CrowdStrike Outage: Lessons for Third-Party Vendor Risk Management Programs

Four Best Practices for Proactive Third-Party Incident Response

The announcement of a high-impact incident, regardless of cause, is the wrong time to ensure your organization has a third-party incident response plan in place. Instead, start preparing for the next incident through implementing a proactive approach now. Here are four best practices to start with:

1. Develop a centralized inventory of all third parties

A centralized vendor inventory needs to be created in a platform, not manual spreadsheets, so all the necessary internal teams can participate in vendor management through an automated process. Once that’s done, you need to conduct inherent risk scoring to help determine how to assess your third-party vendors on an ongoing basis according to the risks they pose to your business.

2. Build a map of third parties to determine technology concentration risk

Knowing about the 4th-party technologies deployed in your vendor ecosystem helps to identify relationships between your organization and third parties based on certain technology usage.

Once you understand this, you can better determine possible concentration risks like weak points and access paths into your enterprise for proactive mitigation. You can accomplish this through a targeted assessment or via passive scanning.

3. Assess third parties’ business resilience and continuity plans

Proactively engage impacted vendors with simple, targeted assessments that align with known industry supply chain security standards such as NIST 800-161 and ISO 27036. Results from these assessments will help you target remediations to close potential gaps. Good solutions will provide built-in recommendations to speed up the remediation process and close those gaps quickly.

4. Continuously monitor impacted vendors and suppliers for issues

Being continuously vigilant for the next supply chain problem means looking for signals of an impending incident. Monitoring multiple sources of risk intelligence, such as criminal forums, hack/breach notice sites, code repositories, and vulnerability databases, is key. You can monitor these sources individually or find solutions that unify all the insights into a single dashboard so all risks are centralized and visible to the enterprise. The CrowdStrike issue was thankfully not from a malicious source, but risk monitoring remains a key component in understanding your exposure to a third-party incident.

What Next?

Over the next few weeks, companies affected by the CrowdStrike outage are likely going to be spending a significant amount of time recovering their systems. Vendors, large and small, will be contending with the business slowdown and bringing potentially many thousands of end-user machines back into service. Understanding which of your vendors have been impacted the most should be a good indication of what to do next and how to ensure that you – if you’re not also dealing with the outage – don’t experience the same slowdown in business.

Looking to mature your third-party risk management program and be better prepared for future incidents like this one? Learn how Prevalent can help by requesting a demo of our TPRM platform today.