A new report* by the Opus and the Ponemon Institute reveals that 61 percent of US companies surveyed said they have experienced a data breach caused by one of their vendors or third parties. What is even more alarming is that 22 percent of respondents admitted they didn’t know if they’d had a third-party data breach in the past 12 months and only 37 percent indicate that they have sufficient resources to manage third-party relationships.
“Consumer data is money and companies in general have lots of it. That data is also increasingly vulnerable to misuse and breaches, and, as a result, under growing regulatory scrutiny. With GDPR now in force, the California Consumer Privacy Act passed, and a new federal data privacy bill under review that criminalizes inaccurate or incomplete information on data privacy and security practices, companies will need to thoroughly map what data they collect—whether on their own or through vendors and third parties—how they use it, and whom they share it with. As businesses become increasingly dependent on third parties in gathering this data within their digital ecosystem, a good first place to start is knowing all third parties who keep their websites and apps running, what information they collect, the lifespan of their data gathering technologies (eg, cookies), and what security measures these third parties have in place. This is because websites and apps are often primary touchpoints for prospects and customers. Unfortunately, no industry standards require knowing anything about third party code; not even PCI DSS requires it even though most payment pages are supported by third parties and are being attacked by cybercrime rings like Magecart. In the post-GDPR world, managing risks from third parties is not only a data compliance strategy but a revenue strategy.”
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.