Tag: third-party risk

• See: China hacked a Navy contractor and secured a trove of highly sensitive data on submarine warfare

Third-party risk (or nth-party risk) is a hot topic in cybersecurity. While it can mean many things, at its core third-party risk describes a situation in which an organization that does a good job of protecting its own network and data, within its environment, works with other organizations that do not do such a good job and those organizations (third-parties or nth-parties), through their weaker security practices, put the first party’s network and data at risk.

This past week we learned that hackers had access to the network of a relatively small company that is a contractor for the Australian Signals Directorate for almost a year. The hackers were able to exfiltrate roughly 30GB of data including data about sensitive United States military assets such as “restricted technical information on the F-35 Joint Strike Fighter, the P-8 Poseidon maritime patrol aircraft, the C-130 transport aircraft, the Joint Direct Attack Munition (JDAM) smart bomb kit, and a few Australian naval vessels.” Read more about the attack here: Hackers steal restricted information on F-35 fighter, JDAM, P-8 and C-130

This is a classic example of cybersecurity third-party risk and one every business should understand — just ask Target about it’s HVAC vendor, Fazio Mechanical. If you’re interested in learning more about these concepts, take a look at a recent checklist I created: Managing Third-Party Risk in Cybersecurity

For yesterday’s example of third-party risk see Third-Party Risk in Cybersecurity Exemplified by North Korea’s Stealing of US War Plans.

Third-party risk (or nth-party risk) is a hot topic in cybersecurity. While it can mean many things, at its core third-party risk describes a situation in which an organization that does a good job of protecting its own network and data, within its environment, works with other organizations that do not do such a good job and those organizations (third-parties or nth-parties), through their weaker security practices, put the first party’s network and data at risk.

This past week we learned that the North Koreans stole the United States’ war plans for battle with North Korea. How did they do this? By cyber attack — not on the United States, which likely had the plans fairly well secured — but by cyberattack against the United States’ “partner” in this endeavor, the South Koreans, with whom the US had shared its plans. Read more about the attack here: ‘Ridiculous Mistake’ Let North Korea Steal Secret U.S. War Plans

This is a classic example of cybersecurity third-party risk and one every business should understand — just ask Target about it’s HVAC vendor, Fazio Mechanical. If you’re interested in learning more about these concepts, take a look at a recent checklist I created: Managing Third-Party Risk in Cybersecurity