Software Transparency

CHAPTER 2Existing Approaches—Traditional Vendor Risk Management

Traditional approaches to vendor risk management have been historically used to understand secure software development practices for software and product suppliers. The idea is that asking the vendor to answer a set of questions about how they approach certain security controls may be the only way to determine whether they understand what they should be doing, if they have a documented process to do it, and if they are doing what they say. It is accomplished by asking for additional evidence, indicating what they are doing. But first, let's unpack this a bit and examine the efficacy of this approach.

Assessments

To begin, these assessments suffer from a major scalability challenge. How can the enterprise conduct hundreds, if not thousands, of these assessments each year to support their risk management program? The most common answer is to leverage a standard questionnaire that they can send to all their suppliers, asking them all the same questions in order to benchmark their suppliers against each other. But which questions are good ones to ask? How many questions are enough or too much? Are all the suppliers evaluated the same way? How can we gain the context needed to ask good questions? How can we process all the questionnaires effectively? This is definitely a lot of work! It is cumbersome for not only the software consumers but also the software providers, as they must field several requests from their ...