1

Let's say a software company XYZ is using a variety of 3rd party vendors - as an example, it could use:

  • Lastpass as a company password manager;
  • Azure B2C as the authentication framework for the company's software product,
  • AWS S3 as storage for this software,
  • New Relic as a log solution for this software.

What are the possible approaches to monitoring for security incidents / vulnerabilities within Lastpass / Azure B2C / S3 / New Relic / etc similar 3rd party vendors., so that XYZ can learn about these vulnerabilities as soon as they're published, and not accidentally when scrolling through Twitter feed 1 month after a vulnerability was made public? How do companies solve this problem? Are there free/low-cost solutions to this problem? CVE databases like cvedetails.com don't keep track of such security incidents (neither recent Lastpass nor Azure B2C security issues were given a cve and listed there).

2
  • 1
    A software company that cares about security will have a head of security that is responsible for subscribing to the vendors' security bulletins, monitor advisories, and following sites that publish issues. It's their job.
    – ThoriumBR
    Commented Apr 11, 2023 at 23:06
  • @ThoriumBR thanks, but this is a bit generic answer. Is this done by listing all such 3rd party dependencies and finding an bulletin for each, or are there good aggregators out there for such information, with subscription/alerting functionalities so that it doesn’t require a person to check multiple websites daily? Commented Apr 12, 2023 at 5:48

2 Answers 2

0

Any company that takes security seriously have a head of security, or someone tasked with keeping updates from the security of their products. If the company is small, this individual will have to check everything by himself. If the company is a little larger, they can pay someone else to do the checking: vulnerability monitoring services.

There are several companies offering vulnerability monitoring: they usually have a scanner (or several) running on your infrastructure and listing all products and versions, and all components and libraries you use on your infrastructure.

If any component is found to be vulnerable, the security dashboard will be updated to reflect that. Then it's on the company to decide if they will update, and when.

Most companies don't have a clean security dashboard. Some vulnerabilities are considered too difficult to exploit and troublesome to fix, so they are left. Some companies use obsolete products that will not be updated. Some depend on a behavior that changed on the new versions, so they keep the old one.


(If you search around, you will find several companies that you may have heard of: Rapid7, Tenable, Nexpose, Qualys, Falcon. They usually publish findings on products they monitor, and their reports are great for learning how vulnerability discovery works.)

0

Since you are talking about products/services provided by others, and not things that you have direct control over, the term you are looking for is "Third Party Risk Management" (TPRM).

As part of that, there are

  • tools that keep watch over your vendors' news and announcements and alert you of new events
  • questionnaires that you can regularly send vendors to query them directly on specific or generic security concerns (e.g. "have you patched log4j?", "have there been security announcements over the past quarter?", etc.)
  • SLAs and contracts that can require that your vendors notify you of security-related events

TPRM is a 'newish' field and responsibility is often shared between the security and procurement departments.

Keeping track of all your vendors and all the possible things that could go wrong with each of their products is a complex task, so there is no single tool or approach that will cover an organisation's needs. It tends to be a mix of automated and manual processes.

2
  • @littlebobbytables the answer you accepted is only applicable for systems over which you have control. But you cannot vulnerability scan Lastpass / Azure B2C / S3 / New Relic, as you mention in your question.
    – schroeder
    Commented Apr 13, 2023 at 20:25
  • I found both answers insightful, I tried to mark both as accepted but seemingly there's a limit of 1 accepted answer so only the last one marked like that stays accepted. I do find it insightful that I could scan my cloud provider instance to identify the services I'm using & get notifications of their security issues (if indeed it works correctly + it feels quite scary to let them scan my premises). I find your answer insightful for introducing the TPRM term - are there tools you'd recommend in this space, something where I could subscribe for e.g. Lastpass/NewRelic alerts? Commented Apr 14, 2023 at 9:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .