Where are organizations going wrong in their third-party and supply chain risk governance programs? And what's the potential impact of those missteps, especially during the COVID-19 crisis? I'm Marianne Kolbesec-McGee, Executive Editor at Information Security Media Group. Today, I'm speaking with Brenda Ferraro, a Vice President at third-party risk management firm Prevalent and a former Aetna CISO at the company's Meritain subsidiary.
So, Brenda, from the perspective of being a former CISO, where do you think organizations go wrong in their third-party and supply chain risk governance programs and why? So a couple of things, actually. One of the things that I always thought about as a CISO was what is my role? And my role was to know, mitigate, reduce all the risks that were on my portfolio and do that in an economic, scalable, and efficient way.
And the way that I see this being a disconnecting gap in some of the programs that are being developed today is that when they're thinking of risk management versus risk governance, those are two different things. Managing a risk and governing a program needs to be looked at as, okay, here I'm going to governance the ability to measure my key performance and my risk indicators for the program and identify the risk-based decisions that need to be made in efforts to be more efficient throughout time while I'm maturing that management program. And another thing is that we've got some convoluted taxonomies and glossary of terms that are being used today. There's continuous monitoring.
There's continuous evaluation. There's continuous assessments. And basically what tools give you the information that you need to know in order to do those types of services. And then finally, I would say that we're not doing a great enough job at performing or conducting incident response scenario-based tests.
The only way for us to have muscle memory on knowing exactly how to react if something were to go wrong with either the vendors or supply chain or third parties that we're using, how that's going to impact our business, what departments need to be involved, is to have those scenario-based tests and efforts to know what things we can improve upon in the event that something were to happen to us. So Brenda, as the nation deals with the COVID-19 crisis, many sectors are under stress, but probably none more so than the healthcare sector. Based on your experience as a CISO at a healthcare sector company, how do you see supply chain and third-party risk governance programs playing out right now during this crisis, especially missteps that could have or should have been avoided? So what we need to look at is the business resilience of your program.
Do you know the vendor universe that you have in your portfolio? Have you performed assessments and are those assessments identifying risks that based off of your risk appetite and or tolerance within your company? In the event that someone is impacted or a business is impacted, have you looked at the most critical information that's going to give you what you need to make a decision based on, do I pivot my work to another company? Do I have bench strength of multiple companies providing the same service?
Is a business unit within my company going to be impacted by another company not being available? Are there key resources that provide a type of service that no one else knows how to do? And if that resource either gets sick or is not able to work for whatever reason, how are we going to get that service accomplished? And then looking at it from a supply chain perspective, am I going to be able to get the supplies that I need in efforts to give a service or a product to the ecosystem of businesses and or users?
So for example, if there is a pharmaceutical company that has a particular type of medicine that is using a particular type of vial and or container to get that medicine out, how are we going to make sure that if that company is a single point of failure, if they close, that we would still be able to get that medication to where it needs to go? And that's just one example out of many. But I really worry with my CISO hat on, if I were to be impacted by either a company that's providing me a critical service or a product, what would happen if that service or product isn't going to be available in the future? So Brenda, building upon that, you mentioned maybe a supplier not being available.
What about security incidents involving the supply chain? We hear so much about ransomware attacks and a lot of these attacks seem to be surging related to COVID-19. Sort of looking ahead, any lessons that you see emerging out of being prepared for these sorts of attacks on the supply chain potentially in a time of crisis? Yeah, you're listening to the media talk about here are some of the ways that adversaries or hackers are getting to individuals by doing phone calls or click scenarios that's going to cause them to either lose data or even just provide data over the phone.
The same thing happens with companies that you've decided to do business with by protecting the data. Hackers are going to use this particular threat landscape that's environmental to us as a ploy in efforts to go after our data in many multifaceted facets. So for example, there could be a email that comes out from a company that's asking for information. So we still have to watch those phishing attempts.
There also could be some items where the hackers have advanced persistent threats sitting there waiting for us to be weak and vulnerable in our security to steal our data and use it either maliciously or just to have for financial purposes and gain for them. So in my incident response, I also had an incident response position for over two years. My brain automatically starts thinking as a CISO as, okay, I'm dealing with this situation over here, but it leaves me vulnerable to the hackers and what they may want to take advantage of based on the fact that we've got so much cycle time towards dealing with the now versus what could be happening in the background. So Brenda, again, the healthcare sector is in this midst of chaos here in response to this crisis.
Are there some critical steps that healthcare entities can take midstream right now to improve their third party supply chain and risk governance programs as they're going through this? Yeah, you need to start thinking about the different security controls that are important for the way that we're living today. Work from home is a really interesting security domain that has become the way of life. And in efforts for us to better secure our work from home environment and all of our resources working from home, you have to now step up your game on how are you protecting the network?
How are the users and access being uplifted to be protected? Do you have VPN access? Are you putting controls on certain ways that information is either coming in or out of your network based on all of these work from home environments? Are your laptops encrypted?
Are you doing encryption of data in transit and at rest? So we haven't really been seeing a shift in the criticality of the security domains of multi-factor authentication and encryption and the like. But what we have been seeing is that we're now looking at other venues of work platforms that need to have wrapped security controls and key controls implemented in efforts to make sure that we're not weak and vulnerable based on the new way of working. And Brenda, once the COVID-19 crisis ends, what are your predictions in terms of the types of lessons we might see emerging about third party and supply chain risk?
Interestingly enough, I'm hearing from a lot of the industries and it's not even just the small or medium or large size companies. As a whole, we're identifying that we've been driven by compliance and a lot of our companies are not driven by risk. So we will see a shift in risk becoming just as important as compliance. We're also noticing that our third party risk governance and management programs, majority of the companies are having information that's less than five years old.
So they've only been doing assessments for five years. They're starting to see a focus where they've been looking at their critical top tier third parties and they need to look at the medium and the low tiered third parties and supply chains because they are just as important. And you're also going to see a big risk and maybe even the regulators coming at us asking for how do you know your nth party of security posture? Are you really looking past just the engagement and the relationship with a company you have contracted to do the service and provide products?
But do you know how far that reaches? Where is the breadcrumb trail leading and where is it ending? So that if something happens to any of those entities, you're able to lift and shift in efforts to stay afloat. There's also going to be a lot of companies that look at where am I in my maturity of my third party risk program?
How can I evolve on my journey to be more economical, more scalable? I may be doing things very well, so it'll be seeing companies doing maturity assessments and then really looking at business resilience. That seems to be the focus today and it will continue to lead into tomorrow. But understanding what do I need to do based on if there is an impact of a service or a product and if that service or product is not available, how do I know quickly how that impacts my departments, my enterprise or my business in efforts to continue doing business?
Thanks, Brenda. I've been speaking to Brenda Ferraro. I'm Marianne Kolbysak-McGee of Information Security Media Group. Thanks for listening.