Security Ratings have become integral for vendor risk management programs. In the case of vendor selection, these ratings allow organizations to get a sense of a third party’s security posture without prior engagement. Other assessments such as vulnerability scans and penetration tests usually require prior consent from the third party. As regulations around third party risk management have increased in numerous industries, organizations are increasingly turning towards automated security ratings as a means of monitoring third party security.
Other security rating uses cases include:
- Reporting To The Board: A company's board must do its part to secure the future of the organization. In Cybersecurity: What the Board of Directors Needs to Ask, a 2014 study by The Institute of Internal Auditors Research Foundation, they found that only 14 percent of board respondents said they were actively involved in the company's cybersecurity preparedness. Vendor ratings have made it easier to present risk assessment to boards in an easy-to-understand format.
- Benchmarking Security Performance: Organizations, such as universities and private companies, are using security ratings to improve their security posture and mitigate cyber risk, especially against peer-to-peer file sharing networks.
- M&A Due Diligence: A data breach can happen right before or right after a company is acquired. But a rating can help you monitor the company until networks are combined, showing that the acquired company is in the same state of security from when you first started the acquisition process.
Security Ratings also offer a benchmark upon which a company and its vendors can improve, as well as create rating mandates that a company can ask a vendor to meet or exceed to keep the business they are contracted to do.
Some of the questions that a rating system should be able to answer, thereby helping you to better select vendors, include:
- Does the organization have controls in place to identify and prevent botnet infections?
- Is spam being sent from the organization’s mail servers?
- Has the organization prevented malware infections that can be designed to harvest data, abuse company resources and spread across a network?
- Are devices with potentially unwanted software, such as adware, spyware and remote access tools, on a network?
- Is the host trying to contact other services in an irregular manner?
- Are disclosed credentials circulating across the internet?
Ratings Provider Selection Process
When choosing a provider and its security rating service, you should look for three things:
- Objectivity — a rating should always be objective and unbiased and not tailored to any one particular business, company or industry.
- Verifiable Data— The data and all the underlying aspects behind the rating should be confirmable so that a company receiving a rating can understand what that rating means. Ratings should provide an accurate picture of an organization’s security posture, and this should be able to be verified by a neutral third party if necessary.
- Actionable Information— The rating should be able to be used to make critical business decisions, such as on-boarding a vendor, selecting a vendor or terminating an existing vendor relationship.
When looking at the rating system itself, the data quality is the first component to consider. Ask the ratings provider what kind of data feeds it is leveraging to create a rating and how sound they are.
Also, find out what kind of information is made available to customers, as well as other parties involved. A ratings provider should be responsibly disclosing data and not sharing any unwanted data that could put companies at risk.
Make sure the ratings platform is easy to use and allows for collaboration. If you are looking at a vendor’s security rating and it shows it had a security event on the network, you should be able to collaborate within the rating platform to ask why the infection occurred. Or perhaps a company using a ratings vendor notices an infection on its guest network and wants to convey the explanation of how its guest network is segregated from its core network to the companies with whom it does business. That too should be possible and is an essential part of the ratings platform. This kind of clarity is invaluable for the vendor selection process. Without this context, businesses may be making vendor selection decisions with a limited or inaccurate view of a company’s security posture.
Along with excellent customer service to answer any security ratings questions, the rating system should have an appeals process. If a business sees a rating that it believes is inaccurate, perhaps due to an IP mapping issue, it should be able to ask to have the rating reviewed.
A rating service platform should be easily understood and intuitive. The platform should be easy for anyone using it, whether you are a risk professional talking to your board or a board-level executive talking to your security engineers.
For more information about security ratings, visit bitsight.com, or download its guide: A Security Manager’s Guide to Vendor Risk Management.
