Home > Security and Compliance Blog > Cybersecurity Risk Management > Nth-Party Risks Identified in RiskRecon and Cyentia Report Point to the Need for a Private Content Network

Nth-Party Risks Identified in RiskRecon and Cyentia Report Point to the Need for a Private Content Network

by Patrick Spencer updated December 14, 2023 Cybersecurity Risk Management

Reading Time: 5 minutes

Supply Chain Risks Pinpointed in New Report

Understanding the intricate web of third-party relationships and the risks they pose has never been more critical. The new report by Riskrecon and Cyentia, titled “Risk to the Nth-Party Degree: Parsing the Tangled Web,” sheds light on a crucial aspect often overlooked in risk management: the extension of vendor risk beyond immediate third parties. This blog post aims to guide security, risk management, and compliance leaders through the key findings and insights of this comprehensive report.

At the heart of this report is the concept of “nth-party” risk. Traditional risk management approaches often focus on direct, third-party relationships. However, businesses are enmeshed in a far more complex network of interconnected organizations. This “nth-party” risk extends far beyond direct vendors, is frequently invisible, yet harbors potential for significant and widespread consequences. The report underscores that attacks on any segment of this intricate network can trigger a domino effect, impacting multiple organizations simultaneously.

Surprisingly, the extent of nth-party risk is often underestimated. The report delves into the astonishing prevalence of these risks, highlighting how deeply and intricately supply chains are interconnected. This interconnectedness means that risks increase as one moves further away from core vendors. The farther the distance, the more diverse and potentially riskier the organizations become.

Expansive Nature of Supply Chain Risk

The RiskRecon report unveils a striking reality: Supply chains are not linear but form a vast web that often stretches to the eighth party and beyond. Remarkably, 87% of supply chains analyzed in the report reach this level, signifying a complex network where risk is not merely a third-party issue but an nth-party concern.

Moreover, the report highlights that most vendor risk is concentrated in the fourth and fifth-party tiers. This discovery is pivotal. It means that while the ripple effects of a supply chain incident might extend to distant tiers, the core of the risk often lies closer, within these intermediary layers.

The sheer volume of these connections is staggering. The median figures from the report show a typical organization dealing with 45 third-party vendors, 328 fourth-party entities, and an additional 301 fifth-party organizations. This exponential increase in numbers from the third-party tier to the fourth and fifth tiers (nearly 14 times more), underscoring the inadequacy of traditional supply chain risk management strategies that focus solely on direct vendors.

Deciphering the Web of Interconnectedness

The report also sheds light on the intricate web of recurring and interdependent relationships within supply chains. Over 80% of companies have recurring third-party connections, where their vendors also serve other partners. This interconnectedness means that an incident in one part of the supply chain can swiftly cascade through multiple layers, impacting operations far beyond the initial point of disruption.

A striking visual representation within the report illustrates this interdependence within a sample organization’s supply chain. It vividly demonstrates how incidents in third and fourth-party vendors can multiply risk exposure due to these overlapping connections.

Deeper Layers of Supply Chain and Rising Threats

As we delve deeper into the supply chain, the report reveals a worrying trend: a decline in oversight and an increase in vulnerability. There is a notable decrease in the level of discretion and rigor applied to partnerships as we move further from direct third-party relationships. This lapse in vigilance correlates with a significant rise in breach risk.

The cyber risk posture across these layers is telling. While 21% of third parties have experienced a breach in the past three years, this number declines for deeper relationships. However, starting from the fifth and sixth-party levels, many vendors receive only C or lower grades in terms of security, with 14.6% of fifth parties getting D and F grades.

In terms of supply chain diversity, the greatest variance emerges at the fifth and sixth-party levels. This diversity, while beneficial in some respects, correlates with an increased likelihood of nth-party breaches. This finding underscores a crucial point: diversity in supply chain can be a double-edged sword, offering resilience on one hand but introducing varied practices and potential vulnerabilities on the other.

Unraveling the Cascade Effect in Supply Chain Disruptions

The report provides a compelling analysis of how disruptions in the supply chain spread like wildfire. A single incident at a third or fourth-party vendor can trigger a domino effect, impacting a significant portion of the interconnected network.

The statistics are revealing: a breach at a third-party vendor affects, on average, 29% of interconnected vendors. The impact of a fourth-party breach is also significant, touching an average of 12.8% of third parties. Simulations in the report suggest that over a three-year period, a breach at a fourth-party level could potentially affect every single third-party vendor in the network.

This “viral” spread of incidents highlights the impracticality of approaches that focus on containment or isolation in an environment where partners are intricately connected. It emphasizes the need for a comprehensive perspective that acknowledges the potential for widespread impact from any breach within the supply chain.

Implementing Effective Supply Chain Risk Management Strategies

Acknowledging the complexity and expansiveness of nth-party risk, traditional risk management methods are insufficient. The report suggests several practical steps for a more comprehensive approach:

1. High-Value Vendor Identification

Identify and assess vendors that, if compromised, could significantly impact your operations or data security. Extend these assessments to their fourth and fifth-party networks to gain a more complete picture of potential risks.

2. Mapping Critical Intersections

Identify key points where a single vendor serves multiple partners. These nodes are crucial as they represent potential hotspots for risk propagation.

3. Automated Risk Monitoring

As new vendor partnerships are formed, implement automated monitoring systems. This dynamic approach allows for real-time visibility and responsiveness as the attack surface evolves.

4. Resource Allocation

Distribute security oversight resources more evenly across the supply chain tiers. Concentrating solely on primary, direct vendors leaves significant vulnerabilities unaddressed in lower tiers.

Use a Private Content Network to Reduce Supply Chain Risks

Kiteworks-enabled Private Content Networks facilitate the reduction of data security risks in supply chains by providing secure file sharing and collaboration, robust policy controls, and detailed audit logs. The platform’s secure file sharing capability is vital in mitigating supply chain vulnerabilities, especially when transferring sensitive information. By employing encryption, it ensures the confidentiality and integrity of data during transit and storage.

Zero-trust policy management in Kiteworks enables organizations to enforce compliance with various regulations, such as NIST 800-171, further strengthening the security posture against third-party risks. Moreover, detailed audit logs provided by Kiteworks offer transparency and traceability, allowing organizations to monitor and analyze data exchange activities. This comprehensive approach to data security not only safeguards against breaches but also enhances regulatory compliance within the supply chain.

Report Insights Demand Action

If anything, the report from RiskRecon and Cyentia understands that supply chain risk is far more complex and interconnected than previously acknowledged. Report Insights serve as a clarion call for an expanded, more nuanced approach to supply chain risk management. By embracing a comprehensive strategy that includes continuous monitoring and mitigation of threats across the entire supply chain ecosystem and comprehensive governance of sensitive content communications, organizations can significantly enhance their resilience and operational reliability in the face of inevitable disruptions.

For more information on the Kiteworks Private Content Network, schedule a custom-tailored demo today.

Additional Resources