Cybersecurity and Third-Party Risk

Introduction

• Who Will Benefit Most from This Course?

What Is the Risk?

• The SolarWinds Supply‐Chain Attack
• The VGCA Supply‐Chain Attack
• The Zyxel Backdoor Attack
• Other Supply‐Chain Attacks
• Problem Scope
• Compliance Does Not Equal Security
• Third‐Party Breach Examples
• Conclusion

Cybersecurity Basics

• Cybersecurity Basics for Third-Party Risk
• Cybersecurity Frameworks
• Due Care and Due Diligence
• Cybercrime and Cybersecurity
• Conclusion

What the COVID‐19 Pandemic Did to Cybersecurity and Third‐Party Risk

• The Pandemic Shutdown
• SolarWinds Attack Update
• Conclusion

Third‐Party Risk Management

• Third‐Party Risk Management Frameworks
• The Cybersecurity and Third‐Party Risk Program Management
• The Kristina Conglomerate (KC) Enterprises
• Conclusion

Onboarding Due Diligence

• Intake
• Cybersecurity Third‐Party Intake
• Conclusion

Ongoing Due Diligence

• Low‐Risk Vendor Ongoing Due Diligence
• Moderate‐Risk Vendor Ongoing Due Diligence
• High‐Risk Vendor Ongoing Due Diligence
• “Too Big to Care”
• A Note on Phishing
• Intake and Ongoing Cybersecurity Personnel
• Ransomware: A History and Future
• Conclusion

On‐site Due Diligence

• On‐site Security Assessment
• On‐site Due Diligence and the Intake Process
• Conclusion

Continuous Monitoring

• What Is Continuous Monitoring?
• Enhanced Continuous Monitoring
• Third‐Party Breaches and the Incident Process
• Conclusion

Offboarding

• Access to Systems, Data, and Facilities
• Conclusion

Securing the Cloud

• Why Is the Cloud So Risky?
• Conclusion

Cybersecurity and Legal Protections

• Legal Terms and Protections
• Cybersecurity Terms and Conditions
• Conclusion

Software Due Diligence

• The Secure Software Development Lifecycle
• On‐Premises Software
• Cloud Software
• Open Web Application Security Project Explained
• Open Source Software
• Mobile Software
• Conclusion

Network Due Diligence

• Third‐Party Connections
• Zero Trust for Third Parties
• Conclusion

Offshore Third‐Party Cybersecurity Risk

• Onboarding Offshore Vendors
• Country Risk
• KC's Country Risk
• Conclusion

Transform to Predictive

• The Data
• Level Set
• A Mature to Predictive Approach
• The Predictive Approach at KC Enterprises
• Conclusion

Conclusion