penetration test summaries, cyber insurance certificates. A SOC 2 Type II report is the gold standard for SaaS vendors - it's an independent auditor's assessment of the vendor's security controls over a period of time (typically 12 months). If a vendor can't produce one, that's not necessarily a deal-breaker, but it means you need to do more due diligence yourself.

Red Flags in Vendor Assessments

We've reviewed hundreds of vendor security postures for our clients. Certain responses consistently indicate higher risk:

• "We take security seriously." Every vendor says this. It means nothing without specifics. Probe further.
• No SOC 2 report and no timeline for obtaining one. For vendors handling sensitive data, this is a gap. It's increasingly a market expectation, and vendors without it are increasingly being excluded from consideration.
• Shared credentials. If a vendor's team shares a single set of credentials to access your environment, there's no accountability, no audit trail, and no way to revoke one person's access without affecting everyone.
• No MFA on their own systems. If a vendor doesn't require MFA for their employees, their accounts are easier to compromise - and a compromised vendor account becomes your problem.
• Resistance to the assessment process. Reputable vendors expect security questionnaires and have standardized responses ready. A vendor that pushes back on basic security questions is telling you something about their security maturity.
• No cyber insurance. A vendor without cyber insurance may not be able to support you (or themselves) through an incident. It also suggests they haven't been through the insurance application process, which itself is a basic security assessment.

Limiting Vendor Access

The principle of least privilege applies to vendors just as much as it applies to employees. Actually, more. Vendors should have:

• Named accounts. Every vendor employee who accesses your environment should have an individual account. No shared logins. Individual accountability.
• Time-limited access. If a vendor needs temporary access for a project, that access should have an expiration date. Not "we'll disable it when the project is done" - an actual expiration in the system.
• Scoped permissions. Access only to the systems and data necessary for the vendor's function. Your marketing agency doesn't need access to your financial systems. Your payroll vendor doesn't need access to your file shares.
• Monitored sessions. For vendors with privileged access, session recording and logging provides an audit trail of exactly what was done, when, and by whom.
• MFA enforcement. Every vendor account should require MFA. No exceptions. If a vendor can't support MFA, find a different vendor.

API Security: The Invisible Access Layer

Modern SaaS applications communicate through APIs. When you connect your CRM to your email marketing platform, or your accounting software to your bank, those integrations use API keys or OAuth tokens that provide ongoing access. These connections are easy to create and easy to forget about.

Audit your API integrations. In Microsoft 365, check Enterprise Applications in the Entra ID admin center - you may be surprised by how many third-party apps have been granted access to your tenant. In Google Workspace, check the Security > API Controls section. For each integration, ask: is this still needed? What data can it access? Who authorized it? Does the vendor still need this level of access?

We've seen Microsoft 365 tenants with 30+ third-party applications granted read/write access to email, calendars, and files - applications that nobody at the company remembers authorizing. Each one is a potential access point if that third-party vendor is compromised.

Supply Chain Attacks: What You Can Do

You can't prevent the next SolarWinds. But you can limit your exposure. Practical steps for supply chain risk reduction:

1. Maintain an inventory of all vendors with access to your data or systems. You can't manage what you don't know about.
2. Classify vendors by risk tier based on data sensitivity and access level. Tier 1 vendors (high access, sensitive data) get formal assessments. Tier 3 vendors (minimal access, no sensitive data) get basic review.
3. Review vendor access quarterly. Remove access that's no longer needed. Verify that named accounts are still current.
4. Include vendor compromise scenarios in your incident response tabletop exercises (see Part 4). If your IT provider is compromised, what's your plan?
5. Monitor vendor security news. Services like UpGuard and SecurityScorecard provide continuous monitoring of vendor security posture. For smaller businesses, even setting up Google Alerts for your critical vendors plus "breach" or "vulnerability" is better than nothing.

Part 6, the final installment in this series, will pull everything together - building a security culture that doesn't end when October does. If you'd like help evaluating your vendor risk or cleaning up third-party access in your environment, we do this regularly for our managed IT clients and we're happy to have the conversation.