CISO Summit No 16: Third Party Security and Patching: How to face this major vulnerability?

Third Party Security and Patching: How to face this major vulnerability?
In analyzing root causes of incidents, third party security and patching is strongly represented as a solution to attacks around 80% of the time. It is, thus, an utmost and urgent issue that needs addressd.

From the perspective of attackers, it is essential to run the attack-business well, which is why they invest 10-20% of their time investigating the weakest point in the targets’ defense concepts. Well protected multi-billion-dollar global companies are hard targets to hit, but their suppliers, their contractors, their clients and partners are often protected on a SME level only.
Against this background, the weakest links are often represented by a third party, which is an ideal situation for hackers to get an easy hook in to the well protected castle.

There are many statistical reports on patching., With an observed share of 50% of patched systems functioning 10 days after a patch has been implemented, it is clear that the patching sequence is in many cases far less effective than what it should be. However, the other 50% of systems are vulnerable with known weaknesses for which attack suits can be downloaded from the internet or the darknet. For any hacker, these are easy targets that can be conquered at very low cost.

The theory behind the topic is really very easy to understand, however, counter measures need many careful steps. There are two enlightening presentations on this topic in this summit. The first one deals with third party and patching issues in procurement and creates a binding framework for security issues in partnerships. The second one is based on real-time measurements in which the partners are controlled with software and information will be presented on the real important issues of how the observed weaknesses can be presented and eliminated.

As usual, the goal of Summit 16 is to learn from the speakers, from each other and from the material distributed before the meeting in order to explore today’s most compelling trends in addressing the information and cyber security challenges with the best set of controls.