LastPass Breach: 3 Best Practices for Third-Party Incident Response

On December 22, 2022, password management company LastPass announced that an unknown threat actor leveraged information obtained during an August 2022 security incident to access a third-party cloud-based storage service that LastPass uses to store archived backups. Although LastPass claims that the threat is minimal due to their data encryption methods, attackers could have access to:

• Customer account information and related metadata, including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service; and
• Unencrypted data, such as website URLs, as well as fully encrypted sensitive fields, such as website usernames and passwords, secure notes, and form-filled data

As a result of the breach, LastPass recommends that customers take an extra measure of caution and change their master passwords to prevent any potential downstream risks such as from a credential stuffing attack.

This incident is yet another example of how organizations can be impacted by a third-party vendor breach and events in their fourth-party ecosystem. This post reviews three practices to improve discovery and mitigation of vendor security incidents, and offers some basic questions to probe vendors on their exposure to the latest LastPass data breach.

3 Best Practices for Third-Party Vendor Data Breach Mitigation

Although it is not possible to eliminate all risk from every vendor relationship, your third-party risk management program can still deliver the visibility and automation to effectively find and mitigate the risk before further damage or disruption to your business can occur. Start with these three steps:

1. Identify vendors that could be using the impacted technology

Knowing which vendors use an impacted technology requires knowing who your vendors are in the first place, and that means building a centralized vendor inventory. You can’t accomplish this by using spreadsheets, or by delegating vendor management to line-of-business teams. It has to be done centrally in a system that everyone in the organization with a hand in vendor management can access. You should be able to import vendors from those spreadsheets or use an API connection to an existing procurement solution into a central system of record.

Once you have centralized all your vendors use vendor questionnaires supported by passive scanning capabilities to help you identify fourth-party technology relationships. In this particular breach case, this exercise would reveal which vendors use LastPass (and by proxy, the third-party cloud backup provider that was breached). Collecting information about fourth-party technologies deployed in your vendor ecosystem helps to laser in on organizations using the impacted technology so you can prioritize vendors to further assess.

2. Issue event-specific risk assessments

Once you have identified vendors with the impacted technology deployed in their environments, engage those impacted vendors with simple, targeted assessments that align with known security standards and best practices such as NIST 800-161 and ISO 27036. Results from these assessments will help you target needed remediations to close potential security gaps. Good solutions will provide built-in recommendations to speed the remediation process and close those gaps quicker.

Start your event-specific assessment with the following eight questions, weighting answers according to your organization’s risk tolerance: