Vendor Risk Management

Transcription

1

2 Vendor Risk Management Using Big Data Analytics Marcel Knippen Onsight IT Security Experts IT Security Experts Onsight External Use 2

3 About Marcel Knippen Founder of Onsight Business Development About Onsight Since % focus on IT Security Security for Enterprises Risk Services Security Services Vendor Risk Management Enterprise Risk Management Security Monitoring Security Enforcement IT Security Experts Onsight External Use 3

4 Why Vendor (Third Party) Risk Management? Investors Customers Providers Suppliers Insurers Outsourcers IT Security Experts Onsight External Use 4

5 Your Digital Eco System - Per department. sales operations supply marketing finance IT Security Experts Onsight External Use 5

6 Third Parties impact most top business risks IT Security Experts Onsight External Use 6

7 Third party attacks In 70% of the attacks where we know the motive for the attack, there s a secondary victim IT Security Experts Onsight External Use 7

8 IT Security Experts Onsight External Use 8

9 KPMG refers to the use of ratings IT Security Experts Onsight External Use 9

10 IT Security Experts Onsight External Use 10

11 Current Vendor Risk Management Tooling Assessments Questionnaires Audits Penetration Testing Manual Cost intensive Low frequency Risk Monitoring Risk Mitigation Risk Profiling Due Diligence IT Security Experts Onsight External Use 11

12 How to improve Vendor Risk Management by using daily security ratings IT Security Experts Onsight External Use 12

13 The company is well on its way to being as widely recognized as a Moody s or S&P ratings for the information security space. IT Security Experts Onsight External Use 13

14 IntelliRatings DATA-DRIVEN RATING OF A COMPANY S SECURITY PERFORMANCE Companies are rated on a scale of High rating indicates a strong security performance, and lower security risk Analyzes, rates, and monitors companies security performance, all from the outside Daily ratings and alerts provide continuous visibility IT Security Experts Onsight External Use 14

15 PEER-TO-PEER FRAUD MALWARE SPAM VULNERABILITY BOTNET BREACH PHISHING CONFIGURATION VIRUS DDOS OUTSIDE-IN APPROACH LEVERAGING TERABYTES OF GLOBAL DATA Risk and event data from >100 sources (proprietary and exclusive) > new events observed daily (and growing) IT Security Experts Onsight External Use 15

16 Security Ratings Engine IT Security Experts Onsight External Use 16

17 Guiding Questions for Information Security How secure are my vendors? How secure is my supply chain? How secure am I? How do I compare to my peers? How do I know this acquisition is safe? How do we assess and manage cyber risk of our insured?. Am I better off now than this time last year?. Or last Month IT Security Experts Onsight External Use 17

18 How secure are my vendors? IT Security Experts Onsight External Use 18

19 How do my vendors compare? IT Security Experts Onsight External Use 19

20 How is my vendor trending? IT Security Experts Onsight External Use 20

21 Security Ratings Use Cases 1. Industry Supervising 2. Manage third party risks 3. Benchmark security performance 4. Underwrite cyber insurance 5. Investments, mergers & acquisitions What is your use case? IT Security Experts Onsight External Use 21

22 Whatever your use case is... You want to have a clear understanding of what s going on IT Security Experts Onsight External Use 22

23 Example: Explore a company IT Security Experts Onsight External Use 23

24 Dive deeper.. IT Security Experts Onsight External Use 24

25 And deeper.. IT Security Experts Onsight External Use 25

26 And get a clear understanding what is going on. IT Security Experts Onsight External Use 26

27 Example Use Case: Industry Supervising SuwiNet IT Security Experts Onsight External Use 27

28 Supervisor Use Case IT Security Experts Onsight External Use 28

29 IntelliRatings Results Sample14 of top 50 Dutch municipalities 11 have basic or intermediate security score Avarage score is decreasing Number of infections is increasing Time to resolve is increasing IT Security Experts Onsight External Use 29

30 Conclusions IT Security Experts Onsight External Use 30

31 The business value of security ratings Continuous and Objective Better communication Cost saving IT Security Experts Onsight External Use 31

32 Thank you! Questions? IT Security Experts Onsight External Use 32

33 IT Security Experts Onsight External Use 33