A hidden risk that quietly sabotages businesses and personal data: vendor information-security posture. Sloppy public-facing security can be a silent sales-prevention department and how weak governance lets problems linger for years.
A rapid, objective vendor risk assessment (sometimes as little as $300) can reveal whether a vendor will protect your secrets or cost you thousands in wasted time. Tune in to learn the questions to ask, why you must stop delegating oversight, and how to choose vendors that reduce — not amplify — your risk.
Summary
Vendor Risk Management and Security
Felicia discussed vendor risk management, specifically focusing on information security risks associated with vendors. She explained how poor vendor risk management can negatively impact both organizations and vendors, where a weak security posture turns off prospects. Felicia emphasized that vendors need to be assessed and maintain a good public-facing information security posture to reduce barriers to doing business.
Website Security Investment Challenges
Felicia discussed the challenges organizations face with their public-facing information security posture, particularly noting that many don't realize how many contacts are not being made through their websites. She explained that professional website management requires significant investment and cannot be outsourced effectively, as it involves comprehensive tracking of website engagement and content performance. Felicia emphasized that outsourcing all website security typically leads to poor results.
Vendor Risk Management Challenges
Felicia discussed the challenges of seeking low prices from web service providers, which often results in limited and inadequate service scope. She highlighted the importance of operational maturity and vendor risk management, particularly in contexts where vendors might access sensitive data, such as with law firms handling business or individual information.
Vendor Risk Assessment Best Practices
Felicia discussed the importance of conducting rapid vendor risk assessments, particularly for firms handling sensitive data. She highlighted that excessive access to data by personnel not directly servicing the account is problematic and emphasized the need for limited access even for large organizations. Felicia noted that while AI tools attempt to perform analyses, they are often inaccurate and lack contextual judgment. She suggested investing in assessments, which can cost as little as $300, to ensure the security of sensitive information and recommended looking for indicators of good governance and oversight in organizations.
Independent Business Problem Assessment Strategy
Felicia compared managing business challenges to a bus driver situation, arguing that when a problem driver is identified, they should be removed from driving the bus rather than being asked to assess themselves. She emphasized that organizations often make the mistake of delegating complex issues to IT personnel without proper independent assessment, which she described as "delegating and abdicating" responsibility. Felicia noted that assessments are relatively affordable, with baseline assessments costing around $300 and more detailed ones around $5,000, while often revealing $100,000 worth of issues in a $10,000 engagement.
Information Security in Service Providers
Felicia discussed the importance of evaluating companies providing sensitive services, emphasizing the need to assess their information security posture beyond just price and coverage. She highlighted the prevalence of incompetence among service providers and warned against starting the evaluation process with price alone, particularly for sensitive services like insurance. Felicia specifically cautioned against using insurance brokers who may not have adequate information security measures in place.
Insurance Industry Security Concerns
Felicia discussed security concerns in the insurance industry, highlighting issues with data access controls and authentication at both brokerage and insurance company levels. She explained how inadequate security measures, such as the lack of multi-factor authentication in customer portals, expose sensitive personal information to potential compromise. Felicia questioned the validity of the shared responsibility model, arguing that it shifts blame to consumers for security issues largely beyond their control.
Insurance Reimbursement Challenges
Felicia discussed the challenges of getting reimbursement for identity theft and insurance claims, highlighting how insurance companies create complex and time-consuming processes that can cost victims significantly more than the actual claim amount to navigate. She provided an example of someone who has been trying to recover $11,000 from an insurance company since May but has already spent approximately $20,000 in time and effort due to the company's requirements for documentation and paperwork.
Vendor Risk Assessment Discussion
Felicia discussed the importance of conducting thorough vendor risk assessments to understand the potential risks introduced by working with vendors. She questioned the value of casualty insurance and emphasized the need for objective data from experienced professionals to assess vendors' information security postures. Felicia highlighted that many security breaches go unreported, making it crucial to evaluate vendors' capabilities in securing data they hold or process on behalf of the customer.
https://media.gtc.edu/recordings/BreakfastBytes/BB-100326.mp3