In cybersecurity, vendor-managed assets are any hardware or software components within your organization's IT environment owned, managed, and maintained by a third-party vendor. These assets range from network devices and servers to software applications and cloud services.

Here are some key characteristics of vendor-managed assets:

• Ownership: The vendor retains ownership of the asset, even though it's deployed within your environment.

• Management: The vendor is responsible for the asset's operation, maintenance, and security.

• Access: You may have limited or no direct access to the asset's configuration or underlying infrastructure.

• Visibility: It can be challenging to gain complete visibility into the security posture of vendor-managed assets.

Examples of vendor-managed assets:

• Network devices: Firewalls, routers, and switches provided and managed by a telecommunications company.

• Servers: Physical or virtual servers hosted and managed by a cloud provider.

• Software applications: SaaS applications like CRM, email, or productivity suites.

• Security tools: Intrusion detection systems, security information and event management (SIEM) solutions, or vulnerability scanners managed by a third-party security provider.

• Point-of-sale (POS) systems: Retail terminals and associated software managed by a payment processing vendor.

Why are vendor-managed assets important in cybersecurity?

• Expanded attack surface: Vendor-managed assets become part of your organization's attack surface, introducing potential vulnerabilities that attackers can exploit.

• Reduced control: You have limited control over the security of these assets, relying on the vendor to implement and maintain appropriate security measures.

• Visibility challenges: It cannot be easy to gain complete visibility into vendor-managed assets' configuration and security posture.

• Shared responsibility: Security becomes a shared responsibility between your organization and the vendor.

Securing vendor-managed assets requires:

• Due diligence: Carefully vet vendors before engaging their services and assess their security practices and track record.

• Contractual agreements: Establishing precise security requirements and responsibilities in contracts with vendors.

• Inventory and visibility: Maintaining an inventory of all vendor-managed assets and gaining visibility into their security posture.

• Regular assessments: Conduct security assessments of vendor-managed assets to identify and address vulnerabilities.

• Incident response planning: Collaborating with vendors to develop incident response plans that address potential security incidents related to their assets.

By effectively managing vendor-managed assets, organizations can mitigate the risks associated with third-party dependencies and ensure the security of their overall IT environment.

ThreatNG offers a comprehensive solution for managing the risks associated with vendor-managed assets. Here's how its features and capabilities address the key challenges:

1. Due Diligence and Vendor Assessment:

• ThreatNG's Security Ratings: Before engaging a vendor, you can use ThreatNG to assess their security posture and risk profile. The platform provides comprehensive security ratings based on various factors, including online presence, vulnerability exposure, and dark web presence. This helps you decide which vendors to trust with your assets.

• Supply Chain & Third-Party Exposure: This module allows you to analyze the security posture of your existing vendors, identifying potential risks that could impact your organization. You can gain insights into their technology stack, vulnerabilities, and overall security practices.

2. Contractual Agreements and Security Requirements:

• Policy Management: ThreatNG's features allow you to define and enforce vendor security standards. You can create custom policies that align with your organization's risk tolerance and contractual agreements.

• Reporting: ThreatNG generates detailed reports on your vendors' security posture, which can be used to track compliance with contractual obligations and identify areas for improvement.

3. Inventory and Visibility:

• Domain Intelligence: This module helps you discover and map all internet-facing assets associated with your vendors, including subdomains, IP addresses, certificates, and exposed APIs. This provides a comprehensive inventory of vendor-managed assets within your environment.

• Cloud and SaaS Exposure: ThreatNG identifies cloud services and SaaS applications used by your vendors, providing visibility into their cloud assets and potential misconfigurations.

4. Regular Assessments and Vulnerability Management:

• Continuous Monitoring: ThreatNG continuously monitors the security posture of your vendors, alerting you to any changes or emerging threats that could impact your organization.

• Known Vulnerabilities: The platform identifies known vulnerabilities in your vendors' systems and applications, allowing you to address potential risks proactively.

• Sensitive Code Exposure: This module scans public code repositories for exposed credentials, API keys, and other sensitive information that could compromise your vendors' systems and, indirectly, your environment.

5. Incident Response Planning:

• Dark Web Monitoring: ThreatNG scans the dark web for mentions of your vendors, leaked credentials, and planned attacks, providing early warnings of potential incidents.

• Collaboration and Management: ThreatNG facilitates collaboration between your security team and your vendors through features like Correlation Evidence Questionnaires. This helps streamline communication and ensure a coordinated response to security incidents.

Complementary Solutions:

ThreatNG can integrate with existing security tools to enhance your management of vendor-managed assets:

• Vulnerability Scanners: Integrate with vulnerability scanners to gain deeper insights into your vendors' systems and identify potential weaknesses.

• Security Information and Event Management (SIEM): Feed ThreatNG's findings into your SIEM to correlate external threats with internal security events and gain a holistic view of your security posture.

• Governance, Risk, and Compliance (GRC) Tools: Integrate with GRC tools to manage vendor risk assessments, track compliance with regulations, and streamline vendor onboarding processes.

Examples:

• Identifying a Vulnerable Vendor System: ThreatNG discovers that a vendor's firewall is running an outdated firmware version with known vulnerabilities. You can then notify the vendor and work with them to update the firmware and address the risk.

• Responding to a Data Breach at a Vendor: ThreatNG's dark web monitoring identifies leaked credentials belonging to vendor employees. You can immediately notify the vendor and take steps to contain the breach, potentially limiting the impact on your systems.

• Enforcing Security Standards: ThreatNG helps you enforce security standards by identifying vendors not compliant with your policies. You can then work with them to remediate any issues and ensure they meet your security requirements.

By providing comprehensive visibility, proactive risk assessment, and continuous monitoring of your vendors' security posture, ThreatNG empowers you to effectively manage vendor-managed assets and mitigate the risks associated with third-party dependencies.