Top Threat #5 - Third Party Tango: Dancing Around Insecure Resources

Written by CSA’s Top Threats Working Group.

In this blog series, we cover the key security challenges from CSA's Top Threats to Cloud Computing 2024. Drawing from insights of over 500 experts, we'll discuss the 11 top cybersecurity threats, their business impact, and how to tackle them. Whether you're a professional or a beginner, this series offers a clear guide to the evolving cloud security landscape.

Today’s post covers the #5 top threat: Insecure Third-Party Resources.

What is Cybersecurity Supply Chain Risk Management?

Cloud computing relies heavily on third-party resources, from open-source code to SaaS products. These third-party risks, also known as supply chain vulnerabilities, can impact your cloud services and applications.

Cybersecurity Supply Chain Risk Management (C-SCRM) focuses on managing these risks to safeguard against breaches–especially as two-thirds of breaches stem from third-party vulnerabilities. Since even a single weak link, like a small supplier, can be exploited, securing every component of your supply chain is essential.

Consequences & Business Impact

Insecure third-party resources can create significant risks across multiple areas:

• Technical Impact: Unauthorized access can lead to data disclosure, compromising confidentiality, or data destruction, resulting from improper code refactoring.
• Operational Impact: Delays or unpatched vulnerabilities in third-party resources can disrupt production systems, causing outages.
• Financial Impact: Non-compliance by a third-party can result in fines, penalties, and legal liabilities for your organization.
• Reputational Impact: Publicly disclosed breaches caused by insecure third-party resources can damage customer trust and the company’s reputation for protecting sensitive information.

Mitigation Strategies

While no software is completely secure, organizations can take steps to minimize risks:

• Choose Wisely: Use officially supported third-party resources with compliance certifications, transparent security efforts, bug bounty programs, and a responsible approach to security fixes.
• Track Resources: Use Software Composition Analysis (SCA) to build and maintain a Software Bill of Materials (SBOM) or SaaSBOM. Monitor all third-party resources, including open source, SaaS, and cloud providers, to avoid surprises from vulnerabilities.
• Review Regularly: Conduct periodic reviews of third-party resources. Remove unnecessary products or outdated versions with security issues, and audit access grants to critical systems.
• Collaborate with Suppliers: Ensure suppliers have the training and tools to perform automated security testing on their applications.

To learn more about the top threats and explore strategies for mitigating these risks, download the full Top Threats to Cloud Computing 2024 here.