<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

How to Discover Vendor Cybersecurity Flaws Before Data Thieves Exploit Them

author Michael Berman
2 min read
Mar 8, 2019

Cybersecurity ratings have come a long way since they were first introduced.

Today’s cybersecurity ratings are a guide for uncovering and addressing cybersecurity issues that need to be resolved before they are exploited. In a world where financial institutions have a multitude of vendors with access to sensitive information, ratings help identify third-party vendors that are real-time risks, allowing a financial institution  to take action to mitigate the threat.

A detailed cybersecurity rating lets you know which of your vendors are most susceptible to a breach before it happens and helps identify vendors that are not aligned with your institution’s cyber risk appetite.

How do you know if a cybersecurity rating is covering all the bases? Make sure it monitors these key areas:

  • Open ports. Monitors ports exposed to the public internet to determine if unnecessary access points exist.
  • TLS/SSL certificates. Monitors records to verify accuracy of vendor’s servers and relationships to establish cryptographic trust.
  • TLS/SSL configuration. Monitors records to ensure that servers have properly configured security protocol libraries and support strong encryption standards.
  • Sender Policy Framework (SPF). Monitors DNS records to identify which mail servers are permitted to send email on behalf of a domain to prevent hackers from forging email.
  • Domain Keys Identified Mail (DKIM). Monitors protocols to prevent unauthorized servers from sending email on behalf of a company’s domain.
  • Network security. Monitoring for database vulnerabilities, lack of proper network security measures.
  • DNS health. Monitoring for multiple DNS configuration settings to determine inappropriate vs. recommended configurations.
  • Patching cadence. Monitoring frequency of patching operating systems, services, applications, software, and hardware in a timely manner.
  • Endpoint security. Monitoring for protection of a vendor’s laptops, desktops, mobile devices, and all employee devices that access the vendor’s network.
  • IP reputation. Monitoring millions of malware signals from all over the world to detect infected IP addresses attributed to vendors to determine a level of risk and the quantity and duration of the infections.
  • Web application security. Monitoring for cross-site scripting attacks and SQL injection attacks.
  • Mobile application security. Monitors mobile applications in Android and iOS devices connected to the vendor’s network with known security risks that could compromise the vendor’s network.
  • Hacker chatter. Monitors hacker communications from multiple streams to determine if a vendor is discussed and/or targeted.
  • Leaked credentials. Monitors all sensitive information that is exposed as part of a data breach or leak, keylogger dumps, paste bin dumps, database dumps, and other information repositories, which are associated with vendor email addresses or other vendor dates to access likelihood of a data breach.
  • Social engineering. Monitors factors related to social engineering, which include vendor employees using network devices for social networks, personal finances, marketing lists, etc. that can be exploited.

Vendors are not always quick to alert their clients of a cybersecurity issue, and vendors can  often be unaware of issues. For example, Scottrade only discovered it had exposed 20,000 customers’ data because an outside white hat researcher uncovered the flaw.

Don’t wait for a vendor to reveal an issue. Make sure you are being as proactive as possible in identifying and mitigating potential vendor data breaches. As a financial institution, you can’t afford to take risks with your reputation.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
When Customers Invite Third-Party Risk
Risk Management

When Customers Invite Third-Party Risk

Jan 9, 2020 4 min read
Third-Party Vendors & Compliance Risk: 10 High-Risk Compliance Situations
Risk Management

Third-Party Vendors & Compliance Risk: 10 High-Risk Compliance Situations

Jun 18, 2020 3 min read
Examiners Will Be Focusing on Your Institution’s Riskiest Areas. Do You Know What They Are?
Risk Management

Examiners Will Be Focusing on Your Institution’s Riskiest Areas. Do You Know What They Are?

Dec 7, 2018 2 min read