In my line of work, I’m reminded on a daily basis that hackers follow the path of least resistance. And this path often leads them to the doorstep of third-party vendors.
As a former CISO who now helps oversee risk management at Mastercard, I’m amazed by the sheer amount of work that’s needed to keep organizations secure from the inside out.
To learn more about how RiskRecon can help you assess and manage your third-party risk, request a demo.
Request a demo
1. https://www.gao.gov/blog/solarwinds-cyberattack-demands-significant-federal-and-private-sector-response-infographic
2. https://www.experian.com/blogs/ask-experian/moveit-data-breach/
3. https://energycommerce.house.gov/posts/what-we-learned-change-healthcare-cyber-attack
4. https://www.riskrecon.com/state-of-ransomware-report-2024
See also:
https://blog.riskrecon.com/powerful-third-party-breach-predictor-0
https://blog.riskrecon.com/powerful-third-party-breach-predictor
https://blog.riskrecon.com/the-power-of-risk-ratings-platforms-driving-better-risk-decisions
https://blog.riskrecon.com/vendor-based-breach-events
Previous
BIN attacks
Next
Ransomware
One of the best ways to address this challenge is by diving into the data of past breach events. Analyzing these patterns sheds light on how to create excellent cybersecurity hygiene practices.
Analyzed
14,413
publicly reported breaches
With this mission in mind, Mastercard Cybersecurity cataloged and analyzed 14,413 publicly reported breaches between 2012 and 2023.
Analysts from our RiskRecon third-party risk management team homed in on the mechanics of hacks — down to the days of the week criminals favor — and found:
1
Vendors are a growing target
More and more hackers are deploying “supply-chain” or “third-party” attacks, in which they sneak malware into a provider’s products and infect the clients who use them.
Last year, for the first time, these third-party breach events outnumbered direct-attack breaches by nearly three times.
Several of those breaches have been high-profile events. For example, in 2020, hackers embedded malicious code into a popular line of IT monitoring tools1 from a developer called SolarWinds.
As a result,
customers who installed SolarWinds’ next software update — including thousands of federal agencies and Fortune 500 companies — unknowingly bugged their own networks. A 2023 ransomware attack on MoveIT,2 a file-transfer tool, exposed the data of third- and even fourth-party entities around the world.
2
Ransomware is on the rise
Ransomware attacks are a constant threat that hang over the head of every organization. Criminals seeking a ransom payout have learned that their most effective leverage is a company’s operational and data protection obligations to other organizations.
As the Change Healthcare ransomware attack3 shows,
the failure of even a single business-to-business service can wreak havoc on an entire industry. Our 2024 State of Ransomware Report4 dives into this in more detail.
Staying safe — and protected
In a heavily interconnected digital economy, where businesses rely on each other for critical products and services, how can you stay safe? Without a comprehensive understanding of the risks posed by each vendor, organizations are essentially navigating blindfolded through treacherous terrain.
By harnessing the power of data analytics and machine learning, risk ratings platforms automate parts of the vendor assessment process to streamline workflows and drive efficiency.
The right solutions empower companies to mitigate threats and bolster resilience in the face of uncertainty.
Home
Threatcasting
Threatcasting
BIN attacks
BIN attacks
CISO Lessons
CISCO lessons
Ransomware
Ransomware
The Trust Center
The Trust Center
Power of STEM
Power of STEM
Zero Trust
Zero trust
Kelly White
Lessons learned: