Are contractors the weak link in your security chain?

Filed Under: Data loss, Featured, Security threats

Weak link image courtesy of ShutterstockA few weeks ago, the US Department of Defense issued a press release announcing new rules for the private-sector firms it deals with. Contractors will be required to maintain "established information security standards", and report breaches that result in data loss.

The story was covered by Reuters and a few other press outlets, with minimal fanfare.

So far so unsurprising, you might say. We'd expect arms dealers and other firms involved in the defense industry to maintain good security practices.

It would be a bit of an eye-opener to hear our governments saying to banks, "Please keep your cash in vaults, not plastic bags." Or saying, "Hey hospitals, when you have blood-stained waste, don't leave it lying around the cafeteria, dispose of it safely."

The odd thing here is not that the DoD has set these rules, but that it's had to do so now. In 2013.

Not, say, 20 years ago when people were starting to use computers to create, store and share sensitive information of the sort that defense firms routinely deal with.

Not, perhaps, five years ago when state-sponsored hacking and online industrial espionage started becoming big news. But now, long after the requirement for cyber security became, you might think, fairly obvious to everybody.

Admittedly, the new rules mainly cover "unclassified controlled technical information" and networks that hold such data. Presumably anything considered "classified" will already be covered by much stricter regulation. But still, the unclassified stuff could well be pretty sensitive.

Defense firms are a treasure-trove for hackers. For a start, there's an insane amount of money involved - on the same day as the rules were announced, the Pentagon granted a $5.3 billion contract, while a day that saw $109 million worth of deals done can be called "slow".

There are also a lot of secrets, both technical information of the sort targeted by nation-state-sponsored or industrial espionage hackers, and politically-sensitive data like the hoard harvested by Mr Snowden.

Everyone should be taking at least industry standard precautions

So they should expect their networks to be the target of attacks, and secure them appropriately. If you're a small firm that doesn't hold much valuable technical or financial information, you should be taking "industry standard" precautions just in case. If you're dealing in valuable technology and handling large amounts of money, you should perhaps be going several steps further than this.

And you should have been doing so for years. Ideally, in fact, from before you connected your first computer to the internet.

The problem here seems to exemplify the way security has been applied to the computer world, not as a basic first step integral to how everything else works, but as an optional add-on.

The Windows systems most of us are using may have a lot of security features these days, but for the most part they're tacked on to the original design.

Linux, Unix and Mac OS platforms are seen by many as inherently more secure, and they may have a more ground-up attitude to security, but many aspects of this are still dependent on circumstances and need to be properly applied, something which seems to come far down the priority list in many organisations.

"Get it working" comes first, "get it working securely" only later on.

How do we expect our contractors, visitors and supply chain to behave?

I'm sure the DoD has been maintaining strict cybersecurity internally for a long time now. The worry is that it's only now that it has demanded similar precautions from the firms it outsources work to.

Everyone we do business with, share data with, outsource operations to, sell things to or buy things from forms a part of our own security chain. A breach at any point in the chain can have an impact on the privacy and integrity of our data.

So we should demand the same levels of security from all of them that we expect to maintain ourselves. Security should be part of any negotiation for new business, any contract that we enter into, ensuring that those we deal with are doing things right and not putting us at risk through their own sloppiness.

This applies to individuals as well as firms. We should be considering the security of the websites we give our information to, be they online businesses or banks, government portals or social tools and networks. We should be giving this consideration the weight it deserves. "Is it safe?" should be only a fraction below "Does it do what I need?" in our mental processes.

We should be demanding more openness from third parties too. Everyone should be required to confirm their conformity with security best practices, and rapidly inform the world of any incident which may have jeopardised the security of data they hold.

If we can all get it into our heads that security is a basic requirement, not an optional extra, maybe we'll all live safer and happier lives.

Image of weak link courtesy of Shutterstock.

, , , ,

You might like

6 Responses to Are contractors the weak link in your security chain?

  1. Anonymous · 625 days ago

    It never ceases to amaze me how few vendors understand or care for security. In my current position includes vetting vendors who will be processing or storing our information. Most begin cordially saying that they are HIPPA compliant, SSEA16, and follow "Industry Best Practice." Apparently others in our industry use these as "code words," giving any company that issues them a free pass. After 30 seconds of asking actual questions regarding their controls, considerations, and implementations, it becomes apparent that they are doing absolutely nothing and have no idea what any of it means.

  2. Anonymous · 625 days ago

    Before I retired about 12 years ago our company had started to contract out or bus-contract union jobs. I was not in anything like the DOD, but in the communications field. From the first out-sourcing of jobs, we were correcting incorrect information given to customers or correcting their accounts & bills. Trying to keep the customer happy and still stay within company guidelines. I don't think most of the contract companies had any set guidelines.
    Most contract companies only see the money, they have no loyalty.

  3. Doug · 625 days ago

    I was contracting for over 35 years and was always held to much tighter standards than permanent staff, but it doesn't surprise me to see contractors under the hammer again based purely on paranoia. If a contractor is found to have offended in some way, they are usually walked off the site: What I'd like to know is: What happens to their supervising manger and the Personnel/HR person also involved?

  4. Blake · 625 days ago

    Hello, you used horde instead of hoard.

  5. Dave Gill · 624 days ago

    Great article

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

John Hawes is Chief of Operations at Virus Bulletin, running independent anti-malware testing there since 2006. With over a decade of experience testing security products, John was elected to the board of directors of the Anti-Malware Testing Standards Organisation (AMTSO) in 2011.