Look at the past week's cyber cases and a clear pattern emerges. Crédit Mutuel Arkéa was not breached through its own systems, but through a technology vendor's platform, and the attackers took about $133 million from there. SEGA was not breached at all, but 2.2 million of its customers' addresses leaked from email vendor Arara, breached along with hundreds of other customers. Attackers are not storming the fortress. They are attacking the vendor with a key.
The logic is clear. A large organization spends a fortune on security: teams, systems, testing. Its vendor, often much smaller, spends less. But to provide its service, the vendor gets access: to the customer list, the payment system, sometimes the money itself. For the attacker, it is simply the cheaper route. And one breach of a vendor serving hundreds of organizations is worth hundreds of breaches.
The problem is that responsibility does not move with the service. SEGA's customers do not know what Arara is, and they will blame SEGA. A regulator will not accept 'it was the vendor' from a bank. And yet in most organizations, vendor risk management is a questionnaire sent once a year, filled in by the vendor itself and stored in a folder. That is not risk management, it is legal cover.
What actually works? Three things. First, give each vendor only the minimum access it needs, and verify it in practice, not just in the contract: an email vendor does not need home addresses, and a technology vendor does not need permission to move money without additional approval. Second, monitor the actions a vendor takes as if it were a potential attacker, because on a bad day it is one. And third, plan in advance what to do when a vendor is breached, including how to cut it off quickly.
Israeli companies also have an opportunity here. Much of Israel's cyber industry is built on exactly this problem: permissions management, monitoring third-party access and protecting data across the supply chain. But organizations in Israel, from banks to insurers and retail chains, should also ask themselves a simple question this week: if our least secure vendor is breached tomorrow, what does the attacker get? Those who cannot answer already have their answer.
