How does third-party risk complicate your operations?
Sort by:
In a past role, there was malware that appeared on our network and we weren't sure how it got there at first. It was wormable and it had propagated itself to a number of systems. After investigating, we found our patient zero: a network sniffer that was portable. The sniffer was maintained by the network engineering team who had a contract with a third party.
The third party would have these portable sniffers sitting on a shelf and they would ship them out to wherever they were needed. And they had a fourth party that was responsible for maintaining the image on those devices. They would get re-imaged each time they got sent back. But the fourth party had a malware compromise in their environment, so when they rebuilt the appliance on their network, it had the malware propagate to it. So that was a fun conversation to have with both the third and fourth party because we had to tell them, "You need to clean up your stuff."
When I was in biotech, we had these million dollar robots in a locked lab, with all this physical security around it. One day the technician for those robots walked in, stuck a USB stick in there and the whole machine got infected. We had to come up with something to prevent that from happening again, so we decided there would be no more USB sticks allowed. If a technician had to come update the firmware, they’d have to send us that firmware so we could put it on a secure drive. Then that could be plugged in. That's the only way we did it going forward.