Outline what can be learned from the case studies presented.
The idea
The case studies of third-party failures share a pattern even though the triggers differ. In the 2013 Target breach, attackers entered through credentials of a heating and cooling contractor. A small vendor with network access became the route to a large firm. In the SolarWinds compromise of 2020, a trusted vendor's software update was itself corrupted and carried to its customers. In the July 2024 CrowdStrike outage, a faulty content update from one security vendor crashed large numbers of Windows machines worldwide, with no attacker involved. The lessons are to limit and segment vendor access and to treat vendor software updates as a source of risk. Firms should also stage rollouts and plan for manual recovery. They should not rely on a vendor's attestation or contract alone. Exam point: a vendor failure becomes your own operational incident, so build your own resilience.
A practice question
In the 2013 Target data breach, attackers gained their initial access to the retailer's network through:
- a flaw in the retailer's own point-of-sale software that was patched too late.Why not: Attributes the breach to internal software; the entry point was a contractor's credentials.
- a malicious software update shipped by the retailer's main security software vendor.Why not: Confuses Target with a supply-chain software compromise such as SolarWinds.
- a physical break-in at one of the retailer's distribution centres.Why not: Invents a physical intrusion; the access was gained remotely using a vendor's credentials.
- credentials stolen from a heating and cooling contractor. - correct
The attackers used credentials belonging to a contractor, so a small third party with network access became the route into a large firm. The lesson is to limit and segment vendor access.
A harder one
In the 2020 SolarWinds compromise, attackers inserted malicious code into a software update from a trusted vendor that customers then installed. Which lesson for third-party risk management follows most directly?
- Firms should avoid installing any software update from any vendor.Why not: Overreacts; unpatched software creates its own risk, so the lesson is controls around updates, not refusal to update.
- Questionnaires are not enough; firms must also monitor vendor software and limit its privileges. - correct
- Only vendors that are listed on a stock exchange can be trusted to maintain secure software.Why not: Uses listing status as a safeguard; nothing in the case suggests public companies are immune.
- The risk lay only with the vendor, so customers could not have reduced their exposure by any means.Why not: Denies customer responsibility; least privilege, segmentation and monitoring can contain a compromised vendor tool.
Trusted vendor software can be the attack route, so firms need their own monitoring and least-privilege controls. Paper-based diligence on the vendor cannot detect a compromised build process.
The hardest tier
After a security incident at a vendor, a bank's executive says: the vendor holds a current independent security attestation, so the bank did nothing wrong. Which response best reflects what the case studies teach?
- An attestation is point-in-time and does not replace the bank's own access limits and monitoring. - correct
- The executive is correct because a current independent attestation transfers responsibility for the incident to the vendor.Why not: Treats the attestation as a transfer of accountability, which does not happen.
- The executive is correct only if the attestation was issued by the vendor's own internal audit function.Why not: Prefers self-assessed assurance, which is weaker than independent evidence and still not a substitute for the bank's own controls.
- The attestation proves that the incident could not have occurred, so the claim of a vendor failure must be wrong.Why not: Treats a past-looking attestation as proof of future security, which no control assurance can provide.
Attestations describe controls at a point in time and cannot transfer accountability or guarantee future security. The bank still needs its own access limits, monitoring and response plans.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →