Vendor Security Review. When is it overkill?

Question

Looking for everyone's opinion here. One of my buddies was doing a vendor security review for a company that sells different types of software. The software allows you to create 3D models for home and office design (think HGTV home improvement). This software is installed locally on either a Win or Mac client.

From what he told me about the company, they do collect/handle PII and process credit card information. He also said, the company doesn't have PCI or ISO 27001 cert nor are they looking at getting it done.

He even went as far as asking them if they do any secure code review and secure coding practices for which they said they don't do any of that.

My question is, did he go too far with these questions to the vendor? I guess, when is it going overboard? Based on what the vendor said, is this a bullet that his company is potentially dodging?

To me, it's a software that just makes 3D models of homes or office. I'm on the fence.

Answer 1

To me, it's a software that just makes 3D models of homes or office.

To me, it is a software which is installed on a local machine inside the local network. Thus any vulnerabilities in the software will affect the security of the machine and of the local network.

And having access to the local network in a company or agency usually allows a wide range of attacks, from infiltrating infrastructure, leaking secret company information, leaking sensitive information, extorting ransom, ... but also attacking other companies using established trust relationships.

Such supply chain issues are a major problem and there were a lot of these in the past, like explicit backdoors implemented by attackers in network monitoring software (Solarwinds 2020) or in VPN products and firewalls (Juniper 2015), critical bugs which essentially opened a backdoor in mail infrastructure (MS Exchange Proxylogon 2021) or products for remote management (Kasyea VSA 2021) ...

Checking out the internal security and the development processes of a supplier (i.e. software vendor or service provider) is thus a relevant step in assessing the risks which comes with installing a new software. Most unfortunately just blindly hope that the supplier will be fine, often because they would have no alternative to use a better supplier anyway. Only there are usually not enough incentives for the supplier to provide sufficient security, since there is usually very limited liability and the customer is the one taking almost all risks and damages.

Answer 2

From what he told me about the company, they do collect/handle PII and process credit card information. He also said, the company doesn't have PCI or ISO 27001 cert nor are they looking at getting it done.

I suppose they are talking about the website, which is something completely different than the software they are selling. The company may also be processing credit card transactions through a processor, which means they may not have to fulfill all PCI requirements.

He even went as far as asking them if they do any secure code review and secure coding practices for which they said they don't do any of that.

At least the company is honest :) Perhaps try to engage with them and steer them in this direction if they are open to the idea ? But you need to have this discussion with the right people, that is the developers and the technicians. Not the sales rep who is very likely clueless and unable to provide the qualified answers you are looking for.

My question is, did he go too far with these questions to the vendor? I guess, when is it going overboard? Based on what the vendor said, is this a bullet that his company is potentially dodging?

I don't think he went too far, he simply did not behave like an ordinary client. If you are going to install proprietary software on your machines it's perfectly legitimate to inquire about security.

There are things you can do on your end like containerize the application, although I am more familiar with Linux solutions than the Windows environment. You could even use virtual machines or intermediate solutions such as Docker. Perhaps you might even want to use a dedicated computer too.

Realistically, the application will probably require Internet access for updates, and even then you may restrict access to a few whitelisted IP address that the vendor should be able to provide. Assign a VLAN which is separate from the VLAN where the crown jewels are. The application may also need access to a network drive for your blueprints or other work materials. So you create one, with the right ACLs. A supply chain attack is always possible but can be contained and limited.

Answer 3

It comes down to risk appetite.

If your company processes highly confidential data or requires a high integrity of the computing environment the company will likely have a rigorous process of onboarding software even if the software vendor cannot receive data that is processed in the software. One goal of such a process can be making sure that the vendor is capable of securing its own perimeter in order to reduce the likelihood of a supply chain attack.

Such a company would likely have enough people to support such a rigorous onboarding process. But in case it doesn't then risk appetite comes again. If the volume of such software that need to be onboarded is larger than what the team can handle, management has the possibility of accepting the risk because the risk persists instead of hiring more people for the onboarding team.

One interesting consequence of this is that now you might enable automatic updates instead of testing each new software version in an isolated test environment for suspicious behavior. Of course such tests aren't that sensible because malware might just sleep a bit until it is activated.

Other companies might have assessed the risk and concluded that the risk is negligible for the data they process or the service they provide.

Answer 4

Actually, it might be required by some laws or regulatory documents for certain companies / economy sectors, but I am not aware about such things, so I will answer simply from my personal PoV.

As I see it, primary focus in organization should be on implementing proper security architecture, security policies, security controls, and security checks. And rigorous supply vendor checks is actually an overkill for pretty much every company.

If you are certain that your architecture is well-designed and properly implemented, your policies are well-written and are actually enforced to a proper degree, your controls are properly configured, security monitoring is effective, and all these points are regularly checked, well-documented, and kept up-to-date with modern threats - then only should you look at rigorous vendor checks. Otherwise, just build up a short checklist for vendors - and it would be more than enough, as you have better areas to invest time & effort of cybersecurity team.