Nearly three-quarters (71%) of enterprises which have specific data usage guidelines for partners and subcontractors received compensation after an incident that affected suppliers they share information with. In comparison, only 22% of organizations of the same size who do not have regulations in place reported this to be the case. These are the findings of a survey of IT security leaders conducted by Kaspersky.
According to Gartner research, 71% of organizations have more third parties in their network than they had three years ago – and the same amount expect this number to grow in the next three years. In order for subcontractors to fulfil their work obligations, companies often allow them access to their sensitive data and IT assets.
Kaspersky’s IT Security Economics report revealed that 79% of enterprises have special policies in place explaining to partners and suppliers how to work with shared resources and data, as well as any penalties they may incur. Their concerns make sense as, according to the survey, damage from incidents is estimated to cost $2.57m on average, with data breaches among the three costliest problems faced by enterprises. Kaspersky researchers has discovered a number of sophisticated supply chain attacks including ShadowPad.
One of the main benefits of implementing third party policies is that they solve issues around accountability by defining the areas of responsibility for both of the organizations involved. Consequently, it increases the chances that a company will get compensation from a supplier that becomes an entry point for an attack. 71% of enterprises with a third party policy reported to receive monetary recompense after an incident, compared to only 22% of peers who did not have regulations in place. Policies boost the likelihood of compansation amongst SMBs as well. For instance, 68% of SMBs with policies received money, compared to only 28% of those who didn’t implement rules for their subcontractors.
The survey did not indicate whether or not data breach policies make supply chain attacks any less frequent. Almost a quarter (24%) of enterprises that implemented special IT policies for third parties experienced a data breach because of a cybersecurity incident affecting suppliers and only nine percent of companies without such rules confirmed that they had suffered an attack.
“The results of our survey may seem rather paradoxical with enterprises with special policies saything they have experienced supply chain attacks more often. However, we can suggest that a business with a wider network of third party organizations will pay more attention to this area, which results in implementing specific guidelines. Nonetheless, a vast network of subcontractors may make such data breaches more likely. Besides, organizations with third party policies can more accurately determine the causes of a particular breach,” comments Sergey Martsynkyan, Head of B2B Product Marketing at Kaspersky.
To stay protected from supply chain attacks, Kaspersky recommends taking the following security measures:
- Regularly update your list of all partners and suppliers, as well as the data they can access. Ensure that they only have access to the resources they need to carry out their work. Confirm that organizations that don’t collaborate with your company are excluded and cannot access or use data and assets.
- Provide all third parties with the requirements they should follow – including compliance and security practices.
- Kaspersky offers Kaspersky Anti Targeted Attack that can detect advanced attacks that may have gone under the radar of perimeter protection solutions, including supply chain attacks, at an early stage.
The full report is available here.
-Ends-
About the survey
The Kaspersky Global Corporate IT Security Risks Survey (ITSRS) is a global survey of IT business decision makers, which is now in its 9th year. A total of 4,958 interviews were conducted across 23 countries. Respondents were asked about the state of IT security within their organizations, the types of threats they face and the costs they have to deal with when recovering from attacks. The regions covered include LATAM (Latin America), Europe, North America, APAC (Asia-Pacific with China), Japan, Russia and META (Middle East, Turkey and Africa).
About Kaspersky
Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 270,000 corporate clients protect what matters most to them. Learn more at www.kaspersky.com
For further information please contact:
Sweta Fernandes, Account Executive
Mobile: +971 56 2467612, Golin, KasperskyTeam@golin.ae
Disclaimer: The contents of this press release was provided from an external third party provider. This website is not responsible for, and does not control, such external content. This content is provided on an “as is” and “as available” basis and has not been edited in any way. Neither this website nor our affiliates guarantee the accuracy of or endorse the views or opinions expressed in this press release.
The press release is provided for informational purposes only. The content does not provide tax, legal or investment advice or opinion regarding the suitability, value or profitability of any particular security, portfolio or investment strategy. Neither this website nor our affiliates shall be liable for any errors or inaccuracies in the content, or for any actions taken by you in reliance thereon. You expressly agree that your use of the information within this article is at your sole risk.
To the fullest extent permitted by applicable law, this website, its parent company, its subsidiaries, its affiliates and the respective shareholders, directors, officers, employees, agents, advertisers, content providers and licensors will not be liable (jointly or severally) to you for any direct, indirect, consequential, special, incidental, punitive or exemplary damages, including without limitation, lost profits, lost savings and lost revenues, whether in negligence, tort, contract or any other theory of liability, even if the parties have been advised of the possibility or could have foreseen any such damages.
