97 Things Every Information Security Professional Should Know

Chapter 6. Security, Privacy, and Messy Data Webs: Taking Back Control in Third-Party Environments

Ben Brook

One of the most common challenges for InfoSec professionals is the lack of visibility into the security and data protection practices of third-party ecosystems, including those owned by partners and vendors. Core business functions like marketing, HR, sales, customer service, finance, and even engineering teams increasingly use third-party software to run daily operations. Reclaiming security in a messy and poorly linked system requires new tools.

Today, the average company uses more than 200 software as a service (SaaS) vendors.¹ Too often, the onus is put on legal colleagues to develop contracts and liability clauses that offer paper promises instead of true, deep, and technical system checks we can audit and log. Contracts and policies can’t guarantee technical execution, and words are not engineers.

The framework below is one way to approach managing privacy across data silos when you don’t have full control of the environment.

Establish Technical Visibility

1. Understand who has what. Until there is a way to do this at the code level, leveraging vendor assessments in your procurement process is a solid starting point to identify who has access to which systems and data. Depending on your organization’s risk posture and tolerance, you may also decide to require vendors ...