Headlines

Evaluating New Partners and Vendors: Assessing Identity Security Risks in Today’s Landscape

Evaluating New Partners and Vendors: Assessing Identity Security Risks in Today's Landscapewordpress,partners,vendors,identitysecurity,riskassessment,landscape

Effective Identity Management: A Crucial Aspect of Enterprise Security

In today’s digital landscape, effective identity management is crucial for enterprise security, enablement, and ultimately, success. However, many business leaders outside the IT and security space often have only a surface-level understanding of identity security. It’s a complex topic that requires a firm grasp on access, governance, entitlements, and permissions, particularly in protecting on-premises solutions, cloud environments, and multitenant software-as-a-service (SaaS) tools. Third-party risk management (TPRM) is of utmost importance in this regard, especially when vetting new vendors, particularly security vendors.

Why Evaluate Vendors and Suppliers?

While evaluating a vendor’s technical and functional prowess is essential, it shouldn’t be the sole decision-making criteria for establishing a successful long-term partnership. It’s important to comprehensively evaluate a vendor beyond its technical capabilities alone.

One critical aspect to consider is the long-term viability of security vendors. An effective identity security solution must be integrated across all environments and protect tens (if not hundreds) of thousands of identities. Business leaders should assess whether the security vendor will still be around in the future, whether it’s two, five, or ten years down the line. Switching security providers can be a challenging and risky process, which makes choosing a financially stable and viable partner an imperative consideration.

Another crucial factor is the company’s history of technical innovation. It’s essential to evaluate not only what the company is doing presently but also whether it has a track record of adapting quickly to new trends or if it tends to lag behind. A security vendor’s ability to innovate is vital in keeping pace with evolving threats and providing cutting-edge solutions to mitigate risks.

Perhaps the most critical evaluation point is assessing the level of risk associated with a potential vendor. Has the company been breached recently, and if so, how did it respond? Chief information security officers (CISOs) and chief information officers (CIOs) bear the responsibility of safeguarding their organizations against breaches that can cost millions of dollars and damage the brand. Therefore, understanding a vendor’s risk profile is of paramount importance.

Questions to Ask Potential Vendors

Before engaging with a new vendor, it’s crucial to ask the right questions that assess the non-technical capabilities that could impact an organization’s risk profile. Several key questions to consider include:

  • Financial health: Request audited financials and review the company’s funding and ownership model to gauge its financial stability. A poorly structured company can be a red flag that might impact future support and continuity.
  • Business culture: Gain an understanding of the company’s culture, as disgruntled employees with access to privileged identities can pose significant risks.
  • Service level agreements (SLAs) and contracts: Review the vendor’s SLAs and contracts to understand how it operates and interacts with clients. Clear and robust agreements can provide insights into the vendor’s commitment to security and ongoing support.
  • Customer references: Assess the satisfaction levels of the vendor’s existing (and past) customers. Metrics like Net Promoter Score (NPS) and Customer Satisfaction Score (CSAT) can reveal how clients feel about the company’s service quality. Additionally, understanding why companies may have left a vendor can provide valuable insights into potential pitfalls.
  • Security and compliance status: Inquire about the vendor’s security certifications, data residency practices, and use of on-premises versus cloud solutions. Understand how the vendor aligns with data privacy regulations such as the General Data Protection Regulation (GDPR) and California Privacy Rights Act (CPRA). Evaluating its compliance with industry standards like SOC 2 and ISO 27001 can offer valuable insights into its commitment to security best practices.

While these questions may not provide a complete picture of a vendor’s capabilities, they offer a valuable glimpse into how the vendor approaches security and the likelihood of compromise to an organization’s identity security.

The Importance of Limiting Third-Party Risk

In a landscape where third-party attacks continue to rise, businesses must take proactive steps to limit third-party risk when considering new vendors and partners. An inadequate security program can expose an organization to significant risks.

When onboarding new security vendors, organizations must exercise diligence and be ruthless in their evaluations. Assessing factors such as the vendor’s financial standing, company culture, and approach to security is paramount in minimizing potential risks. The consequences of settling for a vendor that is “good enough” can be severe, resulting in breaches that cost millions of dollars and cause reputational damage.

Picking the right partner for a successful identity security program is a crucial element in safeguarding an organization’s assets and reputation.

About the Author

Matt Mills, the President of Worldwide Field Operations at SailPoint, brings over 30 years of experience in enterprise software and selling complex solutions. With a proven track record of leading high-growth sales organizations, Mills has previously served as CEO of MapR, repositioning the company as an enterprise-class converged data platform. He also held key leadership roles at Oracle for 15 years, leading divisions within the company’s North American sales organization.

Security-wordpress,partners,vendors,identitysecurity,riskassessment,landscape


Evaluating New Partners and Vendors: Assessing Identity Security Risks in Today
<< photo by Scott Webb >>
The image is for illustrative purposes only and does not depict the actual situation.

You might want to read !