An Understanding of Different Types of Vendor Data Breaches

In today’s business environment, the risk of a breach occurring at one of your third-party vendors is becoming more and more prevalent, so it’s important to stay on top of how they happen, why it can happen and what you can do. Vendor data breaches can come in all shapes and sizes, and they don’t necessarily have the same motives.

4 Types of Vendor Data Breaches

Not all vendor data breaches are the same. While some may be caused by malicious actors, many are simply the result of misconfiguration which can then lead to vulnerabilities within your vendor’s system. Here are some examples of common data breach types and how they can affect your vendors:

1. Misconfiguration: Many data breaches are in fact caused by misconfiguration, in which malware isn’t involved. A misconfiguration is an umbrella term given to situations where certain security settings aren’t correctly or optimally established. This can include incidents like a system that’s unpatched or old and out of date applications.
2. Malware: This is a broad term given to any type of harmful software that is specifically designed for exploitation. Here are just a few examples of how malware can be used:
   • Ransomware: This type of attack occurs when malware is installed to block access to a system or data, which can only be obtained after paying a ransom. Ransomware is often initiated through other means like spyware or viruses.
   • Viruses: These are secretly uploaded to a computer to perform damaging actions like stealing or deleting data.
   • Trojans: A trojan appears to be a legitimate program to trick a user into installing it to his computer where it can then carry out its intended activities of theft or destruction.
   • Spyware: This type of software is installed on a user’s computer to collect information either by recording keystrokes or monitoring website visits. Passwords, or other valuable information like financial records can be obtained through this method.
3. Phishing: A phishing email refers to a type of fraudulent email that appears to be sent from a legitimate source. The user who opens a link in a phishing email is often at risk of revealing passwords or banking information.
4. Denial of service (DoS): A DoS attack essentially forces a system to shut down by overwhelming it with various requests or traffic.

3 Prevention Methods

While vendor data breaches aren’t 100% preventable, there are some practical steps you can take to reduce the likelihood and severity of an event. Consider the following practices:

• Due diligence: It may seem overly simplified but performing due diligence assessments to understand the vendor’s security processes and controls is the first practical step you can take. When you have a thorough understanding of the vendor’s current situation, you’re in a better position to determine the appropriate controls needed to protect your organization’s data.
• Proper controls: Ensure that your vendors have implemented the necessary controls such as user authentication, intrusion prevention systems and breach notification and remediation processes. These should all be well defined in your vendor contract.
• Identification: Proper education and training will enable your vendor’s cybersecurity team to quickly identify and address any incidents before they become large scale issues.

Data Breach Objectives for Cybercriminals

Just as criminals use different methods for data breaches, they may also have different objectives. Here are two examples of what motivates these cybercriminals:

• Financial gain: As with many criminal activities, one of the primary goals of a data breach is financial gain. Most cybercriminals understand the high value of sensitive information and can use it at leverage it for top dollar either directly through a ransom demand or indirectly through selling it on the dark web.
• Non-financial gain such as activism or terrorism: It may be surprising to learn that some cybercriminals aren’t pursuing financial gain and are instead engaged in a type of “activism” or terrorism. The lines between hacktivism and cyberterrorism can often be blurred in today’s political environment. The infamous hacking group Anonymous was well known in its efforts against various world governments and corporations. These hackers were often more focused on promoting political or ideological ideas, instead of increasing their net worth. Cyberterrorism has also made headlines in recent years, with the Colonial Pipeline attack and Solar Winds hack being two well-known examples.
  
  These types of politically motivated attacks are often directed towards general infrastructure, with the intent to disrupt a society, and in serious cases, can endanger public health or safety. 

Next Steps After Your Vendor Suffers a Breach

As unpleasant as it may be, it’s best to operate under the assumption that your vendor will be the victim of a data breach. By being proactive and knowing what you can do when your vendor has a breach, you’ll be better prepared to deal with the aftermath with minimal consequences.

Follow these best practices to ensure that you’re protecting your sensitive data:

• Determine the breach’s impact: You’ll need to understand just how extensive the vendor data breach is to know how to carry out the remediation process.
• Follow regulatory guidelines: Make sure that you’re aware of your state or industry’s notification laws, which should be outlined in your remediation policy. Waiting too long to notify your customers of your vendor’s breach will put you at both compliance risk and reputational risk.
• Monitor your vendor: It’s critical to confirm that the breached vendor is taking the necessary steps to protect your sensitive data so you should continue to monitor them on an ongoing basis.
• Perform root cause analysis: It’s important to understand how and why the vendor data breach occurred to prevent it from happening again. Use the information found in the analysis to strengthen your current procedures and enhance your security controls.

Vendor data breaches are continuously evolving and becoming more sophisticated, so it’s important to stay current on emerging trends to protect your organization’s data. Also, remember that prevention is key to minimizing the effects of a data breach, so ensure you and your vendors are taking the proper precautions to mitigate your overall risk.