The most popular and comprehensive Open Source ECM platform
Let us know more
Security Breaches: Third-Parties Often to Blame in Increasing Number of Hacking Incidents
Recently, data breaches and hacks are being announced on a regular, if not daily basis. There was the Equifax hack. The SEC. Yahoo’s disclosure that their hack was even bigger than originally announced. Forrester Research announced that their industry research was recently hacked too. The list goes on.
Many of the breaches that are occurring now aren’t the direct fault of the company whose data is being lost or exposed. The Forrester Research incident, for example, was a loss of data that was hosted on the site Disqus. That’s not to say that Forrester should be off the hook, but it highlights the fact that managing security is difficult, especially when there are multiple entities involved. Disqus had already been hit by a data breach in 2012. The most recent Disqus breach exposed 17.5 million records.
A study by Ponemon found that fifty-six percent of cyberattacks involved vulnerabilities introduced by third parties. The most common result of these hacks is that company sensitive or confidential information is abused. Three-quarters of organization said that they think that the number of breaches occurring due to third party involvement is increasing.
George F. Colony, chairman and chief executive officer of Forrester, said that “we recognize that hackers will attack attractive targets — in this case, our research IP. We also understand there is a tradeoff between making it easy for our clients to access our research and security measures. We feel that we have taken a common-sense approach to those two priorities; however, we will continuously look at that balance to respond to changing cybersecurity risk.”
Kevvie Fowler, a cyber security expert, said that “cyber criminals are increasingly targeting third parties that can serve as an easier attack vector to their clients data. There have been several high profile examples such as law firms and cloud providers, who were targeted by criminals looking for sensitive data of one of the suppliers clients. Aggregators such as insurance providers and regulators who have a lot of sensitive data belonging to several clients are also at risk.”
